8.2.2014   

EN

Official Journal of the European Union

C 38/8

Executive Summary of Opinion of the EDPS on the Proposal for a Regulation of the European Parliament and of the Council concerning type-approval requirements for the deployment of the eCall system and amending Directive 2007/46/EC

(The full text of this Opinion can be found in English, French and German on the EDPS website (http://www.edps.europa.eu))

(2014/C 38/04)

1.   Introduction

1.1.   Consultation of the EDPS

1.

On 13 June 2013, the Commission adopted the proposal for a Regulation of the European Parliament and of the Council concerning type-approval requirements for the deployment of the eCall system and amending Directive 2007/46/EC (the Proposal) (1) announced in the Commission Communication of 21 August 2009 on ‘eCall: Time for Deployment’ (the 2009 Communication) (2).

2.

The EDPS welcomes the fact that he is consulted by the Commission and that a reference to the consultation is included in the preambles of the Proposal.

3.

Before the adoption of the Proposal, the EDPS was given the possibility to provide informal comments to the Commission. He highly appreciates that most of his comments have been taken into account.

1.2.   Objective and scope of the Proposal

4.

This Proposal complements other regulatory measures which have been implemented to support the deployment of eCall, such as the ITS Directive 2010/40/EU (3), the Commission Recommendation of 8 September 2011 on the support to the EU-wide eCall service (4), and the adoption of specifications for the upgrade of Public Safety Answering Points (PSAPs) (5), on which the EDPS was consulted and provided comments (6).

5.

The Proposal provides for the mandatory introduction of an eCall in-vehicle system in new type-approved vehicles in Europe. Contrary to the current system where eCall is installed by car manufacturers on a voluntary basis, the Proposal provides for the mandatory fitting of eCall devices in all new vehicles starting with new passenger cars and light commercial vehicles by 1 October 2015 (7). It therefore contains several obligations addressed to vehicle/equipment manufacturers.

4.   Conclusions

63.

The EDPS emphasises that the processing of personal data is one of the core obligations created by the Proposal and welcomes that many recommendations he made in relation to 112 eCall's data protection implications were taken into account.

64.

Regarding 112 eCall, the EDPS recommends that the following issues are further specified in the Proposal:

—

an explicit reference to applicable EU data protection law should be inserted in the Proposal in a substantive and dedicated provision, mentioning in particular Directive 95/46/EC and specifying that the provisions will apply in accordance with the national rules implementing it;

—

the reference to the Article 29 Working Party working document is dissociated from the reference made to the data protection legislation in recital 13;

—

concrete data protection safeguards applying to 112 eCall should be developed in the Proposal rather than in delegated acts and in particular that Article 6:

—

designates the controller and the authority responsible for handling access requests;

—

specifies the list of data referred to as a minimum set of data and as a full set of data (possibly to be elaborated in a delegated or implementing act);

—

includes the possibility for data subjects to deactivate private eCall and added value services;

—

specifies retention periods for the data processed;

—

specifies the modalities of the exercise of data subjects’ rights;

—

Article 6(3) should be complemented to ensure that the information it refers to is part of the technical documentation handed over together with the vehicle and it should be specified in the Proposal that the availability of the information has to be pointed out to the car owner at the time of the purchase of the car, in a separate document;

—

the EDPS should be consulted prior to the adoption of delegated acts foreseen in Article 6(4);

65.

Regarding private eCall and added value services, the EDPS reminds that they are regulated by the Proposal so that they comply with similar or stricter data protection requirements than those foreseen for the 112 eCall system. He also reminds that:

—

the Proposal specifies that contrary to the 112 eCall, private eCall and added value services shall be activated on a voluntary basis and deactivated by default;

—

the requirement for an appropriate and distinct contract between the consumer and the service provider is stated in a specific provision of the proposed Regulation and that it is clarified in the provision that this contract should cover data protection aspects, including providing appropriate information to consumers on the service(s) and collecting their consent for the processing of data in relation to the provision of these added value services; the proposal ensures that data subjects are given the choice to opt for the services, through a specific contract offer, made prior to the processing: non-negotiable clauses part of a car sale contract, or clauses belonging to general terms and conditions, whose acceptance is mandatory, will not fit this requirement;

—

it should also be stated in the contract that the refusal of the service offered will not involve adverse consequences linked to that refusal: such a statement could appear in the privacy statement of the contract.

66.

The EDPS further recommends that:

—

it is clarified in the Proposal that constant tracking is prohibited for added value services;

—

the categories of data processed under the 112 eCall — and private eCall and added value services is specified in a substantive provision of the Proposal and that the concept of ‘FSD’ is defined in the Proposal;

—

only the data necessary to private eCall and added value services are processed in compliance with the data minimisation principle;

—

a specific provision recalls that the processing of sensitive data under private eCall and added value services is prohibited;

—

the retention period of data processed under 112 eCall, private eCall and added value services is determined and specified in a substantive provision of the Proposal;

—

security of the data processed under 112 eCall, private eCall and added value services is guaranteed by some specifications in the text.

Done at Brussels, 29 October 2013.

Giovanni BUTTARELLI

Assistant European Data Protection Supervisor

(1)  COM(2013) 316 final.

(2)  COM(2009) 434 final.

(3)  Directive 2010/40/EU of the European Parliament and of the Council of 7 July 2010 on the framework for the deployment of Intelligent Transport Systems in the field of road transport and for interfaces with other modes of transport (OJ L 207, 6.8.2010, p. 1).

(4)  Commission Recommendation 2011/750/EU of 8 September 2011 on support for an EU-wide eCall service in electronic communication networks for the transmission of in-vehicle emergency calls based on 112 (eCalls) (OJ L 303, 22.11.2011, p. 46).

(5)  Commission Delegated Regulation (EU) No 305/2013 of 26 November 2012 supplementing Directive 2010/40/EU of the European Parliament and of the Council with regard to the harmonised provision for an interoperable EU-wide eCall Text with EEA relevance (OJ L 91, 3.4.2013, p. 1).

(6)  See in particular Opinion of 22 July 2009 on the ITS Directive, formal comments of 12 December 2011 on the Commission Recommendation on the implementation of the harmonised EU-wide eCall, and the letter of 19 December 2012 on the Commission Delegated Regulation with regard to the harmonised provision for an interoperable EU-wide eCall, all published on the EDPS website (http://www.edps.europa.eu) (under ‘Consultation’).

(7)  See Article 4 and Article 5(1) of the Proposal.