24.03.2013

EDPS: Additional Comments on the Data Protection Reform Package

Last week, the EDPS sent additional comments on the reform of the EU rules governing data protectionto the European Parliament, the Commission and the Council in view of [the] debate on the subject in the Civil Liberties, Justice and Home Affairs Committee (LIBE). These comments relate to specific areas that require clarification and are a reaction to a number of amendments proposed by various Parliament committees, including LIBE. [see press release]

I. ANONYMISATION AND PSEUDONYMISATION:
[...] In the EDPS' view, it should be ensured that amendments regarding the definition of anonymous data and pseudonymous data are fully consistent with the definition of personal data and that they do not lead to unduly removing certain categories of data from the scope of the Regulation, in particular in cases where it is not clear whether the data have indeed been fully anonymised. In such cases, the data should remain within the scope of the Regulation. [...]

II. SCOPE OF THE REGULATION:
[...] 3. Territorial scope
15. As to the territorial scope of application, some amendments have been proposed to Article 3(1) that restrict the data subjects to be covered by the Regulation only to those 'residing in the Union' (LIBE AM 700, LIBE AM 701, LIBE AM 703).

16. If accepted, these amendments would purport to deprive of protection large groups of data subjects which today are protected by Directive 95/46/EC. These include e.g. tourists, as well as processing activities conducted in the EU on data subjects residing abroad, creating a double legal standard within the Union. Furthermore, it should be noted that this restriction in secondary law is contrary to primary law, namely Article 16 TFEU and Article 8 of the EU Charter of Fundamental Rights, which explicitly afford the right to protection of personal data to 'everyone', meaning every individual who falls within the scope of EU law, irrespective of his or her place of residence. This has also been an important starting point in discussions with third countries. Given that the proposed Regulation limits the scope of the subjective rights in an appropriate manner, the EDPS advises against these amendments. [...]

Further comments by EDPS concern the following subjects:
III. PURPOSE LIMITATION AND LAWFULNESS OF THE PROCESSING
IV. ROLES, RESPONSIBILITIES AND LIABILITY OF CONTROLLER VS. PROCESSOR
V. FLEXIBILITY, RISK-BASED APPROACH, MSMEs
VI. TRANSFERS, INCLUDING PROPOSED ARTICLES 43a AND 44a
VII. COOPERATION, CONSISTENCY, BINDING POWERS EDPB
VIII. SANCTIONS
IX. PRELIMINARY FINDINGS ON THE DIRECTIVE