European Parliament Report to the Implementation of the Data Protection Directive 95/46EC

EUROPEAN PARLIAMENT

1999  2004

Session document

FINAL A5-0104/2004

24 February 2004

REPORT

on the First Report on the implementation of the Data Protection Directive (95/46/EC)

(COM(2003) 265 – C5-0375/2003 – 2003/2153(INI))

Committee on Citizens' Freedoms and Rights, Justice and Home Affairs Rapporteur: Marco Cappato

RR\525824EN.doc  PE 339.591

EN  EN

CONTENTS

Page

PROCEDURAL PAGE ............................................................................................................. 4 DRAFT EUROPEAN PARLIAMENT RESOLUTION ........................................................... 5 EXPLANATORY STATEMENT............................................................................................ 13

OPINION OF THE COMMITTEE ON LEGAL AFFAIRS AND THE

INTERNAL MARKET............................................................................................................ 17

OPINION OF THE COMMITTEE ON INDUSTRY, EXTERNAL TRADE,

RESEARCH AND ENERGY.................................................................................................. 20

PROCEDURAL PAGE

By letter of 15 May 2003 the Commission forwarded to Parliament the First Report on the implementation of the Data Protection Directive (95/46/EC) (COM(2003) 265), which was referred to the Committee on Citizens' Freedoms and Rights, Justice and Home Affairs for information.

At the sitting of 4 September 2003 the President of Parliament announced that the Committee on Citizens' Freedoms and Rights, Justice and Home Affairs had been authorised to draw up an own-initiative report on the subject under Rules 47(2) and 163, and that the Committee on Legal Affairs and the Internal Market and the Committee on Industry, External Trade, Research and Energy had been asked for their opinions (C5-0375/2003).

The Committee on Citizens' Freedoms and Rights, Justice and Home Affairs appointed Marco Cappato rapporteur at its meeting of 9 September 2003.

The committee considered the draft report at its meetings of 22 January and 19 February 2004.

At the latter meeting it adopted the draft resolution unanimously.

The following were present for the vote: Jorge Salvador Hernández Mollar (chairman), Johanna L.A. Boogerd-Quaak (vice-chairwoman), Giacomo Santini (vice-chairman), Maurizio Turco (for Marco Cappato, rapporteur), Mary Elizabeth Banotti, Kathalijne Maria Buitenweg (for Patsy Sörensen), Michael Cashman, Carmen Cerdeira Morterero, Gérard M.J. Deprez, Adeline Hazan, Margot Keßler, Timothy Kirkhope, Eva Klamt, Luís Marinho (for Ozan Ceyhun), Marjo Matikainen-Kallström (for Charlotte Cederschiöld), Arie M. Oostlander (for Carlos Coelho), Elena Ornella Paciotti, Paolo Pastorelli (for Giuseppe Brienza), Hubert Pirker, Bernd Posselt, Olle Schmidt (for Baroness Ludford), Sérgio Sousa Pinto, Joke Swiebel, Anna Terrón i Cusí and Christian Ulrik von Boetticher.

The opinions of the Committee on Legal Affairs and the Internal Market and the Committee on Industry, External Trade, Research and Energy are attached.

The report was tabled on 24 February 2004.

DRAFT EUROPEAN PARLIAMENT RESOLUTION

on the First Report on the implementation of the Data Protection Directive (95/46/EC) (COM(2003) 265 – C5-0375/2003 – 2003/2153(INI))

The European Parliament,

– having regard to the First Report on the implementation of the Data Protection Directive (95/46/EC) (COM(2003) 265 - C5-0375/2003),

– having regard to the texts that in international law protect the right to privacy, and notably Article 12 of the Universal Declaration of Human Rights of 10 December 1948, Article 17 of the International Covenant on Civil and Political Rights of 16 December 1966, Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms[1] of 4 November 1950, the Convention for the protection of individuals with regard to automatic processing of personal data[2] of 28 January 1981 and the recommendations adopted by the Council of Europe,

– having regard to Article 6 of the TEU (respect for human rights and fundamental freedoms in the EU) and Article 286 of the EC Treaty, as well as Articles 7 (respect for private and family life) and 8 (protection of personal data) of the European Charter of Fundamental Rights,

– having regard to the EU laws that protect the right to privacy and to data protection, and notably Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector,

– having regard to other EU instruments concerning data protection in the field of the third pillar, and notably to the draft Greek Presidency working document on common rules for the protection of personal data within the framework of the third pillar, and having regard to the announcement made by Commissioner Vitorino that the Commission intended to propose a legal instrument on this issue in 2004[3],

– having regard to the opinions of the working party on privacy established by Article 29 of Directive 95/46/EC,

– having regard to the documents relating to the transfer of transatlantic passengers' personal data to the USA, with particular reference to: the opinions of the Article 29 Working Party, the Commission communications, the US Undertakings, the opinion of the Belgian Committee on the Protection of Privacy on complaints by some passengers, and the complaint lodged with the Commission regarding the violation of Regulation (EEC) No 2299/89,

– having regard to the Court of Justice judgment of 20 May 2003 in the Österreichscher Rundfunk and Others case,

– having regard to Rule 47(2) and Rule 163 of its Rules of Procedure,

– having regard to the report of the Committee on Citizens' Freedoms and Rights, Justice and Home Affairs and the opinions of the Committee on Legal Affairs and the Internal Market and the Committee on Industry, External Trade, Research and Energy (A5-0104/2004),

1. whereas the right to privacy is a fundamental human right, as set out in all the main legal instruments that guarantee citizens' freedoms and rights at international, European and national level,
2. whereas the EU has developed a legal regime aimed at guaranteeing citizens' privacy through a high standard of data protection in areas covered by the first pillar,
3. whereas, due to the current pillar structure of the EU, activities that fall within the remit of the second and third pillars are excluded from this legal regime and are partially subject to fragmented specific provisions; whereas the European Parliament is only partially consulted and informed and whereas the Court of Justice has limited powers in this area,
4. whereas Directive 95/46/EC charges the Commission with reporting to the Council and the European Parliament on the implementation of the directive and with proposing, if necessary, suitable amendments,
5. whereas, since the terrorist attacks of September 2001, measures aimed at increasing security by modifying privacy and data protection rights have been adopted or are planned at national, European and international level,
6. whereas data transfers to third states and organisations are an area of concern, both because of disparities in the laws of the Member States, some of which are excessively permissive and other excessively rigid, and, above all, because the binding assessment of the adequacy of the protection provided by recipients for a fundamental right of European citizens comes within the remit of the executive body, the Commission, and not that of Parliament,
7. whereas negotiations are still underway between the EU and the US on the issue of the illegal transfer of transatlantic passengers' data to the US and whereas the EP has asked the Commission to take action pursuant to Article 232 of the EC Treaty,
8. whereas the Belgian Committee on the Protection of Privacy has ascertained that the personal data of some European transatlantic passengers - including a Member of the European Parliament - were transferred to the USA illegally, in violation of Belgian law and European directives,

9. whereas the Article 29 Working Party stated in its opinion on the transfer to the USA of data relating to transatlantic passengers that 'the progress made does not allow a favourable adequacy finding to be achieved', and whereas a large number of further issues need to be resolved before the Commission can take an adequacy decision,
10. whereas the EU, its institutions and the Member States are required to comply with the Charter of Fundamental Rights of the EU, particularly Article 8 thereof, the European Convention on Human Rights and Fundamental Freedoms and the general principles of international law, and whereas the current policies of data retention and data transfer to third countries are likely to result in their being seriously breached,
11. whereas the Commission and Member States and national privacy protection authorities are responsible for the effective implementation of national and European privacy laws and for punishing violations of those laws,
12. whereas national and European laws on the transfer of personal data to third countries have been flagrantly breached by the transfer of transatlantic passengers' personal data to the US law-enforcement authorities, and whereas the attitude of the Commission, the Member States and some privacy protection authorities - particularly those which under national law have the power to block data transfers - has been basically to connive at this violation of the law and of the principle of legality,
13. whereas in the Internet global information society context, solutions cannot be found within the EU only,

on the need for a comprehensive and trans-pillar European privacy and data protection regime

1. Deplores the extremely serious delays that have occurred within the Commission in this matter and urges it to propose within the first half of 2004, as announced, a 'legal instrument' on the protection of privacy in the third pillar; this instrument should be binding in nature and aimed at guaranteeing in the third pillar the same level of data protection and privacy rights as in the first pillar; it should harmonise, according to these high standards, the current rules on privacy and data protection concerning Europol, Eurojust and all other third-pillar organs and actions, as well as any exchange of data between them and with third countries and organisations;
2. Considers that, in the long term, Directive 95/46/EC should be applied, following the appropriate modifications, to cover all areas of EU activity, so as to guarantee a high standard of harmonised and common rules for privacy and data protection;
3. Believes that respect for privacy and data protection rules should be guaranteed by national supervisory authorities, a common EU authority, to which citizens will have the right to appeal, and the Court of Justice; maintains that Parliament should also be consulted on, and have decision-making powers in respect of, all proposals concerning or having an impact on the protection of privacy within the EU, such as international agreements involving its bodies, adequacy findings and so on;
4. Considers that immediate steps should be taken to facilitate enjoyment by citizens of their right to privacy and protection of their personal data (access to data, correction, amendment, deletion, etc.), involving the introduction of a single procedure for national privacy authorities regarding data stored in national and European databases coming under the first and third pillars;

5. Welcomes the fact that the Commission has conducted an open and in-depth consultation and debate with all interested parties (Member State governments and supervisory authorities, organisations, companies, citizens), on-line and off-line, on the implementation of the directive, and takes note of the results of this consultation;

on the implementation of Data Protection Directive 95/46/EC

6. Regrets the fact that some Member States did not implement the directive before the deadline for transposition of 24 October 1998, thereby obliging the Commission to take legal action on 11 January 2000 against France, Luxembourg, the Netherlands, Germany and Ireland, but notes that all Member States have now done so; calls on Ireland to immediately notify to the Commission its recent law of implementation; regrets the fact that the tardy implementation of the directive by the Member States and the continuing differences in the way in which it is applied at national level have prevented economic operators from drawing maximum benefit from it, and have blocked some cross-border activities within the European Union;
7. Calls on all the actors concerned, European institutions, Member States and data protection authorities, as well as economic and societal actors, to make their contribution and cooperate to ensure correct implementation of the data protection principles regulated by the directive;
8. Shares the view of the Commission that, since implementation of the directive has been slow and experience with it is still very limited, the directive should not be amended for the time being (except as indicated in paragraph 16), and that current shortcomings in the implementation of the directive should be overcome by actions taken at the European and national level by Member States and data protection authorities following the programme announced in the Commission's communication;
9. Points out that the completion of the internal market is conditional upon guaranteed data protection; accordingly, calls on the Commission to highlight the areas in which diverging interpretations of the directive are hampering the smooth operation of the internal market, and to report on this to the European Parliament;
10. Shares the Commission's view that, if after a deadline of six months this cooperation does not produce the results expected, it will bring those Member States failing or refusing to comply with the directive to Court; considers, in this connection, that the Commission should show particular vigilance and determination as regards the proper application of legal exceptions to privacy laws, so as to ensure compliance with the ECHR and the related case law;

on data transfers to third states or organisations

11. Welcomes the intention of the Commission of simplifying the regulatory framework for enterprises as regards requirements for international transfers of data;

12. Recalls that no exception should be allowed to the principle that first-pillar-related data can only be transferred to third countries and organisations if the data protection level is similar to that of the EU;
13. Points out, notably to Europol, Eurojust and other third-pillar organs, that law enforcement-related data can only be transferred on a case-by-case basis to countries or organs that respect human rights and fundamental freedoms, democracy, the rule of law and European data protection standards, such as the data protection principles laid down by Council of Europe Recommendation R (87) 15 on the use of data of a personal nature in the police sector; asks, furthermore, to be consulted before - and receive reports after - such transfers take place; urges Europol and Eurojust to clarify and make available to citizens and to Parliament the necessary information on the exchange of data, whether personal or not, with third countries and organisations;
14. Reiterates that, as stated in the opinion of the Belgian Committee on the Protection of Privacy, the opinions of the Article 29 Working Party and the report of the EU network of experts on human rights, EU data protection standards are seriously infringed when personal data are, without informing and obtaining the consent of the data subject, transferred or accessed directly and systematically by a third state party or law- enforcement authority, notably when data are collected for another purpose and without judicial authorisation, as in the case of US authorities accessing transatlantic passenger data collected in the EU by airline companies and electronic reservation systems;
15. Agrees with the Article 29 Working Party's opinion on the inadequacy of the current privacy arrangements in the United States and on the latest version of the Undertakings, as well as on the remaining problem areas; considers the progress made in this connection during a year of negotiations between the Commission and the US authorities to be totally inadequate;
16. Proposes that the directive be amended so as to make the assessment of the adequacy of the protection provided for the personal data of European citizens by a third country to which such data are to be transferred subject to Parliament's approval;
17. Calls for the agreements currently being negotiated or already negotiated which entail the transmission of personal data between the EU and third countries or bodies to guarantee an adequate level of data protection and, in any case, to maintain the level guaranteed in Directive 95/46/EC;

on exceptions to privacy laws

18. Believes that Member States' laws providing for the wide-scale retention of data related to citizens' communications for law-enforcement purposes are not in full conformity with the European Convention on Human Rights and the related case law, since they constitute an interference in the right to privacy, falling short of the requirements of: being authorised by the judiciary on a case-by-case basis and for a limited duration, distinguishing between categories of people that could be subject to surveillance, respecting confidentiality of protected communications (such as lawyer-client communications), and specifying the nature of the crimes or the circumstances that authorise such an interference; believes, furthermore, that serious doubts arise as to their necessity within a democratic society and

- as specified by Article 15 of Directive 2002/58/CE - as to their appropriateness and

proportionality;

19. Asks the Commission to produce a document on the right to privacy and the conditions for exceptions to be legal, on the basis of the European Convention on Human Rights, the related case law and EU data protection directives and urges the EU institutions to launch an open and transparent debate on the basis of this document;

other concerns

20. Asks the Member States to respect criteria of legal clarity and legal security for better regulation when implementing the directive in order to avoid any unnecessary burden on enterprises and particularly on SMEs;
21. Stresses that the free movement of personal data is vital for the smooth operation of virtually all Union-wide economic activities; it is therefore necessary to resolve these differences of interpretation as soon as possible, to enable multinational organisations to frame pan-European data protection policies;
22. Stresses the need for the Member States and the European institutions to adopt an equivalent level of protection of fundamental rights and protection of individuals in applying both Directive 95/46/EC and Regulation (EC) No 45/2001 on data protection;
23. Calls on the Commission to adopt an approach seeking to harmonise this directive with other legislative provisions, such as the proposal for a European Parliament and Council directive for the approximation of laws, regulations and administrative provisions of the Member States concerning consumer credit, in order to avoid inconsistencies between such proposals;
24. Calls on Member States and supervisory authorities to create a less complex and burdensome environment for data controllers and agrees with the Commission on the need to avoid imposing requirements that could be dropped without any detrimental effects for the high level of protection guaranteed by the directive;
25. Stresses that the management and protection of data are nowadays a critical factor of success for companies;
26. Agrees with the Commission on the need for improvements to be made in order for economic operators to have a wider choice of standard contractual clauses in the field of data protection and that these should possibly be based on clauses submitted by business representative associations;
27. Calls on Member States to ensure that data protection authorities are provided with the necessary means to comply with the tasks foreseen by Directive 95/46/EC, and that they are independent and autonomous from national governments; considers that data protection authorities should keep enhancing their efficiency and effectiveness and play a more active role at national and European level in the framework of the Article 29 Working Party, for instance in helping to implement the programme proposed by the Commission and in ensuring that the law is implemented;
28. Regrets that seven Member States - Belgium, Germany, Greece, France, Luxembourg, the

Netherlands and Portugal - have not respected the deadline for implementation of Directive 2002/58/EC set for 31 October 2003, and calls on them to take the necessary measures;

29. Calls on the Commission, the Member States and national privacy authorities to carry out annual assessments of compliance with national and international privacy laws, irrespective of the pillar concerned, and, where appropriate, to submit amendments to legislation, to forward these amendments to the relevant bodies - particularly parliamentary bodies - and to make them publicly available, inter alia on the Internet;
30. Expresses concern at the development of SIS and the Council plans under which SIS II should allow new categories of alerts (persons and objects) and new sectors to be added, alerts to be inter-linked, the period during which alerts may be stored to be changed, biometric data (especially photographs and fingerprints) to be registered and transferred, and access to be provided to new authorities, namely Europol, Eurojust and national judicial authorities, where necessary, for purposes other than those originally laid down, such as the transmission of European arrest warrants; deplores, furthermore, the legal confusion created by the fact that SIS covers both first and third pillar matters, with different levels of privacy protection;
31. Expresses concern at the general approach taken by the Council to proposals seeking to incorporate biometric data (digital photographs and fingerprints) into visas and residence permits using an electronic chip, particularly because such data can easily be copied into centralised databases when checks are carried out; is concerned that new developments in the field of data protection, such as the possible use of biometrics, will put more demands on the supervisory authorities that are currently 'under-resourced for their wide range of tasks'[4]; calls on the Member States to make additional resources available for the data protection supervisory authorities to ensure the effective functioning of the system;
32. Calls on the Member States and national and European authorities to ensure that privacy legislation is not misused intentionally or unintentionally to undermine the right of access to documents, administrative transparency and institutional advertising, or to make it excessively difficult for individuals to exercise their 'right to be known'; calls on the Commission to submit a report, based on an opinion of the Article 29 Working Party, on this type of abusive conduct and to put forward guidelines and, where appropriate, legislative measures with a view to guarding against such practices;
33. Calls on the Commission to continue to monitor the issue of video surveillance, not least in the light of national judicial rulings, and awaits the submission of the proposal on the protection of privacy at the workplace, of which advance notice has been given;
34. Urges Eurojust to state exactly which national and European provisions it has been and is implementing, given that there is much confusion and some serious doubts surrounding this matter;
35. Believes that self-regulation is a good means of avoiding excessively detailed legislation and calls on the business community to create a European code of conduct on personal data protection;

36. Asks for an additional effort towards internationally agreed principles to be made at the national, European and international level in order to improve the application of OECD guidelines and the Council of Europe Convention;
37. Points out that privacy and personal data protection should be part of the educational curriculum related to computers and the Internet; asks the Member States and the Commission to promote citizens' awareness in the field of data protection rights;
38. Instructs its President to forward this resolution to the Council and the Commission, the governments and parliaments of the Member States, the national privacy authorities, Europol and Eurojust and the United States Government.

EXPLANATORY STATEMENT

Introduction

The right to privacy and the protection of personal data in the European Union is safeguarded by numerous international, European and national instruments that ensure a high standard of protection. Besides the rules laid down in United Nations conventions, which establish respect for private life as a human right and fundamental personal freedom, specific protection has been provided for at European level, on the one hand by the European Convention on Human Rights and Fundamental Freedoms (ECHRFF), by the case law of the European Court of Human Rights (ECHR) and by the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, and on the other hand by the European Union which, via a series of measures - in particular Directive 95/46/EC of

24 October 1995 on the protection of individuals with regard to the processing of personal data and Directive 2002/58/EC on the protection of privacy in the electronic communications sector - has laid down rules for the application of the principles and rules already established.

Although the 'formal' protection of the right to respect for private life, at least in areas covered by the first pillar, is in essence relatively satisfactory, there are concerns surrounding the weakening of the 'substantial' protection of that right. Many states have passed so-called 'anti- terrorism' laws which imperil fundamental rights and freedoms that lie at the heart of democracy and the rule of law. The right to privacy has been one of the first victims of this emergency legislative approach, which aims to redraw the fine dividing line between fundamental rights and lawful and necessary interference in a democratic society for reasons of 'public order'.

This report, which aims to take stock of the protection of privacy in the UE, first of all addresses the current situation and the structural reforms needed at European level, and then moves on to the issue of the implementation of the above-mentioned directives, offering some suggestions as to the action to be taken, the issue of the transfer of personal data to third states, and the threat posed to the protection of privacy by interference by the state and by third parties - often on behalf of the former.

1. The European Union and privacy: fragmented protection

The protection of privacy in the European Union is subject to different rules, in terms both of vertical (international, European, national) and horizontal (pillar-specific) measures. The provisions of international law and the ECHRRF and relevant case law are applicable 'horizontally' across the three pillars, but the guarantee regimes defined in the above- mentioned directives are only valid in areas covered by the first pillar. With regard to the application of Directive 95/46/EC to the third pillar, and the establishing of specific rules applicable to the third pillar as a whole, the preferred strategy has so far been to create ad hoc rules relating to the body responsible for processing specific types of personal data. This has led to an extremely confused and fragmented situation, which is very hard for members of the public - and also experts - to fathom and therefore to effectively assert their rights.

This situation requires urgent rectification. Your rapporteur, despite condemning the lengthy delay in this area, welcomes the Commission's undertaking, as announced by Commissioner Vitorino, to present at the earliest opportunity a proposal on data protection in third pillar areas, and considers it essential in the short term for there to be harmonisation or at least clarification of the principles, their application and the methods of ensuring respect for the right to privacy in the context of the processing of personal data. In the long term, and especially in view of the abolition of the EU pillar structure advocated in the European Constitution, it is to be hoped that Directive 95/46/EC will be applied horizontally, with the requisite adjustments. In any event, your rapporteur stresses the urgent need to guarantee that all citizens can easily access the data relating to them, possibly by means of a single procedure before the relevant national guarantors, with the possibility of appeal to a common European supervisory authority and to national and European courts should access be denied.

Implementation of Directive 95/46/EC

The European Commission has just issued a communication concerning the implementation of Directive 95/46/EC on the processing of personal data. The Commission, which is required under Article 33 of that directive to report on the implementation of the directive and to suggest any necessary amendments, decided not to propose any modifications, for a variety of reasons which your rapporteur supports, and which are set out in the communication. It is important to note while on this point that implementation of the directive has proved decidedly problematic, as emerged during the public consultation process launched by the Commission with a view to preparing the communication: excessive time taken to adopt the transposition acts (and notify these to the Commission), related decisions by the Commission to open infringement proceedings against certain states, contrasts in transposition at national level, difficulty for both the guarantor authority and the other bodies responsible for implementing the law to enforce respect for the rights and obligations established and excessive complications and formalism in the notification procedures. The programme of initiatives the Commission has drawn up to resolve these problems offers a possible solution, but one that has to be assessed on the basis of its results in terms of clarification and simplification as regards the 'horizontal' obligations and rights - i.e. for all members of society

- arising from the directive. In this sense it would be worthwhile laying down stage markers and a deadline for the discussions which the Commission is to hold with the Member States and the authorities on the basis of the programme. A time limit of one year would seem reasonable for the Member States to take the necessary measures.

Once the time needed to iron out the discrepancies between European and national law has passed, the Commission should however take resolute action against recalcitrant Member States which have in its opinion violated the letter and the spirit of the directive. It is also to be hoped that the Commission would report to the EP on the implementation of the directive on a yearly basis.

Transfer of data to Third States

Commissioner Bolkestein stated at the joint meeting of the Committee on Legal Affairs and the Internal Market and the Committee on Citizens' Freedoms and Rights, Justice and Home Affairs which took place on 1 December 2003 that the accessing by US authorities of personal data on passengers on Transatlantic flights was 'illegal'. Stefano Rodotà, the Italian privacy guarantor and chairman of the Article 29 Group asserted at the same meeting that some

national guarantors could have brought injunctions against the airline companies to suspend the transfer of data, but decided not to do so. Your rapporteur is greatly alarmed at the fact that when faced with a clear breach of European and national law and of the fundamental right to privacy, those institutionally responsible for ensuring observance of those laws and rights failed to do this and in essence became instrumental in violations of the law. Not only this, but the Commission quickly took the opportunity to propose a European framework for the retention and processing of data relating to European flights that drew on the US model. Your rapporteur does not agree with the political choices made by the Commission, and is convinced that at this juncture only a ruling from the European Court of Justice will clarify this legal 'imbroglio'.

Guarantees on the transfer to Third States of data collected in the context of first pillar activities have been violated, but there are even greater concerns with regard to the third pillar. Owing to international cooperation in the combating of terrorism, there has been an increase in the transfer to Third States of data relating to third pillar activities stored in the databases of various bodies (Europol, Eurojust, SIS, etc.). As has been shown above, even data collected in the context of first pillar activities (transport: Transatlantic flights) are being made accessible to Third States (the United States) for reasons of public order, which also poses a question as regards legality. In view of the sensitivity of the information exchanged, the minimum rule that must be established is the application of a democratic clause prohibiting the transfer of data to states that do not respect basic human rights and freedoms, democracy, the rule of law, and in particular the principles laid down by the Council of Europe in Recommendation R (87)15 regulating the use of personal data in the police sector.

Exceptions to privacy laws

International human rights treaties guaranteeing the right to privacy normally contain a clause on legal exceptions to that right. The prohibition of interference by the public authorities in the exercising of the right to privacy is normally attenuated by the establishing of exceptions founded on a law, which are necessary in a democratic society in the interests of national security, public safety, the economic well-being of the state, the prevention of disorder and crime, moral protection and the protection of the rights and freedoms of third parties. The case law of the European Court of Human Rights features interpretations of the clause contained in the ECHRRF. Interpreting these exceptions in a restrictive manner, the Court has applied the criteria of legality, legitimacy and necessity in a democratic society in a series of rulings which have resulted in case law that is extremely attentive to the defence of citizens' privacy from interference by the public authorities or third parties and which is also binding on the European Union and the Member States, given that they are all signatories to the ECHRFF, that Article 6 TEU refers to the ECHRFF and the related case law and that the European Court of Human Rights is recognised as having competence to assess the conformity of Community acts to the ECHRFF and that the EU Member States are responsible for the decisions adopted by the Union. The insertion in Article 15 of Directive 2002/58/EC of the possibility for EU Member States to lay down rules on the retention of data, as well as the clause excluding third pillar activities from the scope of the directive do not exempt the Union from compliance with the ECHRFF or with the case law of the Court.

In the opinion of your rapporteur, the rules on the systematic retention of data on communications flows between citizens, for time periods exceeding those laid down for the issuing and payment of invoices, which is a type of retention imposed by states on telephone

companies for reasons of public order, pose serious problems in terms of conformity with the case law of the European Court of Human Rights and therefore with Community law[5].

Since the Commission, like the European Parliament, initially expressed its opposition to the inclusion of a reference to data retention, it should in the opinion of your rapporteur draw up a second document, based on an analysis of the case law of the European Court of Human Rights, that serves to guide the Member States in the transposition of Directive 2002/58/EC, in order to ensure that the national and European rules relating to the right to privacy conform to European legislation on human rights.[6] 

28 January 2004

OPINION OF THE COMMITTEE ON LEGAL AFFAIRS AND THE INTERNAL MARKET

for the Committee on Citizens' Freedoms and Rights, Justice and Home Affairs

on the first report on the implementation of the Data Protection Directive (COM(2003) 265 – C5-0375/2003 – 2003/2153(INI)) (95/46/EC)

Draftswoman: Anne-Marie Schaffner

 PROCEDURE

The Committee on Legal Affairs and the Internal Market appointed Anne-Marie Schaffner draftswoman at its meeting of 7 July 2003.

It considered the draft opinion at its meetings of 2 December 2003 and 22 January 2004. At the latter/last meeting it adopted the following suggestions unanimously.

The following were present for the vote: Giuseppe Gargani (chairman), Bill Miller (vice- chairman), Anne-Marie Schaffner (draftswoman), Uma Aaltonen, Paolo Bartolozzi, Luis Berenguer Fuster (for Maria Berger), Ward Beysen, Bert Doorn, Raina A. Mercedes Echerer (for Brian Crowley pursuant to Rule 153(2)), Janelly Fourtou, Marie-Françoise Garaud, José María Gil-Robles Gil-Delgado, Kurt Lechner, Klaus-Heiner Lehne, Sir Neil MacCormick, Manuel Medina Ortega, Elena Ornella Paciotti, Marianne L.P. Thyssen, Ian Twinn (for Rainer Wieland), Diana Wallis, Joachim Wuermeling and Stefano Zappalà.

CONCLUSIONS

The Committee on Legal Affairs and the Internal Market calls on the Committee on Citizens' Freedoms and Rights, Justice and Home Affairs, as the committee responsible, to incorporate the following suggestions into its motion for a resolution:

1. Considers that the 1995 Data Protection Directive has attained its objective of removing many barriers to the free movement of personal data between the Member States and of providing a high standard of protection in the Community;
2. Considers, like the Commission, that it is too early to propose amendments to the Directive, given the Member States' very limited experience with applying it;
3. Welcomes, accordingly, the Commission's proposal to set up a work programme based on cooperation among the Member States, on the one hand, and between the Member States and the Commission, on the other; hopes that the Commission will examine the results of that work programme in great detail with a view to formulating, if necessary, amendments to the Directive at an early date;
4. Points out that Europe will have 25 Members as from 1 May 2004, and urges all the Member States to adapt their legislation to bring it into line with the provisions of the Directive; also urges the new Member States to allocate sufficient resources to their supervisory authorities and to introduce impartial arrangements for appointing members of those authorities so as to ensure the latter's independence and full cooperation with their partners within the European Union;
5. Points out that the completion of the internal market is conditional upon guaranteed data protection; accordingly, calls on the Commission to highlight the areas in which diverging interpretations of the Directive are hampering the smooth operation of the internal market, and to report on this to the European Parliament;
6. Regrets the fact that the tardy implementation of the Directive by the Member States and the continuing differences in the way in which it is applied at national level have prevented economic operators from drawing maximum benefit from it, and have blocked some cross-border activities within the European Union;
7. Stresses that the free movement of personal data is vital for the smooth operation of virtually all Union-wide economic activities; it is therefore necessary to resolve these differences of interpretation as soon as possible, to enable multinational organisations to frame pan-European data protection policies;
8. Stresses the need for the Member States and the European institutions to adopt an equivalent level of protection of fundamental rights and protection of individuals in applying both Directive 95/46/EC and Regulation (EC) No 45/2001 on data protection.

9. Calls on the Commission to adopt an approach seeking to harmonise this Directive with other legislative provisions, such as the proposal for a European Parliament and Council directive for the approximation of laws, regulations and administrative provisions of the Member States concerning consumer credit, in order to avoid inconsistencies between such proposals;
10. Reiterates the call made by the European Parliament in its resolution on the transmission of personal data by airlines in the case of transatlantic flights[7] and expresses its wish to see that call implemented.

27 January 2004

OPINION OF THE COMMITTEE ON INDUSTRY, EXTERNAL TRADE, RESEARCH AND ENERGY

for the Committee on Citizens' Freedoms and Rights, Justice and Home Affairs

on the first report on the implementation of the Data Protection Directive (95/46/EC) (COM(2003) 265 – C5–0375/2003 – 2003/2153(INI))

Draftswoman: Myrsini Zorba

 PROCEDURE

The Committee on Industry, External Trade, Research and Energy appointed Myrsini Zorba draftsman at its meeting of 20 October 2003.

It considered the draft opinion at its meetings of 2 December 2003 and 27 January 2004. At the last meeting it adopted the following suggestions unanimously.

The following were present for the vote: Luis Berenguer Fuster (chairman), Yves Piétrasanta (vice-chairman), , Myrsini Zorba (draftswoman), Sir Robert Atkins, Felipe Camisón Asensio (for Guido Bodrato), Giles Bryan Chichester, Nicholas Clegg, Willy C.E.H. De Clercq, Concepció Ferrer, Francesco Fiori (for Michel Hansenne), Colette Flesch, Glyn Ford (for Massimo Carraro), Norbert Glante, Hans Karlsson, Helmut Kuhne (for Harlem Désir), Caroline Lucas, Eryl Margaret McNally, Hans-Peter Martin (for Rolf Linkohr), Ana Miranda de Lage, Angelika Niebler, Reino Paasilinna, Paolo Pastorelli, Godelieve Quisthoudt-Rowohl, Imelda Mary Read, Mechtild Rothe, Christian Foldberg Rovsing, Martin , Konrad K. Schwaiger, Esko Olavi Seppänen, Claude Turmes, W.G. van Velzen, Alejo Vidal-Quadras Roca and Olga Zrihen Zaari.

SUGGESTIONS

The Committee on Industry, External Trade, Research and Energy calls on the Committee on Citizens' Freedoms and Rights, Justice and Home Affairs, as the committee responsible, to incorporate the following suggestions in its motion for a resolution:

1. whereas the average citizen needs to know better the risks and the possibilities related to the disclosure of personal data concerning him/her,
2. whereas in the Internet's global information society context, solutions cannot be found within the EU only,
3. whereas personal data protection infringements (concerning EU citizens' data) are likely to take place more in third countries than in the Member States,
4. whereas OECD guidelines on the "Protection of Privacy and Transborder Flows of personal Data", adopted in 23 September 1980 and the Council of Europe "Convention For the Protection of Individuals with Regard to Automatic Processing of Personal Data Council of Europe, Signed January 28, 1981 Entered into force October 1, 1985" don't seem to be internationally applied,

1. Points out that heterogeneous national data protection laws hinder the development of the internal market and therefore asks the Commission to support member States to interpret and apply the directive in a consistent way;
2. Underlines that, in particular, more homogeneity is needed with reference both to notification of processing operations and in the field of information provisions due by data controllers;
3. Welcomes the intention of the Commission of simplifying the regulatory framework for enterprises in the field of requirements for international transfers of data;
4. Believes that a proper implementation of the Data protection directive cannot be realised without a permanent consultation amongst member States national Authorities, national institutions, the business community and consumers' organisations;
5. Stresses the need to provide high and effective standards of data protection taking account of the latest technological development liked to the Information society;
6. Recalls the adoption of the directive on Privacy and Electronic communications, which foresees a particular implementation of the principles embodied in the Data Protection directive;
7. Asks the Commission to take action toward those member States that have not respected the deadline of 31 October 2003 for implementing the directive on Privacy and Electronic Communications;
8. Asks the Member States to respect criteria of legal clarity and legal security for a better regulation when implementing the directive in order to avoid any unnecessary burden on enterprises and particularly to SMEs;

9. Calls on Member States and supervisory authorities to create a less complex and burdensome environment for data controllers and agrees with the Commission on the need to avoid imposing requirements that could be dropped without any detrimental effects for the high level of protection guaranteed by the Directive;
10. Stresses that the management and protection of data are nowadays a critical factor of success for those companies that wish to protect their investments in hardware infrastructure;
11. Agrees with the Commission on the need for improvements to be made in order economic operators to have a wider choice of standard contractual clauses in the field of data protection and that these should possibly based on clauses submitted by business representatives associations;
12. Believes that self-regulation is a good mean to avoid excessively detailed legislation and calls on business community to create a European code of conduct on personal data protection;
13. Asks for an additional effort towards internationally agreed principles to be made at the national, European and international level in order to improve the application of OECD guidelines and the Council of Europe Convention;
14. Believes that protection of personal data and privacy will be practically sufficiently protected if and when it becomes part of the current social and political priorities;
15. Points out that privacy and personal data protection should be part of the educational curriculum related to computers and the Internet;
16. Asks the Member States and the Commission to promote citizens' awareness in the field of data protection right.