Considerations on COM(1999)337 - Protection of individuals with regard to the processing of personal data by the institutions and bodies of the EC and on the free movement of such data - Main contents
Please note
This page contains a limited version of this dossier in the EU Monitor.
| dossier | COM(1999)337 - Protection of individuals with regard to the processing of personal data by the institutions and bodies of the EC and on the ... |
|---|---|
| document | COM(1999)337  |
| date | December 18, 2000 |
(2) A fully-fledged system of protection of personal data not only requires the establishment of rights for data subjects and obligations for those who process personal data, but also appropriate sanctions for offenders and monitoring by an independent supervisory body.
(3) Article 286(2) of the Treaty requires the establishment of an independent supervisory body responsible for monitoring the application of such Community acts to Community institutions and bodies.
(4) Article 286(2) of the Treaty requires the adoption of any other relevant provisions as appropriate.
(5) A Regulation is necessary to provide the individual with legally enforceable rights, to specify the data processing obligations of the controllers within the Community institutions and bodies, and to create an independent supervisory authority responsible for monitoring the processing of personal data by the Community institutions and bodies.
(6) The Working Party on the Protection of Individuals with regard to the Processing of Personal Data set up under Article 29 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data(4) has been consulted.
(7) The persons to be protected are those whose personal data are processed by Community institutions or bodies in any context whatsoever, for example because they are employed by those institutions or bodies.
(8) The principles of data protection should apply to any information concerning an identified or identifiable person. To determine whether a person is identifiable, account should be taken of all the means likely to be reasonably used either by the controller or by any other person to identify the said person. The principles of protection should not apply to data rendered anonymous in such a way that the data subject is no longer identifiable.
(9) Directive 95/46/EC requires Member States to protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data, in order to ensure the free flow of personal data in the Community.
(10) Directive 97/66/EC of the European Parliament and of the Council of 15 December 1997 concerning the processing of personal data and the protection of privacy in the telecommunications sector(5) specifies and adds to Directive 95/46/EC with respect to the processing of personal data in the telecommunications sector.
(11) Various other Community measures, including measures on mutual assistance between national authorities and the Commission, are also designed to specify and add to Directive 95/46/EC in the sectors to which they relate.
(12) Consistent and homogeneous application of the rules for the protection of individuals' fundamental rights and freedoms with regard to the processing of personal data should be ensured throughout the Community.
(13) The aim is to ensure both effective compliance with the rules governing the protection of individuals' fundamental rights and freedoms and the free flow of personal data between Member States and the Community institutions and bodies or between the Community institutions and bodies for purposes connected with the exercise of their respective competences.
(14) To this end measures should be adopted which are binding on the Community institutions and bodies. These measures should apply to all processing of personal data by all Community institutions and bodies insofar as such processing is carried out in the exercise of activities all or part of which fall within the scope of Community law.
(15) Where such processing is carried out by Community institutions or bodies in the exercise of activities falling outside the scope of this Regulation, in particular those laid down in Titles V and VI of the Treaty on European Union, the protection of individuals' fundamental rights and freedoms shall be ensured with due regard to Article 6 of the Treaty on European Union. Access to documents, including conditions for access to documents containing personal data, is governed by the rules adopted on the basis of Article 255 of the EC Treaty the scope of which includes Titles V and VI of the Treaty on European Union.
(16) The measures should not apply to bodies established outside the Community framework, nor should the European Data Protection Supervisor be competent to monitor the processing of personal data by such bodies.
(17) The effectiveness of the protection of individuals with regard to the processing of personal data in the Union presupposes the consistency of the relevant rules and procedures applicable to activities pertaining to different legal contexts. The development of fundamental principles on the protection of personal data in the fields of judicial cooperation in criminal affairs and police and customs cooperation, and the setting-up of a secretariat for the joint supervisory authorities established by the Europol Convention, the Convention on the Use of Information Technology for Customs Purposes and the Schengen Convention represent a first step in this regard.
(18) This Regulation should not affect the rights and obligations of Member States under Directives 95/46/EC and 97/66/EC. It is not intended to change existing procedures and practices lawfully implemented by the Member States in the field of national security, prevention of disorder or prevention, detection, investigation and prosecution of criminal offences in compliance with the Protocol on Privileges and Immunities of the European Communities and with international law.
(19) The Community institutions and bodies should inform the competent authorities in the Member States when they consider that communications on their telecommunications networks should be intercepted, in keeping with the national provisions applicable.
(20) The provisions applicable to the Community institutions and bodies should correspond to those provisions laid down in connection with the harmonisation of national laws or the implementation of other Community policies, notably in the mutual assistance sphere. It may be necessary, however, to specify and add to those provisions when it comes to ensuring protection in the case of the processing of personal data by the Community institutions and bodies.
(21) This holds true for the rights of the individuals whose data are being processed, for the obligations of the Community institutions and bodies doing the processing, and for the powers to be vested in the independent supervisory authority responsible for ensuring that this Regulation is properly applied.
(22) The rights accorded the data subject and the exercise thereof should not affect the obligations placed on the controller.
(23) The independent supervisory authority should exercise its supervisory functions in accordance with the Treaty and in compliance with human rights and fundamental freedoms. It should conduct its enquiries in compliance with the Protocol on Privileges and Immunities and with the Staff Regulations of Officials of the European Communities and the conditions of employment applicable to Other Servants of the Communities.
(24) The necessary technical measures should be adopted to allow access to the registers of processing operations carried out by Data Protection Officers through the independent supervisory authority.
(25) The decisions of the independent supervisory authority regarding exemptions, guarantees, authorisations and conditions relating to data processing operations, as defined in this Regulation, should be published in the activities report. Independently of the publication of an annual activities report, the independent supervisory authority may publish reports on specific subjects.
(26) Certain processing operations likely to present specific risks with respect to the rights and freedoms of data subjects are subject to prior checking by the independent supervisory authority. The opinion given in the context of such prior checking, including the opinion resulting from failure to reply within the set period, should be without prejudice to the subsequent exercise by the independent supervisory authority of its powers with regard to the processing operation in question.
(27) Processing of personal data for the performance of tasks carried out in the public interest by the Community institutions and bodies includes the processing of personal data necessary for the management and functioning of those institutions and bodies.
(28) In certain cases the processing of data should be authorised by Community provisions or by acts transposing Community provisions. Nevertheless, in the transitional period during which such provisions do not exist, pending their adoption, the European Data Protection Supervisor may authorise processing of such data provided that adequate safeguards are adopted. In so doing, he should take account in particular of the provisions adopted by the Member States to deal with similar cases.
(29) These cases concern the processing of data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership and the processing of data concerning health or sex life which are necessary for the purposes of complying with the specific rights and obligations of the controller in the field of employment law or for reasons of substantial public interest. They also concern the processing of data relating to offences, criminal convictions or security measures and authorisation to apply a decision to the data subject which produces legal effects concerning him or her or significantly affects him or her and which is based solely on automated processing of data intended to evaluate certain personal aspects relating to him or her.
(30) It may be necessary to monitor the computer networks operated under the control of the Community institutions and bodies for the purposes of prevention of unauthorised use. The European Data Protection Supervisor should determine whether and under what conditions that is possible.
(31) Liability arising from any breach of this Regulation is governed by the second paragraph of Article 288 of the Treaty.
(32) In each Community institution or body one or more Data Protection Officers should ensure that the provisions of this Regulation are applied and should advise controllers on fulfilling their obligations.
(33) Under Article 21 of Council Regulation (EC) No 322/97 of 17 February 1997 on Community statistics(6), that Regulation is to apply without prejudice to Directive 95/46/EC.
(34) Under Article 8(8) of Council Regulation (EC) No 2533/98 of 23 November 1998 concerning the collection of statistical information by the European Central Bank(7), that Regulation is to apply without prejudice to Directive 95/46/EC.
(35) Under Article 1(2) of Council Regulation (Euratom, EEC) No 1588/90 of 11 June 1990 on the transmission of data subject to statistical confidentiality to the Statistical Office of the European Communities(8), that Regulation does not derogate from the special Community or national provisions concerning the safeguarding of confidentiality other than statistical confidentiality.
(36) This Regulation does not aim to limit Member States' room for manoeuvre in drawing up their national laws on data protection under Article 32 of Directive 95/46/EC, in accordance with Article 249 of the Treaty.