Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the institutions and bodies of the Community and on the free movement of such data
C 376 E/24 EN Official Journal of the European Communities 28. 12. 1999 Proposal for a regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the institutions and bodies of the Community and on the free movement of such data (1999/C 376 E/04) (Text with EEA relevance) COM(1999) 337 final - 1999/0153(COD) (Submitted by the Commission on 17 September 1999) THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION, should not apply to data rendered anonymous in such a way that the data subject is no longer identifiable. Having regard to the Treaty establishing the European Community and in particular Article 286 thereof, Having regard to the proposal from the Commission, Having regard to the opinion of Committee, the Economic and Social Acting in accordance with the procedure laid down in Article 251 of the Treaty, Whereas: (1) Article 286 of the Treaty requires the application to the Community institutions and bodies of the Community acts on the protection of individuals with regard to the processing of personal data and the free movement of such data. (2) A fully-fledged system of protection of personal data not only requires the establishment of rights for data subjects and obligations for those who process personal data, but also appropriate sanctions for offenders and monitoring by an independent supervisory body. (3) Article 286(2) of the Treaty requires the establishment of an independent supervisory body responsible for moni- toring the application of to Community institutions and bodies. such Community acts (4) Article 286(2) of the Treaty requires the adoption of any other relevant provisions as appropriate. (5) A regulation is necessary to provide the individual with legally enforceable rights, to specify the processing obli- gations of the controllers within the Community insti- tutions and bodies, and to create an independent super- visory body responsible for the external monitoring of Community processing of data. (6) The principles of data protection must apply to any information concerning an identified or identifiable person. To determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person. The principles of protection (7) Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of indi- viduals with regard to the processing of personal data and on the free movement of such data (1) requires Member States to protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data, in order to ensure in the Community. flow of personal data free the (8) Directive 97/66/EC of the European Parliament and of the Council of 15 December 1997 concerning the processing of personal data and the protection of privacy in the and particularises sector (2) telecommunications complements Directive 95/46/EC with respect to the processing of personal data in the telecommunications sector. (9) Various other Community measures, including measures on mutual assistance between national authorities and the Commission, are also designed to particularise and complement Directive 95/46/EC in the sectors to which they relate. (10) Consistent and homogeneous application of the rules for rights and the protection of individuals, freedoms with regard to the processing of personal data must be ensured throughout the Community. fundamental (11) The aim is to ensure both effective compliance with the rules governing the protection of individuals’ fundamental rights and freedoms and the free flow of personal data between Member States and the Community institutions and bodies or between the Community institutions and bodies for purposes connected with the exercise of their respective competences. (12) This can best be achieved by adopting measures which are binding on the Community institutions and bodies. These measures should apply to all processing of personal data by Community institutions and bodies in the exercise of their competences under the Treaties establishing the European Communities and the Treaty on European Union. (1) OJ L 281, 23. 11. 1995, p. 31. (2) OJ L 24, 30. 1. 1998, p. 1. 28. 12. 1999 EN Official Journal of the European Communities C 376 E/25 (13) The measures must be identical to the provisions laid down in connection with the harmonisation of national laws or the implementation of other Community policies, notably in the mutual assistance sphere. It may be necessary, however, to particularise and complement those provisions when it comes to ensuring protection in the case of the processing of personal data by the Community institutions and bodies. (14) This holds true for the rights of the individuals whose data are being processed, the Community institutions and bodies doing the processing, and for the powers to be vested in the independent super- visory body responsible for ensuring that this Regulation is properly applied. the obligations of for carried out (15) Processing of personal data for the performance of the the in the public tasks Community the and processing of personal data necessary for the management and functioning of those institutions and bodies. interest by includes institutions bodies (16) It may be necessary to monitor the computer networks operated under the control of the Community institutions and bodies for the purposes of prevention of unauthorised use. The European Data Protection Supervisor should determine whether and under what conditions that is possible. (17) Under Article 21 of Council Regulation (EC) No 322/97 of 17 February 1997 on Community statistics (1), that Regu- lation is to apply without prejudice to Directive 95/46/EC. the funda- Community institutions or bodies, shall protect mental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data. 2. The independent supervisory body established by this Regulation, hereinafter referred to as European Data Protection Supervisor, shall monitor the application of the provisions of this Regulation to all processing operations carried out by a Community institution or body. Article 2 Definitions For the purposes of this Regulation: (a) ápersonal dataí shall mean any information relating to an identified or identifiable natural person (ádata subjectí); an identifiable person is one who can be identified, directly or in particular by reference to an identification indirectly, number or to one or more factors specific to his/her physical, physiological, mental, cultural or social identity; economic, (b) áprocessing of personal dataí (áprocessingí) shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by trans- mission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction; (18) For reasons of transparency, it is necessary to make public further information on the application of this Regulation, including a list of the Community institutions and bodies which are subject to this Regulation. (c) ápersonal data filing systemí (áfiling systemí) shall mean any structured set of personal data which are accessible according to specific criteria, whether centralised, decen- tralised or dispersed on a functional or geographical basis; (19) The Working Party on the Protection of Individuals with regard to the processing of personal data set up under Article 29 of Directive 95/46/EC has delivered its opinion, HAVE ADOPTED THIS REGULATION: CHAPTER I GENERAL PROVISIONS Article 1 Object of the Regulation In accordance with this Regulation, the institutions and 1. bodies set up by, or on the basis of, the Treaties establishing to as the European Communities, hereinafter referred (1) OJ L 52, 22. 2. 1997, p. 1. (d) ácontrollerí shall mean the Community institution or body, the Directorate General, the unit or any other organisa- tional entity which alone or jointly with others determines the purposes and means of the processing of personal data; where are determined by a specific Community act, the controller or the specific criteria for its nomination may be designated by such Community act; and means of processing the purposes (e) áprocessorí shall mean a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller; (f) áthird partyí shall mean any natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or the processor, are auth- orised to process the data; C 376 E/26 EN Official Journal of the European Communities 28. 12. 1999 (g) árecipientí shall mean a natural or legal person, public authority, agency or any other body to whom data are disclosed, whether a third party or not; however, authorities which may receive data in the framework of a particular inquiry shall not be regarded as recipients; (h) áthe data subject’s consentí shall mean any freely given specific and informed indication of his/her wishes by which the data subject to personal data relating to him/her being processed; signifies his/her agreement down appropriate safeguards for personal data stored for longer periods for historical, statistical or scientific use, in particular with regard to making them anonymous. It shall be for the controller to ensure that paragraph 1 is 2. complied with. Section 2 Criteria for making data processing legitimate Article 3 Scope This Regulation shall apply to the processing of personal 1. data by all Community institutions and bodies. 2. This Regulation shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system. CHAPTER II Article 5 Lawfulness of processing Personal data may be processed only if: (a) processing is necessary for the performance of a task carried out in the public interest on the basis of a law or in the legitimate exercise of official authority vested in the Community institution or body or in a third party to whom the data are disclosed, or GENERAL RULES ON THE LAWFULNESS OF THE PROCESSING OF PERSONAL DATA (b) processing is necessary for compliance with a legal obli- gation to which the controller is subject, or Section 1 Principles relating to data quality Article 4 1. Personal data must be: (a) processed fairly and lawfully; (b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. Further processing of personal data for historical, statistical or scientific purposes shall not be considered as incompatible provided that the controller provides appro- priate safeguards, in particular to ensure that the data shall only be processed for such purposes; (c) adequate, relevant and not excessive in relation to the further for which they are collected and/or purposes processed; (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they were collected or for which they are further processed, are erased or rectified; (c) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract, or (d) the data subject has unambiguously given his/her consent, or (e) processing is necessary in order to protect the vital interests of the data subject. Article 6 Further processing for compatible purposes 1. Personal data shall only be processed for purposes other than those for which they have been collected if the change of purpose is expressly permitted by the internal rules of the Community institution or body. 2. Personal data collected for other purposes may be processed to ensure compliance with financial and budgetary regulations. (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further lay processed. The Community institution or body shall 3. Personal data collected exclusively for ensuring the security or the control of the processing systems or operations shall not be used for any other purpose, with the exception of the purposes referred to in Article 18(1)(a). 28. 12. 1999 EN Official Journal of the European Communities C 376 E/27 Article 7 Transfer of personal data within or between Community institutions or bodies Personal data shall only be transmitted within or to other 1. Community institutions or bodies if the data are necessary for the legitimate performance of tasks covered by the competence of the recipient. The controller and the recipient shall bear the responsi- 2. bility for the legitimacy of the transmission. The controller shall only verify the competence of the recipient and the merits of the request. If doubts arise as to the merits, the controller shall, however, also check the necessity of the transmission. The recipient shall ensure that the necessity of the transmission can be subsequently verified. Article 8 Transmissions Community institutions to persons and bodies, other than located in the and bodies, Member States 1. Personal data shall only be transmitted to persons and bodies located in the Member States if the recipient established the necessity of having the data communicated and if no reasons exist the data subject’s legitimate interests might be prejudiced. to assume that The recipient shall process the personal data only for the 2. purposes for which they were transmitted. Article 9 Transfer of personal data to persons and bodies, other than Community institutions and bodies, which are not subject to Directive 95/46/EC 1. Personal data shall only be transferred to persons and bodies other than Community institutions and bodies, which are not subject to national data protection law by virtue of if an adequate level of Article 4 of Directive 95/46/EC, protection is ensured in the country of the recipient or within the recipient international organisation and the data are transmitted strictly within the range of tasks covered by the controller and the requirements the competence of mentioned in Article 4(1)(b) of this Regulation are fulfilled. The adequacy of the level of protection afforded by the 2. country or international organisation in question shall be assessed in the light of all the circumstances surrounding a data transfer operation or set of data transfer operations; particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the country or international organi- sation of final destination, the rules of law, both general and sectoral, in force in the country or international organisation in question and the professional rules and security measures which are complied with in that country or international organisation. 3. The Community institutions and bodies shall inform the Commission and the European Data Protection Supervisor of cases where they consider the country or international organi- sation in question does not ensure an adequate level of protection within the meaning of paragraph 2. 4. Where the Commission, assisted by the committee set up by Article 31(1) of Directive 95/46/EC, finds that a country or an international organisation ensures or does not ensure an adequate level of protection within the meaning of paragraph 2 of this Article, the Community institutions and bodies shall take the necessary measures to comply with the Commission’s decision. That decision shall be adopted in accordance with the management procedure laid down in Article 4 of Council Decision 1999/468/EC (1) and without prejudice to Article 8 thereof. The period provided for 1999/468/EC shall be three months. in Article 4(3) of Decision By way of derogation from paragraph 1, the Community 5. institution or body may transfer personal data if: (a) the data subject has given his/her consent unambiguously to the proposed transfer; or (b) the transfer is necessary for the performance of a contract the between the data subject and the controller or implementation of pre-contractual measures taken in response to the data subject’s request; or (c) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and a third party; or (d) the transfer is necessary or legally required on important public interest grounds, or for the establishment, exercise or defence of legal claims; or (e) the transfer is necessary in order interests of the data subject; or to protect the vital (f) the transfer is made from a register which according to Community law is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate legitimate interest, to the extent that the conditions laid down in Community law for consultation are fulfilled in the particular case. (1) OJ L 184, 17. 7. 1999, p. 23. C 376 E/28 EN Official Journal of the European Communities 28. 12. 1999 The Community institutions and bodies shall inform the 6. European Data Protection Supervisor of (categories of) cases where they have applied paragraph 5. health-care services, and where those data are processed by a health professional subject to the obligation of professional secrecy or by another person also subject to an equivalent obligation of secrecy. Section 3 The processing of special categories of data Article 10 4. Subject to the provision of suitable safeguards, and for reasons of substantial public interest, exemptions in addition to those laid down in paragraph 2 may be laid down by decision of the European Data Protection Supervisor. 1. The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, data and concerning health or sex life, shall be prohibited. processing the of of data relating Processing to offences, 5. criminal convictions or security measures may be carried out only if instruments authorised by Community law or other adopted on the basis of the EU Treaty laying down suitable specific safeguards or authorised by the European Data Protection Supervisor. legal 2. Paragraph 1 shall not apply where: (a) the data subject has given his/her explicit consent to the processing of those data, except where the internal rules of the the Community institution or body provide that prohibition referred to in paragraph 1 may not be lifted by the data subject’s giving his/her consent; or (b) processing is necessary for the purposes of carrying out the obligations and specific rights of the controller in the field of employment in so far as it is authorised by Community law or rules implementing Community law, or agreed upon by the European Data Protection Supervisor, providing for adequate safeguards; or 6. The European Data Protection Supervisor shall determine the conditions under which a personal number or other identifier of general application in a Community institution or body may be processed. Section 4 Information to be given to the data subject Article 11 Information in cases of collection of data from the data subject 1. The controller must provide a data subject from whom data relating to himself/herself are collected with at least the following information, except where he/she already has it: (c) processing is necessary to protect the vital interests of the data subject or of another person where the data subject is physically or legally incapable of giving his/her consent; or (a) the identity of the controller; (d) processing relates to data which are manifestly made public by the data subject or is necessary for the establishment, exercise or defence of legal claims; or (e) processing is carried out in the course of its legitimate activities with appropriate guarantees by a non-profit seeking body which constitutes an entity integrated in a to national Community institution or body, not subject data protection law by virtue of Article 4 of Directive 95/46/EC, and with a political, philosophical, religious or trade-union aim and on condition that the processing relates solely to the members of this body or to persons who have regular contact with it in connection with its purposes and that the data are not disclosed to a third party without the consent of the data subjects. 3. Paragraph 1 shall not apply where processing of the data is required for the purposes of preventive medicine, medical diagnosis, assessment of the medical aptitude for recruitment, the provision of care or treatment or the management of (b) the purposes of the processing for which the data are intended; (c) the recipients or categories of recipients of the data; (d) whether replies to the questions are obligatory or voluntary, as well as the possible consequences of failure to reply; (e) the existence of the right of access to and the right to rectify the data concerning him/her; (f) any further information such as: - the legal basis of the processing for which the data are intended, - the time-limits for storing the data, - the right to have at any time recourse to the European Data Protection Supervisor, 28. 12. 1999 EN Official Journal of the European Communities C 376 E/29 in so far as such further information is necessary, having regard to the specific circumstances in which the data are collected, to guarantee fair processing in respect of the data subject. information proves impossible or would involve a dispropor- tionate effort or if recording or disclosure is expressly laid down by Community law. In these cases the Community insti- tution or body shall provide for appropriate safeguards. 2. By way of derogation from paragraph 1, the provision of information or part of it may be deferred as long as this is necessary to attain the legitimate objective of a statistical survey in view of its subject or its nature. The information must be provided as soon as the reason for which the information is withheld ceases to exist, unless this is manifestly unreasonable or impracticable. In such cases, the information shall be provided as soon as those circumstances have disap- peared at a later stage. Article 12 Information where the data have not been obtained from the data subject 1. Where the data have not been obtained from the data subject, the controller must at the time of undertaking the recording of personal data or if a disclosure to a third party is envisaged, no later than the time when the data are first disclosed provide the data subject with at least the following information, except where he/she already has it: (a) the identity of the controller; (b) the purposes of the processing; (c) the categories of data concerned; (d) the recipients or categories of recipients; (e) the existence of the right of access to and the right to rectify the data concerning him/her; (f) any further information such as: - the legal basis of the processing for which the data are intended, - the time-limits for storing the data, Section 5 The data subject’s right of access to data Article 13 Right of access Every data subject shall have the right to obtain at any time without excessive delay and free of charge from the controller: (a) confirmation as to whether or not data related to him/her are being processed; (b) information as to the purposes of the categories of data concerned, the recipients or categories of recipients to whom the data are disclosed; the processing, (c) communication in an intelligible the data undergoing processing and of any available information as to their source; form of (d) knowledge of the logic involved in any automated decision process concerning him/her. Article 14 Rectification The controller shall at the request of the data subject rectify without delay inaccurate or incomplete personal data. Article 15 Blocking 1. Personal data shall be blocked where: - the right to have at any time recourse to the European Data Protection Supervisor, (a) their accuracy is contested by the data subject and neither their accuracy nor their inaccuracy can be ascertained; - the origin of the data, except where the controller can not disclose this information for reasons of professional secrecy, in so far as such further information is necessary, having regard to the specific circumstances in which the data are processed, to guarantee fair processing in respect of the data subject. 2. Paragraph 1 shall not apply where, processing for statistical purposes or for historical or research, scientific in particular for the purposes of such the provision of (b) the controller no longer needs the accom- plishment of his/her tasks but they have to be maintained for reasons of proof; them for (c) the processing was unlawful and the data subject opposes their erasure and demands instead their blocking. 2. In automated filing systems blocking shall in principle be ensured by technical means. The fact that the personal data are blocked shall be indicated in the system in such a way that it becomes clear that the personal data cannot be used. C 376 E/30 EN Official Journal of the European Communities 28. 12. 1999 Blocked personal data shall, with the exception of their 3. storage, only be processed if they are required for discharging the burden of proof, where the data subject has consented, or for reasons based on the legal interest of a third party. Article 16 Erasure Personal data shall be erased if 1. their processing was unlawful, in particular when the provisions of Sections 1, 2 and 3 of Chapter II are violated. 2. Personal data shall be erased if the controller no longer needs them for the accomplishment of his/her tasks and there is no reason to believe that the data subject’s interests might be prejudiced by the erasure. Article 17 Notification to third parties The controller shall notify third parties to whom the data have been disclosed of any rectification, erasure or blocking unless this proves impossible or involves a disproportionate effort. Section 6 Exemptions and restrictions Article 18 1. The Community institutions and bodies may restrict the application of Article 4(1), Article 11, Article 12(1), Article 13, Article 33 and Article 34(1) when such a restriction constitutes a necessary measure to safeguard: the controller provides adequate legal clearly no risk of breaching the privacy of the data subject and that in particular to ensure that the data are not used for taking measures or decisions regarding a particular individual. safeguards, 3. If a restriction as provided for by paragraph 1 is applied, the data subject shall be informed of the major reasons on which the application of the restriction is based and of his/her right to have recourse to the European Data Protection Supervisor. 4. As soon as the reason for which the restrictions as provided for by paragraph 1 are applied ceases to exist, the provisions referred to in paragraph 1 shall again be fully applied. Section 7 Objections and complaints Article 19 The data subject’s right to object The data subject shall have the right to object at any time on compelling legitimate grounds relating to his/her particular situation to the processing of data relating to him/her, except in the cases covered by Article 5, points (b), (c) and (d). Where there is a justified objection, the processing in question may no longer involve those data. Article 20 The data subject’s right to lodge complaints The data subject shall have the right to lodge complaints at any time to the European Data Protection Supervisor. Article 21 (a) the prevention, investigation, detection and prosecution of Automated individual decisions criminal offences; (b) an important economic or financial interest of a Member including monetary, the European Union, State or of budgetary and taxation matters; (c) the protection of the data subject or of the rights and freedoms of others; (d) a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in cases referred to in (a) and (b). 2. Articles 13 to 16 shall not apply when data are processed solely for purposes of scientific research or are kept in personal form for a period which does not exceed the period necessary for the sole purpose of creating statistics, provided that there is No one shall be subject to a decision which produces legal effects concerning him/her or significantly affects him/her and which is based solely on automated processing of data intended to evaluate certain personal aspects relating to him/her, such as his/her performance at work, reliability or conduct, unless the decision is expressly authorised by a legal provision which also lays down measures to safeguard the data subject’s legitimate interests. Section 8 Confidentiality of processing Article 22 Confidentiality and security of processing Any person acting under the authority of the controller or of the processor, including the processor himself/herself, who has access to personal data shall not process them except on instructions from the controller, unless he is required to so by national law. 28. 12. 1999 EN Official Journal of the European Communities C 376 E/31 Article 23 Article 24 Security of processing Processing of personal data on behalf of controllers 1. Having regard to the state of the art and the cost of their implement the technical implementation, the controller shall and organisational measures necessary to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected. 1. The controller shall, where processing is carried out on his/her behalf, choose a processor providing sufficient guar- antees in respect of the technical security measures and organi- sational measures required by Article 23 and shall ensure compliance with those measures. 2. Where personal data are manually processed, appropriate measures shall be taken in particular to prevent any unauth- orised access or disclosure, alteration, destruction or accidental loss. 2. The carrying out of processing by way of a processor shall be governed by a contract or legal act binding the processor to the controller and stipulating in particular that: 3. Where personal data are processed by automated means, measures shall be taken in particular to: (a) the processor shall act only on instructions from the controller; (a) prevent any unauthorised person from gaining access to computer systems processing personal data; (b) prevent any unauthorised reading, reproduction, alteration or removal of storage media; (c) prevent any unauthorised memory inputs as well as any unauthorised disclosure, alteration or erasure of stored personal data; (d) prevent unauthorised persons from using data processing systems by means of data transmission facilities; (e) ensure that authorised users of a data processing system can access no personal data other than those to which their access right refers; (f) record which personal data have been communicated, at what times and to whom; (b) the obligations set out in Article 23 shall also be incumbent on the processor. For the purposes of keeping proof, 3. the contract or the legal act relating to data protection and the requirements relating to the measures referred to in Article 23 shall be in writing or in another equivalent form. the parts of Section 9 Data protection officer Article 25 Appointment and tasks of the Data Protection Officer Each Community institution and Community body shall 1. appoint at least one person of appropriate rank as personal data protection officer, with the task of: (g) ensure that it will be subsequently possible to check and verify which personal data have been processed, at what times and by whom; (a) ensuring that controllers and data subjects are informed of their rights and obligations; (h) ensure that personal data being processed on behalf of third parties can be processed only in the manner prescribed by the contracting institution or body; (b) cooperating with the European Data Protection Supervisor at the latter’s request or on his/her own initiative; (i) ensure that, during communication of personal data and the data cannot be during transport of storage media, read, copied, or erased without authorisation; (c) ensuring in an independent manner the internal application of provisions of this Regulation and of all other provisions adopted to implement these rules; (j) design the organisational structure within an institution or the special it will meet body in such a way that requirements of data protection. (d) keeping the register of processing operations carried out by the controller, containing the items of information referred to in Article 26(2); C 376 E/32 EN Official Journal of the European Communities 28. 12. 1999 (e) notifying the European Data Protection Supervisor of the processing operations likely to present specific risks within the meaning of Article 28; - processing operations intended to assess the personality of including his/her ability, efficiency and the data subject, conduct. the data thereby ensuring that subjects are unlikely to be adversely affected by the processing operations. the rights and freedoms of 2. The Data Protection Officer shall be provided with the staff and resources required for the performance of his/her duties. These processing operations shall be subject to prior checks. 2. The prior checks shall be carried out by the European Data Protection Supervisor following receipt of a notification from the Data Protection Officer who, in case of doubt, shall consult the European Data Protection Supervisor. rules Further concerning implementing 3. the Data Protection Officer shall be adopted by each Community insti- tution or body on the basis of the guidelines laid down in Annex I. The implementing rules shall in particular concern the qualifications, independence and the tasks, duties and powers of the Data Protection Officer. the appointment, dismissal, Article 26 Notification to the Data Protection Officer The controller 1. shall give prior notice to the Data Protection Officer of any processing operation or set of such operations intended to serve a single purpose or several related purposes. The information to be given shall 2. information referred to in Annex II. include at least the Any change affecting that promptly to the Data Protection Officer. information shall be notified Article 27 Register A register of processing operations notified in accordance with Article 26 shall be kept by each Data Protection Officer. The registers shall contain at least the information referred to in Article 26(2). The registers may be inspected by any person. Section 10 Prior checking by the European Data Protection Supervisor Article 28 1. The European Data Protection Supervisor shall determine the processing operations likely to present specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes, such as that of excluding indi- viduals from a right, benefit or contract, or by virtue of the specific use of new technologies. These processing operations shall include the following: - certain processing operations involving special categories of data as referred to in Article 10; 3. The European Data Protection Supervisor shall deliver his/her opinion within two months following receipt of the notification. If the opinion has not been delivered by the end of that two-month period, it shall be deemed to be favourable. 4. The European Data Protection Supervisor shall keep a register of all processing operations that have been notified to him/her pursuant shall contain the information referred to in Article 26(2). It shall be open to public inspection. to paragraph 2. The register Automated means of 5. communication between the Community institutions or bodies such as an on-line access to databases or an interlinking shall only be established after examination by the European Data Protection Supervisor. In the course of the examination, the European Data Protection Supervisor shall determine whether an automated communi- cation is compatible with the legitimate interests of the data subjects and necessary in view of the tasks of the Community institutions or bodies involved. CHAPTER III REMEDIES AND SANCTIONS Article 29 Remedies 1. Without prejudice to any judicial remedy, every data subject may complain to the European Data Protection Supervisor if he/she considers that his/her rights have been violated as a result of the processing of his/her personal data by a Community institution or body. 2. The Court of Justice of the European Communities and the Court of First Instance of the European Communities shall have jurisdiction to hear all disputes which relate to the provisions of this Regulation, including claims for damages. Article 30 Sanctions Any failure to comply with the obligations pursuant to this Regulation, whether intentionally or through negligence on his/her part, shall make an official or other servant of the European Communities in accordance with the rules and procedures laid down in the Staff Regulations of Officials of the Communities or in the conditions of employment applicable to them. to disciplinary action, liable 28. 12. 1999 EN Official Journal of the European Communities C 376 E/33 CHAPTER IV PROTECTION OF PERSONAL DATA AND PRIVACY IN INTERNAL TELECOMMUNICATIONS THE CONTEXT OF NETWORKS Article 31 Scope In addition to the other provisions of this Regulation, this Chapter shall apply to the processing of personal data in connection with the use of telecommunications networks and terminal a Community institution or body. equipment operated under control of the For the purpose of this Chapter, áuserí shall mean any natural person using a telecommunications network operated under the control of a Community institution or body. Article 32 Security 1. The Community institutions and bodies shall take appro- priate technical and organisational measures to safeguard the secure use of the telecommunications networks and terminal equipment, if necessary in conjunction with the providers of publicly available telecommunications the providers of public telecommunications networks. Having regard to the state of the art and the cost of their implemen- tation, these measures shall ensure a level of security appro- priate to the risk presented. services and/or Article 34 Traffic and billing data 1. Traffic data relating to users processed and stored to establish calls and other connections over the telecommuni- cations network shall be erased or made anonymous upon termination of the call or other connection without prejudice to the provisions of paragraphs 2, 3 and 4. 2. For the purpose of telecommunications budget and traffic management, including the verification of authorised use of the telecommunications system, traffic data as indicated in a list agreed by the European Data Protection Supervisor may be processed. Processing of traffic and billing data shall be restricted to 3. what is necessary for the purposes of the activities referred to in paragraph 2 and shall only be carried out by persons handling billing, traffic or budget management. Users of the telecommunication networks shall have the 4. right to receive non-itemised bills. Article 35 Directories of users Personal data contained in printed or electronic direc- 1. tories of users shall be limited to what is necessary for the specific purposes of the directory. In case of any particular risk of a breach of the security 2. of the network and terminal equipment, the Community insti- tution or body concerned shall inform the users concerning such risks and any possible remedies or alternative means of communication. 2. The Community institutions and bodies shall take all the necessary measures to prevent personal data contained in those directories, regardless of whether they are accessible to the public or not, from being used for direct marketing purposes. Article 33 Article 36 Confidentiality of the communications 1. Community institutions and bodies shall ensure the confi- dentiality of communications by means of telecommunications networks and terminal equipment. Listening, tapping, storage or other kinds of interception or than users, surveillance of shall be without prohibited. communications, by others the users consent of concerned, the Paragraph 1 shall not affect any recording of communi- 2. cations authorised by the internal rules of the Community institutions or bodies, for the purpose of providing evidence of legal or procedural acts relevant to the official tasks of the Community institutions or bodies concerned, subject to the agreement of the European Data Protection Supervisor. Presentation and restriction of calling and connected line identification 1. Where presentation of calling-line identification is offered, the calling user shall have the possibility via a simple means, free of charge, to eliminate the presentation of the calling-line identification. identification is 2. Where presentation of offered, the called user shall have the possibility via a simple means, free of charge, to prevent the presentation of the calling line identification of incoming calls. calling-line 3. Where presentation of connected line identification is offered, the called user shall have the possibility via a simple means, free of charge, to eliminate the presentation of the connected line identification to the calling user. C 376 E/34 EN Official Journal of the European Communities 28. 12. 1999 4. Where presentation of calling and/or connected line identification is offered, the Community institutions and bodies shall inform the users thereof and of the possibilities set out in paragraphs 1, 2 and 3. Article 37 Exceptions Community institutions and bodies shall ensure that there are transparent procedures governing the way in which they may override the elimination of the presentation of calling line identification: (a) on a temporary basis, upon application of a user requesting the tracing of malicious or nuisance calls; (b) on a per-line basis for organisational entities dealing with emergency calls, for the purpose of answering such calls. CHAPTER V SUPERVISORY AUTHORITY: EUROPEAN DATA PROTECTION SUPERVISOR Article 38 Supervisory authority: European Data Protection Supervisor A supervisory authority is hereby established referred to 1. as the European Data Protection Supervisor. 2. It shall be responsible for monitoring the application of the provisions of this Regulation and any other Community act relating to the protection of natural persons with regard to the processing of personal data by a Community institution or a Community body. Article 39 Appointment On a proposal from the Commission, 1. the European Parliament, the Council and the Commission shall appoint by common accord the European Data Protection Supervisor for a term of four years. 2. The European Data Protection Supervisor shall be chosen from among persons who belong or have belonged in their respective countries to the independent authorities supervising the processing of personal data or who are especially qualified for this office. The European Data Protection Supervisor shall be eligible 3. for reappointment. The European Data Protection Supervisor shall remain in 4. office until he/she has been replaced. 5. Apart from normal replacement or death, the duties of the European Data Protection Supervisor shall end when he/she resigns, or is compulsory retired in conformity with paragraph 6. The European Data Protection Supervisor may be 6. the dismissed by the Court of if European Parliament, he/she no longer the performance of his/her duties or if he/she is guilty of serious misconduct. the request of the Commission, required for Justice at the Council or the conditions fulfils Subject to the provisions of this Chapter, the provisions 7. of the the Protocol on the Privileges and Immunities of European Communities applicable to the Judges of the Court of Justice shall also apply to the European Data Protection Supervisor. Article 40 Conditions of employment The European Parliament, 1. the Commission shall by common accord determine the conditions of employment of the European Data Protection Supervisor and in particular his/her salary, allowances and any other benefits in lieu of remuneration. the Council and The European Parliament shall ensure that the European 2. Data Protection Supervisor is provided with the staff and equipment necessary for the performance of his/her tasks. The staff and equipment to be provided shall be itemised the European to the budget of 3. in a separate Chapter Parliament. 4. Staff members shall be appointed by the European Data Protection Supervisor. Their superior shall be the European Data Protection Supervisor and they shall be subject exclusively to his/her direction. The officials and the other staff members shall be subject 5. to the rules and regulations applicable to officials and other servants of the European Communities. In matters concerning its the European Data 6. Protection Supervisor shall have the same status as the insti- tutions within the meaning of Article 1 of the Staff Regulations of Officials of the European Communities. staff, Article 41 Independence 1. in The European Data Protection Supervisor shall act complete independence in the performance of his/her duties. 2. in the The European Data Protection Supervisor shall, performance of his/her duties, neither seek nor take instruction from anybody. 3. The European Data Protection Supervisor shall refrain from any action incompatible with his/her duties and shall not, during his/her term of office, engage in any other occu- pation, whether gainful or not. 4. The European Data Protection Supervisor shall, after his/her term of office, behave with integrity and discretion as regards the acceptance of appointments and benefits. 28. 12. 1999 EN Official Journal of the European Communities C 376 E/35 Article 42 Professional secrecy shall be The European Data Protection Supervisor 2. informed by the Commission of all draft proposals for Community legislation entailing a processing of personal data. The European Data Protection Supervisor and his/her staff shall, both during and after their term of office, be subject to a duty of professional secrecy with regard to any confidential matters which have come to their knowledge in the course of the performance of their official duties. The European Data Protection Supervisor may be 3. consulted by each Community institution or body on all operations related to the processing of personal data. Article 43 Duties The European Data Protection Supervisor shall: (a) receive and investigate complaints; (b) supervise all processing operations involving personal data by any Community institution or body with the exception of the Court of Justice and the Court of First Instance acting in their judicial role; (c) advise all Community institutions and bodies on all matters concerning the use of personal data, in particular before they draw up internal rules relating to the protection of individual and freedoms with regard to the rights processing of personal data; (d) follow the development of information and communication they have an impact on the insofar as technologies protection of personal data; (e) cooperate with the national supervisory authorities to the extent necessary for the performance of his/her duties, in particular by information or requesting an authority of a Member State to exercise its powers; exchanging all useful (f) participate in the activities of the Working party on the Protection of Individuals with regard to the Processing of Personal Data set up by Article 29 of Directive 95/46/EC; (g) keep a register of processing notified to him/her; Article 45 Recourse 1. Any person employed with Community institutions or bodies may on a matter affecting his/her tasks have recourse to the European Data Protection Supervisor, without acting through official channels. No one shall suffer prejudice on account of a recourse or 2. a complaint to the European Data Protection Supervisor alleging a violation of the provisions governing the processing of personal data. Article 46 Powers The European Data Protection Supervisor 1. particular: shall, in (a) conduct inquiries either on his/her own initiative or on the basis of complaints or recourses; (b) be supplied without delay with all information concerning his/her enquiries; (c) be granted at any time access to all official premises. All controllers shall support Supervisor in the performance of his/her duties. the European Data Protection The European Data Protection Supervisor shall have the 2. power to: (a) order the rectification, blocking erasure or destruction of all data processed in violation of the provisions governing the processing of personal data; (h) carry out a prior check of processing notified to him/her. (b) impose a temporary or definitive ban on processing; Article 44 Consultation 1. The Community institutions and bodies shall inform the European Data Protection Supervisor when drawing up draft measures related to the processing of personal data involving a Community institution or body alone or jointly with others. (c) warn or admonish the controller; (d) report the matter to the Community institution or body concerned and if necessary to the European Parliament, the Council and the Commission; (e) intervene in actions brought before the Court of Justice and the Court of First Instance; C 376 E/36 EN Official Journal of the European Communities 28. 12. 1999 (f) give advice to the data subjects and, if requested, assist them as expert in proceedings before the Court of First Instance. Article 47 Activities report 3. Where the European Data Protection Supervisor estab- lishes a violation of the provisions governing the processing of personal data, or any other irregularities in the processing, he/she shall refer the matter to the Community institution or body concerned and where appropriate make proposals for remedying those irregularities and for improving the protection of the data subjects. 4. The Community institution or body concerned shall inform the European Data Protection Supervisor of its views within a period to be specified by him/her. The reply shall also include a description of the measures taken in response to the remarks of the European Data Protection Supervisor. 5. In the event of a complaint or recourse, the European Data Protection Supervisor shall inform the persons concerned of the outcome of his/her enquiries. the 6. Where the data subject has been denied access, European Data Protection Supervisor shall only inform him/her of whether the data have been processed correctly and, if not, whether the necessary corrections have been made. If the European Data Protection Supervisor considers that the the restriction to the right of confirmation application of provided for in Article 13(a), its effect by providing this the European Data Protection Supervisor shall not inform the data subject of the outcome of his/her enquiry. is deprived of information, 1. The European Data Protection Supervisor shall submit an annual report on his/her activities to the European Parliament and at the same time make it public. The report shall be forwarded to the other institutions 2. and bodies of the European Union and shall be discussed by the European Parliament together with their replies. CHAPTER VI FINAL PROVISIONS Article 48 Transitional period Community institutions and bodies shall ensure that processing already under way on the date this Regulation enters into force is brought into conformity with this Regulation within one year of that date. Article 49 Entry into force This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Communities. 7. Actions against decisions of the European Data Protection Supervisor shall be brought before the Court of Justice or the Court of First Instance. This Regulation shall be binding in its entirety and directly applicable in all Member States. ANNEX I 1. The data protection officer shall be selected on the basis of his/her authority, his/her expert knowledge of data protection and his/her personal reliability. 2. The appointment of the data protection officer shall not entail a conflict of interests with regard to other official duties, in particular in relation to the application of the provisions of this Regulation. 3. The data protection officer shall be appointed for a term of at least two years. He/she shall be eligible for reap- pointment. The data protection officer may only be dismissed with the consent of the European Data Protection Supervisor, if he/she no longer fulfils the conditions required for the performance of his/her duties. 4. With respect to the performance of his/her duties, the data protection officer may not receive any instructions. 5. After his/her appointment the data protection officer shall be registered with the European Data Protection Supervisor by the institution, body (or person) which appointed him/her. 28. 12. 1999 EN Official Journal of the European Communities C 376 E/37 6. The data protection officer may make recommendations for the practical improvement of data protection and advise the Community institution or body which appointed him/her and the controller concerned on matters concerning the application of data protection provisions. Furthermore he/she shall, on his/her own initiative or at the request of the Community institution or body which appointed him/her, the controller, the Staff Committee concerned or data subject, investigate matters and occurrences directly relating to his/her tasks and come to his/her notice. 7. The data protection officer may be consulted by the Community institution or body which appointed him/her, by the controller concerned, by the Staff Committee concerned and by any individual, without going through the official channels, on any matter concerning the interpretation or application of the Regulation. 8. No one shall suffer prejudice on account of a matter brought to the attention of the data protection officer and suggesting a violation of the provisions of this Regulation. 9. Every controller concerned shall be required to assist the data protection officer in performing his/her duties and to give information in reply to questions. In performing his/her duties, the data protection officer shall have access at all times to the data forming the subject-matter of processing operations and to all offices, data processing instal- lations and data carriers, and may collect the necessary information. 10. To the extent required, the data protection officer shall be relieved from other activities. The data protection officer and his/her staff, to whom Article 287 of the Treaty shall apply, shall be required not to divulge information or documents which they obtain in the course of their duties. 1. The name and address of the controller. ANNEX II 2. The names of the persons and/or the indication of the organisational parts of an institution or body charged with the processing of personal data for a particular purpose. 3. The purpose or purposes of the processing. 4. A description of the category or categories of data subjects and of the data or categories of data relating to them. 5. The legal basis of the processing for which the data are intended. 6. The recipients or categories of recipient to whom the data might be disclosed. 7. The time limits for blocking and erasure of the different categories of data. 8. Proposed transfers of data to third countries. 9. A general description allowing a preliminary assessment to be made of the appropriateness of the measures taken pursuant to Article 23 to ensure security of processing