Annexes to COM(2010)609 - Comprehensive approach on personal data protection in the EU - Main contents
Please note
This page contains a limited version of this dossier in the EU Monitor.
| dossier | COM(2010)609 - Comprehensive approach on personal data protection in the EU. |
|---|---|
| document | COM(2010)609  |
| date | November 4, 2010 |
The example of online social networking is particularly relevant here, as it presents significant challenges to the individual's effective control over his/her personal data. The Commission has received various queries from individuals who have not always been able to retrieve personal data from online service providers, such as their pictures, and who have therefore been impeded in exercising their rights of access, rectification and deletion.
Such rights should therefore be made more explicit, clarified and possibly strengthened.
The Commission will therefore examine ways of:
- strengthening the principle of data minimisation ;
- improving the modalities for the actual exercise of the rights of access, rectification, erasure or blocking of data (e.g., by introducing deadlines for responding to individuals' requests, by allowing the exercise of rights by electronic means or by providing that right of access should be ensured free of charge as a principle);
- clarifying the so-called ‘ right to be forgotten ’, i.e. the right of individuals to have their data no longer processed and deleted when they are no longer needed for legitimate purposes. This is the case, for example, when processing is based on the person's consent and when he or she withdraws consent or when the storage period has expired;
- complementing the rights of data subjects by ensuring ’ data portability’ , i.e., providing the explicit right for an individual to withdraw his/her own data (e.g., his/her photos or a list of friends) from an application or service so that the withdrawn data can be transferred into another application or service, as far as technically feasible, without hindrance from the data controllers.
2.1.4. Raising awareness
While transparency is essential, there is also a need to make the general public, and particularly young people, more aware of the risks related to the processing of personal data and of their rights. A Eurobarometer survey in 2008 showed that a large majority of people in EU Member States consider that awareness of personal data protection in their own country is low[20]. Awareness raising activities should thus be encouraged and promoted by a broad range of actors, i.e. Member State authorities, particularly Data Protection Authorities and educational bodies, as well as data controllers and civil society associations. They should include non-legislative measures such as awareness campaigns in the print and electronic media, and the provision of clear information on web-sites, clearly spelling out data subjects' rights and data controllers' responsibilities.
The Commission will explore:
- the possibility for co-financing awareness-raising activities on data protection via the Union budget;
- the need for and the opportunity of including in the legal framework an obligation to carry out awareness-raising activities in this area.
2.1.5. Ensuring informed and free consent
When informed consent is required, the current rules provide that the individual's consent for processing his or her personal data should be a ‘freely given specific and informed indication’ of his or her wishes by which the individual signifies his or her agreement to this data processing[21]. However, these conditions are currently interpreted differently in Member States, ranging from a general requirement of written consent to the acceptance of implicit consent.
Moreover, in the online environment – given the opacity of privacy policies – it is often more difficult for individuals to be aware of their rights and give informed consent. This is even more complicated by the fact that, in some cases, it is not even clear what would constitute freely given, specific and informed consent to data processing, such as in the case of behavioural advertising, where internet browser settings are considered by some, but not by others, to deliver the user's consent.
Clarification concerning the conditions for the data subject's consent should therefore be provided, in order to always guarantee informed consent and ensure that the individual is fully aware that he or she is consenting, and to what data processing, in line with Article 8 of the EU Charter of Fundamental Rights. Clarity on key concepts can also favour the development of self-regulatory initiatives to develop practical solutions consistent with EU law.
The Commission will examine ways of clarifying and strengthening the rules on consent .
2.1.6. Protecting sensitive data
The processing of sensitive data, i.e. data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life, is currently already prohibited as a general rule, with limited exceptions under certain conditions and safeguards[22]. However, in the light of technological and other societal developments, there is a need to reconsider the existing provisions on sensitive data, to examine whether other categories of data should be added and to further clarify the conditions for their processing. This concerns, for example, genetic data which is currently not explicitly mentioned as a sensitive category of data.
The Commission will consider:
- whether other categories of data should be considered as ’sensitive data’ , for example genetic data;
- further clarifying and harmonising the conditions allowing for the processing of categories of sensitive data.
2.1.7. Making remedies and sanctions more effective
In order to ensure the enforcement of data protection rules, it is essential to have effective provisions on remedies and sanctions . Many cases where an individual is affected by an infringement of data protection rules also affect a considerable number of other individuals in a similar situation .
The Commission will therefore:
- consider the possibility of extending the power to bring an action before the national courts to data protection authorities and to civil society associations, as well as to other associations representing data subjects' interests ;
- assess the need for strengthening the existing provisions on sanctions , for example by explicitly including criminal sanctions in case of serious data protection violations, in order to make them more effective.
2.2. Enhancing the internal market dimension
2.2.1. Increasing legal certainty and providing a level playing field for data controllers
Data Protection in the EU has a strong internal market dimension , i.e., the need to ensure the free flow of personal data between Member States within the internal market. As a consequence, the Directive’s harmonisation of national data protection laws is not limited to minimal harmonisation but amounts to harmonisation that is generally complete[23].
At the same time, the Directive gives the Member States room for manoeuvre in certain areas and authorises them to maintain or introduce particular rules for specific situations[24]. This, together with the fact that the Directive has sometimes been incorrectly implemented by Member States, has led to divergences between the national laws implementing the Directive, which run counter to one of its main objectives, i.e. ensuring the free flow of personal data within the internal market . This is true for a large number of sectors and contexts, e.g. when processing personal data in the employment context or for public health purposes. The lack of harmonisation is indeed one of the recurring and main problems raised by private stakeholders, especially economic operators, as it is an additional cost and administrative burden for them. This is particularly the case for data controllers established in several Member States and obliged to comply with the requirements and practices in each of these countries. Moreover, the divergence in the implementation of the Directive by Member States creates legal uncertainty not only for data controllers but also for data subjects, creating the risk of distorting the equivalent level of protection that the Directive is supposed to achieve and ensure.
The Commission will examine the means to achieve further harmonisation of data protection rules at EU level .
2.2.2. Reducing the administrative burden
Providing a level-playing field will reduce the need to meet diverging national requirements and will thus considerably reduce the administrative burden for controllers. A further concrete element for lessening the administrative burden and reducing costs for data controllers would be the revision and simplification of the current notification system [25]. There is general consensus amongst data controllers that the current general obligation to notify all data processing operations to the Data Protection Authorities is a rather cumbersome obligation which does not provide, in itself, any real added value for the protection of individuals' personal data. Moreover, this is one of the cases where the Directive leaves a certain room for manoeuvre to Member States, which are free to decide about possible exemptions and simplifications, as well as the procedures to be followed.
A harmonised and simplified system would reduce costs as well as the administrative burden, especially for multinational companies established in several Member States.
The Commission will explore different possibilities for the simplification and harmonisation of the current notification system , including the possible drawing up of a uniform EU-wide registration form .
2.2.3. Clarifying the rules on applicable law and Member States' responsibility
The Commission’s first report on the implementation of the Data Protection Directive as early as in 2003[26] highlighted the fact that the provisions on applicable law[27] were ‘deficient in several cases, with the result that the kind of conflicts of law this Article seeks to avoid could arise’. The situation has not improved since then, as a result of which it is not always clear to data controllers and data protection supervisory authorities which Member State is responsible and which law is applicable when several Member States are concerned. This is particularly the case when a data controller is subject to different requirements from different Member States, when a multinational enterprise is established in more than one Member States or when the data controller is not established in the EU but provides its services to EU residents.
Complexity is also growing due to globalisation and technological developments : data controllers are increasingly operating in several Member States and jurisdictions, providing services and assistance around the clock. The Internet makes it much easier for data controllers established outside the European Economic Area (EEA)[28] to provide services from a distance and to process personal data in the online environment; and it is often difficult to determine the location of personal data and of equipment used at any given time (e.g., in ’cloud computing’ applications and services).
However, the Commission considers that the fact that the processing of personal data is carried out by a data controller established in a third country should not deprive individuals of the protection to which they are entitled under the EU Charter of Fundamental Rights and EU data protection legislation.
The Commission will examine how to revise and clarify the existing provisions on applicable law , including the current determining criteria, in order to improve legal certainty, clarify Member States' responsibility for applying data protection rules and ultimately provide for the same degree of protection of EU data subjects, regardless of the geographic location of the data controller.
2.2.4. Enhancing data controllers' responsibility
Administrative simplification should not lead to an overall reduction of the data controllers' responsibility in ensuring effective data protection . On the contrary, the Commission believes that their obligations should be more clearly spelt out in the legal framework, including in relation to internal control mechanisms and cooperation with Data Protection Supervisory Authorities. In addition, it should be ensured that such responsibility applies also to controllers who are subject to professional secrecy obligations (e.g. lawyers) as well as in those increasingly common cases where data controllers delegate data processing to other entities (e.g. processors).
The Commission will therefore explore ways of ensuring that data controllers put in place effective policies and mechanisms to ensure compliance with data protection rules . In doing so, it will take account of the current debate on the possible introduction of an ‘accountability’ principle[29]. This would not aim to increase the administrative burden on data controllers, since such measures would rather focus on establishing safeguards and mechanisms which make data protection compliance more effective while at the same time reducing and simplifying certain administrative formalities, such as notifications ( see 2.2.2 above ).
Promoting the use of Privacy Enhancing Technologies (PETs), as already pointed out in the 2007 Commission Communication on the issue, as well as of the ‘Privacy by Design’ principle could play an important role in this respect, including in ensuring data security[30].
The Commission will examine the following elements to enhance data controllers' responsibility:
- making the appointment of an independent Data Protection Officer mandatory and harmonising the rules related to their tasks and competences[31], while reflecting on the appropriate threshold to avoid undue administrative burdens, particularly on small and micro-enterprises;
- including in the legal framework an obligation for data controllers to carry out a data protection impact assessment in specific cases, for instance, when sensitive data are being processed, or when the type of processing otherwise involves specific risks, in particular when using specific technologies, mechanisms or procedures, including profiling or video surveillance;
- further promoting the use of PETs and the possibilities for the concrete implementation of the concept of ‘Privacy by Design’ .
2.2.5. Encouraging self-regulatory initiatives and exploring EU certification schemes
The Commission continues to consider that self-regulatory initiatives by data controllers can contribute to a better enforcement of data protection rules . The current provisions on self-regulation in the Data Protection Directive, namely the scope for drawing up Codes of Conduct[32], have rarely been used so far and are not considered satisfactory by private stakeholders.
Furthermore, the Commission will explore the possible creation of EU certification schemes (e.g. ‘privacy seals’) for 'privacy-compliant' processes, technologies, products and services[33]. This would not only give an orientation to the individual as a user of such technologies, products and services, but would also be relevant in relation to the responsibility of data controllers: opting for certified technologies, products or services could help to prove that the controller has fulfilled its obligations ( see 2.2.4 above ). Of course, it would be essential to ensure the trustworthiness of such privacy seals and to see how they fit in with the legal obligations and international technical standards.
The Commission will:
- examine means of further encouraging self-regulatory initiatives , including the active promotion of Codes of Conduct;
- explore the feasibility of establishing EU certification schemes in the field of privacy and data protection.
2.3. Revising the data protection rules in the area of police and judicial cooperation in criminal matters
The Data Protection Directive applies to all personal data processing activities in Member States in both the public and the private sectors. However, it does not apply to the processing of personal data 'in the course of an activity which falls outside the scope of Community law', such as activities in the areas of police and judicial cooperation in criminal matters.[34] The Lisbon Treaty has however abolished the previous ‘pillar structure’ of the EU and introduced a new and comprehensive legal basis for the protection of personal data across Union policies.[35] Against this background, and in view of the EU Charter of Fundamental Rights, the Commission Communications on the Stockholm Programme and the Stockholm Action Plan[36] highlighted the need to have a ‘comprehensive protection scheme’ and to ‘strengthen the EU's stance in protecting the personal data of the individual in the context of all EU policies, including law enforcement and crime prevention’.
The EU instrument for the protection of personal data in the areas of police and judicial cooperation in criminal matters is Framework Decision 2008/977/JHA [37]. The Framework Decision is an important step forward in a field where common standards for data protection were very much needed. However, further work needs to be done.
The Framework Decision only applies to the cross-border exchange of personal data within the EU and not to domestic processing operations in the Member States. This distinction is difficult to make in practice and can complicate the actual implementation and application of the Framework Decision.[38]
Also, the Framework Decision contains too wide an exception to the purpose limitation principle . Another shortcoming is the lack of provisions that different categories of data should be distinguished in accordance with their degree of accuracy and reliability, that data based on facts should be distinguished from data based on opinions or personal assessments[39], and that a distinction should be made between different categories of data subjects (criminals, suspects, victims, witnesses, etc.), with specific guarantees laid down for data relating to non-suspects[40].
In addition the Framework Decision does not replace the various sector-specific legislative instruments for police and judicial co-operation in criminal matters adopted at EU level [41], in particular those governing the functioning of Europol, Eurojust, the Schengen Information System (SIS) and the Customs Information System (CIS)[42], which either contain particular data protection regimes, and/or which usually refer to the data protection instruments of the Council of Europe. For activities within the area of police and judicial cooperation all Member States have subscribed to the Council of Europe Recommendation No R (87) 15, which sets out the principles of Convention 108 for the police sector. This is not, however, a legally binding instrument.
This situation may directly affect the possibilities for individuals to exercise their data protection rights in this area (e.g. to know what personal data are processed and exchanged about them, by whom and for what purpose, and on how to exercise their rights, such as the right to access their data).
The objective of establishing a comprehensive and coherent system in the EU and vis-à-vis third countries entails the need to consider a revision of the current rules on data protection in the area of police cooperation and judicial cooperation in criminal matters. The Commission stresses that the notion of a comprehensive data protection scheme does not exclude specific rules for data protection for the police and the judicial sector within the general framework, taking due account of the specific nature of these fields, as indicated by Declaration 21 attached to the Lisbon Treaty. This implies, for example, a need to consider the extent to which the exercise of certain data protection rights by an individual would jeopardise the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties in a specific case.
The Commission will, in particular:
- consider the extension of the application of the general data protection rules to the areas of police and judicial cooperation in criminal matters , including for processing at domestic level while providing, where necessary, for harmonised limitations to certain data protection rights of individuals, e.g., concerning the right of access or to the principle of transparency;
- examine the need to introduce specific and harmonised provisions in the new general data protection framework, for example on data protection regarding the processing of genetic data for criminal law purposes or distinguishing the various categories of data subjects (witnesses; suspects etc) in the area of police cooperation and judicial cooperation in criminal matters;
- launch, in 2011, a consultation of all concerned stakeholders about the best way to revise the current supervision systems in the area of police cooperation and judicial cooperation in criminal matters , in order to ensure effective and consistent data protection supervision on all Union institutions, bodies, offices and agencies;
- assess the need to align , in the long term, the existing various sector specific rules adopted at EU level for police and judicial co-operation in criminal matters in specific instruments , with the new general legal data protection framework.
2.4. The global dimension of data protection
2.4.1. Clarifying and simplifying the rules for international data transfers
One of the means of enabling the transfer of personal data outside the EU and the EEA area is the so-called ‘adequacy assessment’ . Currently, the adequacy of a third country – i.e., whether a third country ensures a level of protection that the EU considers as adequate – may be determined by the Commission and by Member States.
The effect of a Commission adequacy finding is that personal data can freely flow from the 27 EU Member States and the three EEA member countries to that third country without any further safeguard being necessary. However, the exact requirements for recognition of adequacy by the Commission are currently not specified in satisfactory detail in the Data Protection Directive. In addition, the Framework Decision does not provide for such a decision by the Commission.
In some Member States adequacy is assessed in the first instance by the data controller which itself transfers personal data to a third country, sometimes under the ex-post supervision of the data protection supervisory authority. This situation may lead to different approaches to assessing the level of adequacy of third countries, or international organisations, and involves the risk that the level of protection of data subjects provided for in a third country is judged differently from one Member State to another . Also, the current legal instruments include no detailed, harmonised requirements as to which transfers can be considered lawful. This leads to practices which vary from Member State to Member State.
In addition, as regards data transfers to third countries which do not ensure an adequate level of protection, the current Commission standard clauses for the transfer of personal data to controllers[43] and to processors[44] are not designed for non-contractual situations and, for example, cannot be used for transfers between public administrations.
Moreover, international agreements concluded by the EU or its Member States often require the inclusion of data protection principles and specific provisions. This may result in varying texts with inconsistent provisions and rights, and thus open to divergent interpretations, to the detriment of the data subject. As a consequence, the Commission announced that it would work on core elements for personal data protection in agreements between the Union and third countries for law enforcement purposes[45].
Other means that have been developed as a form of self-regulation, such as internal company codes of conduct known as ‘Binding Corporate Rules’ (BCRs)[46], can also be a useful tool to lawfully transfer personal data between companies of the same corporate group. However, stakeholders have suggested that this mechanism could be further improved and its implementation eased.
To address the issues identified there is a general need to improve the current mechanisms allowing for international transfers of personal data , while at the same time ensuring that personal data are adequately protected when transferred and processed outside the EU and the EEA.
The Commission intends to examine how:
- to improve and streamline the current procedures for international data transfers, including legally binding instruments and ‘Binding Corporate Rules’ in order to ensure a more uniform and coherent EU approach vis-à-vis third countries and international organisations;
- to clarify the Commission’s adequacy procedure and better specify the criteria and requirements for assessing the level of data protection in a third country or an international organisation;
- to define core EU data protection elements , which could be used for all types of international agreements.
2.4.2. Promoting universal principles
Data processing is globalised and calls for the development of universal principles for the protection of individuals with regard to the processing of personal data.
The EU legal framework for data protection has often served as a benchmark for third countries when regulating data protection . Its effect and impact, within and outside the Union, have been of the utmost importance. The European Union must therefore remain a driving force behind the development and promotion of international legal and technical standards for the protection of personal data , based on relevant EU and other European instruments on data protection. This is particularly important in the framework of the EU's enlargement policy.
As regards international technical standards developed by standardisation organisations, the Commission believes that coherence between the future legal framework and such standards is very important to ensure a consistent and practical implementation of data protection rules by data controllers.
The Commission will:
- continue to promote the development of high legal and technical standards of data protection in third countries and at international level;
- strive for the principle of reciprocity of protection in the international actions of the Union and in particular regarding the data subjects whose data are exported from the EU to third countries;
- enhance its cooperation, to this end, with third countries and international organisations , such as the OECD, the Council of Europe, the United Nations, and other regional organisations;
- closely follow up the development of international technical standards by standardisation organisations such as CEN and ISO, to ensure that they usefully complement the legal rules and to ensure operational and effective implementation of the key data protection requirements.
2.5. A stronger institutional arrangement for better enforcement of data protection rules
The implementation and enforcement of data protection principles and rules is a key element in guaranteeing respect for individuals' rights.
In this context, the role of the Data Protection Authorities (DPAs) is essential for the enforcement of the rules on data protection. They are independent guardians of fundamental rights and freedoms with respect to the protection of personal data, upon which individuals rely to ensure the protection of their personal data and the lawfulness of processing operations. For this reason, the Commission believes that their role should be strengthened, especially having regard to the recent ECJ case law on their independence[47], and they should be provided with the necessary powers and resources to properly exercise their tasks both at national level and when co-operating with each other.
At the same time, the Commission considers that Data Protection Authorities should strengthen their cooperation and better coordinate their activities , especially when confronted by issues which, by their nature, have a cross-border dimension. This is particularly the case where multinational enterprises are based in several Member States and are carrying out their activities in each of these countries, or where coordinated supervision with the European Data Protection Supervisor (EDPS) is required[48].
In this respect, an important role can be played by the Article 29 Working Party [49], which already has the task, in addition to its advisory function[50], of contributing to the uniform application of EU data protection rules at national level. However, the continuing divergent application and interpretation of EU rules by Data Protection Authorities, even when challenges to data protection are the same across the EU, calls for a strengthening of the Working Party's role in coordinating DPAs' positions, ensuring a more uniform application at national level and thus an equivalent level of data protection.
The Commission will examine:
- how to strengthen, clarify and harmonise the status and the powers of the national Data Protection Authorities in the new legal framework, including the full implementation of the concept of ‘complete independence’[51];
- ways to improve the cooperation and coordination between Data Protection Authorities ;
- how to ensure a more consistent application of EU data protection rules across the internal market. This may include strengthening the role of national data protection supervisors, better coordinating their work via the Article 29 Working Party (which should become a more transparent body), and/or creating a mechanism for ensuring consistency in the internal market under the authority of the European Commission .
3. CONCLUSION: THE WAY FORWARD
Like technology, the way our personal data is used and shared in our society is changing all the time. The challenge this poses to legislators is to establish a legislative framework that will stand the test of time. At the end of the reform process, Europe's data protection rules should continue to guarantee a high level of protection and provide legal certainty to individuals, public administrations and businesses in the internal market alike for several generations. No matter how complex the situation or how sophisticated the technology, clarity must exist on the applicable rules and standards that national authorities have to enforce and that businesses and technology developers must comply with. Individuals should also have clarity about the rights they enjoy.
The Commission's comprehensive approach to address the issues and achieve the key objectives highlighted in this Communication will serve as a basis for further discussions with the other European institutions and other interested parties and will later be translated into concrete proposals and measures of both legislative and non-legislative nature. For this purpose, the Commission welcomes feedback on the issues raised in this Communication.
On this basis, following an impact assessment and taking into account the EU Charter of Fundamental Rights, the Commission will propose legislation in 2011 aimed at revising the legal framework for data protection with the objective of strengthening the EU's stance in protecting the personal data of the individual in the context of all EU policies, including law enforcement and crime prevention, taking into account the specificities of these areas. Non-legislative measures, such as encouraging self-regulation and exploring the feasibility of EU privacy seals, will be pursued in parallel.
As a second step, the Commission will assess the need to adapt other legal instruments to the new general data protection framework. This concerns, first of all, Regulation (EC) No 45/2001, whose provisions will have to be adapted to the new general legal framework. The impact on other sectoral instruments will also need to be carefully examined at a later stage.
The Commission will also continue to ensure the proper monitoring of the correct implementation of Union law in this area, by pursuing an active infringement policy where EU rules on data protection are not correctly implemented and applied. Indeed, the current review of the data protection instruments does not affect the obligation of the Member States to implement and ensure the proper application of the existing legal instruments on the protection of personal data[52].
A high and uniform level of data protection within the EU will be the best way of endorsing and promoting EU data protection standards globally.
[1] Directive 95/46/EC of the European Parliament and of the Council of 24.10.1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31).
[2] See the Study on the economic benefits of privacy enhancing technologies, London Economics, July 2010 (http://ec.europa.eu/justice/policies/privacy/docs/studies/final_report_pets_16_07_10_en.pdf), p. 14.
[3] See the replies to the Commission's public consultation:http://ec.europa.eu/justice/news/consulting_public/news_consulting_0003_en.htm. More targeted stakeholders' consultations were carried out throughout 2010. Vice-President Viviane Reding also chaired a high level meeting with stakeholders on 5 October 2010 in Brussels. The Commission also consulted the Article 29 Working Party, which provided a comprehensive contribution to the 2009 consultation (WP 168) and adopted a specific opinion in July 2010 on the accountability concept (WP 173).
[4] In addition to the Study on the economic benefits of privacy enhancing technologies (cit., footnote 2), see also the Comparative study on different approaches to new privacy challenges, in particular in the light of technological developments, January 2010(http://ec.europa.eu/justice/policies/privacy/docs/studies/new_privacy_challenges/final_report_en.pdf). A study for an impact assessment for the future EU legal framework for personal data protection is also ongoing.
[5] Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), (OJ L 201, 31.7.2002, p. 37).
[6] The Data Protection Directive 95/46/EC sets the data protection standards for all EU legislative acts, including the e-Privacy Directive 2002/58/EC (amended by Directive 2009/136/EC - OJ L 337, 18.12.2009, p. 11). The e-Privacy Directive applies to the processing of personal data in connection with the provision of publicly available electronic communications services in public communications networks. It translated the principles set out in the Data Protection Directive into specific rules for the electronic communications sector. Directive 95/46/EC applies inter alia to non-public communication services.
[7] In separate contributions made after the end of the public consultation, Europol and Eurojust pleaded for nevertheless taking into account the specificities of their work regarding the coordination of law enforcement and crime prevention.
[8] See Article 16 of the Treaty on the Functioning of the European Union (TFEU).
[9] See Article 16(2), last paragraph, TFEU and Article 39 of the Treaty on the European Union (TEU).
[10] See European Court of Justice, Cases C-101/01, ‘Bodil Lindqvist’, ECR [2003], I-1297, 96, 97, and C-275/06, Productores de Música de España (Promusicae) v Telefónica de España SAU, ECR [2008] I-271. See also the jurisprudence of the European Court of Human Rights, e.g. in cases: S. and Marper v. the United Kingdom, 4.12. 2008 (Application nos. 30562/04 and 30566/04) and Rotaru v. Romania, 4.5. 2000; no. 28341/95, § 55, ECHR 2000-V.
[11] See the definitions of ‘data controller’ and ’data processor’ in Article 2(d) and (e) of Directive 95/46/EC.
[12] See Recital 26 of Directive 95/46/EC.
[13] See for example the case of IP addresses, examined in the Article 29 Working Party Opinion 4/2007 on the concept of personal data (WP 136).
[14] See for instance the judgement by the German Federal Constitutional Court ( Bundesverfassungsgericht ) of 27 February 2008, 1 BvR 370/07.
[15] See Articles 10 and 11 of Directive 95/46/EC.
[16] A Eurobarometer survey carried out in 2009 showed that about half of the respondents considered privacy notices in websites ’very’ or ’quite unclear’ (see Flash Eurobarometer No 282 :http://ec.europa.eu/public_opinion/flash/fl_282_en.pdf).
[17] See the Safer Internet for Children qualitative study concerning 9-10 year old and 12-14 year old children, which showed that children tend to underestimate risks linked to the use of Internet and minimise the consequences of their risky behaviour (available at:http://ec.europa.eu/information_society/activities/sip/surveys/qualitative/index_en.htm).
[18] ‘The Commission takes note of the will of the European Parliament that an obligation to notify personal data breaches should not be limited to the electronic communications sector but also apply to entities such as providers of information society services […]. The Commission will, therefore, without delay initiate the appropriate preparatory work, including consultation with stakeholders, with a view to presenting proposals in this area, as appropriate, by the end of 2011 […]’, retrievable at http://www.europarl.europa.eu/sides/getDoc.do?pubRef=-//EP//TEXT+TA+P6-TA-2009-0360+0+DOC+XML+V0//EN. See also recital 59 of Directive 2009/136/EC amending the e-Privacy Directive 2002/58/EC: ’The interest of users in being notified is clearly not limited to the electronic communications sector, and therefore explicit, mandatory notification requirements applicable to all sectors should be introduced at Community level as a matter of priority.’
[19] Article 4 of Directive 2009/136/EC.
[20] See Flash Eurobarometer No 225 – Data Protection in the European Union:http://ec.europa.eu/public_opinion/flash/fl_225_en.pdf.
[21] Cf. Article 2(h) of Directive 95/46/EC.
[22] Cf. Article 8 of Directive 95/46/EC.
[23] European Court of Justice, C-101/01, ‘Bodil Lindqvist’, ECR [2003], I-1297, 96, 97.
[24] Ibidem , 97. See also recital 9 of Directive 95/46/EC.
[25] See Article 18 of Directive 95/46/EC.
[26] Report from the Commission - First Report on the implementation of the Data Protection Directive (95/46/EC) - COM(2003) 265.
[27] See Article 4 of Directive 95/46/EC.
[28] The European Economic Area includes Norway, Liechtenstein and Iceland.
[29] See in particular the opinion adopted by the Article 29 Working Party on 13 July, 3/2010.
[30] On PETs see: Communication from the Commission to the European Parliament and the Council on Promoting Data Protection by Privacy Enhancing Technology (PETs) - COM(2007) 228. The principle of ‘Privacy by Design’ means that privacy and data protection are embedded throughout the entire life cycle of technologies, from the early design stage to their deployment, use and ultimate disposal. This principle features inter alia in the Commission Communication on ‘A Digital Agenda for Europe’ - COM(2010) 245.
[31] The current possibility for a data controller to appoint a Data Protection Officer in order to ensure, in an independent manner, compliance with the EU and national data protection rules and to assist individuals has been implemented in several Member States already (see e.g. the Beauftragter für den Datenschutz in Germany and the correspondant informatique et libertés (CIL) in France).
[32] See Article 27 of Directive 95/46/EC.
[33] On this aspect, see also the PETs Communication, cit. footnote 30.
[34] See Article 3(2), first indent, of Directive 95/46/EC.
[35] See Article 16 TFEU.
[36] See COM(2009) 262, 10.6.2009, and COM(2010) 171, 20.4.2010.
[37] Council Framework Decision 2008/977/JHA of 27.11.2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters (OJ L 350, 30.12.2008, p. 60). The Framework Decision only envisages minimum harmonisation of data protection standards.
[38] This distinction does not exist in the relevant Council of Europe instruments such as: Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS No.: 108), its Additional Protocol regarding supervisory authorities and transborder data flows (ETS No.: 181) and Recommendation No R (87) 15 of the Committee of Ministers to Member States regulating the use of personal data in the police sector, adopted on 17 September 1987.
[39] As required by Principle 3.2 of Recommendation No R (87) 15.
[40] Contrary to Principle 2 of Recommendation No R (87) 15 and its evaluation reports.
[41] See an overview of such instruments in the Commission Communication ‘Overview of information management in the area of freedom, security and justice’ - COM(2010) 385.
[42] Joint Supervisory Authorities have been set up by the relevant instruments to ensure data protection supervision, in addition to the general supervisory powers of the European Data Protection Supervisor (EDPS) over Union institutions, bodies, offices and agencies based on Regulation (EC) No 45/2001.
[43] Commission Decision 2001/497/EC of 15 June 2001 on standard contractual clauses for the transfer of personal data to third countries under the Directive 95/46/EC (OJ L 181, 4.7.2001, p. 19); Commission Decision 2002/16/EC of 27 December 2001 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC (OJ L 6, 10.1.2002, p. 52); Commission Decision 2004/915/EC of 27 December 2004 amending Decision 2001/497/EC as regards the introduction of an alternative set of standard contractual clauses for the transfer of personal data to third countries (OJ L 385, 29.12.2004, p. 74).
[44] Commission Decision of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council (OJ L 39, 12.2.2010, p. 5).
[45] Stockholm Action Plan, cit. (footnote 36).
[46] ‘Binding Corporate Rules’ are codes of practice based on European data protection standards, which multinational organisations draw up and follow voluntarily to ensure adequate safeguards for transfers or categories of transfers of personal data between companies that are part of a same corporate group and that are bound by these corporate rules. See:http://ec.europa.eu/justice/policies/privacy/docs/international_transfers_faq/international_transfers_faq.pdf.
[47] ECJ judgment of 9.3.2010, Commission v. Germany, Case C-518/07.
[48] This is currently the case for large IT-systems, e.g., for the SIS II (cf. Article 46 of Regulation (EC) No 1987/2006 - OJ L 318, 28.12.2006, p. 4) and for the VIS (cf. Article 43 of Regulation (EC) No 767/2008 - OJ L 218, 13.8.2008, p. 60).
[49] The Article 29 Working Party is an advisory body composed of one representative of Member States', Data Protection Authorities, the European Data Protection Supervisor(EDPS) and the Commission (without voting rights), which also provides its secretariat. See:http://ec.europa.eu/justice/policies/privacy/workinggroup/index_en.htm .
[50] The Article 29 Working Party has the role of advising the Commission on the level of protection in the EU and in third countries and on any other measure relating to the processing of personal data.
[51] See the ECJ judgment of 9.3.2010, Commission v. Germany, Case C-518/07.
[52] This also includes Council Framework Decision 2008/977/JHA: Member States need to take the necessary measures to comply with the provisions of this Framework Decision before 27 November 2010.