6.6.2009   

EN

Official Journal of the European Union

C 128/42

1.

On 13 November 2008, the Commission adopted a proposal for a Council directive imposing an obligation on Member States to maintain minimum stocks of crude oil and/or petroleum products (hereinafter the proposal) (3).

2.

The proposal aims at ensuring a high level of security of oil supply in the Community through reliable and transparent mechanisms based on solidarity amongst Member States, maintaining minimum stocks of oil or petroleum products and putting in place the necessary procedural means to deal with a serious shortage.

3.

On 14 November 2008, the proposal was sent by the Commission to the EDPS for consultation, in accordance with Article 28(2) of Regulation (EC) No 45/2001. The EDPS welcomes the fact that he is consulted on this issue and notes that reference to this consultation is made in the preamble of the proposal, in accordance with Article 28 of Regulation (EC) No 45/2001.

4.

Prior to the adoption of the proposal, the Commission informally consulted the EDPS on a specific article of the draft proposal (the current Article 19). The EDPS welcomed the informal consultation as it gave him an opportunity to make some suggestions prior to the adoption of the proposal by the Commission.

5.

The current issue serves as a good illustration of the fact that there should be a constant awareness of the rules on data protection. In a situation which concerns Member States and their obligation to hold emergency oil stocks, which are owned mainly by legal entities, the processing of personal data is not very obvious, but, even though it is not envisaged as such, it can still take place. One should in any case consider the likelihood of personal data processing taking place and act accordingly.

6.

In the current situation, there are basically two activities set out in the directive which could include the processing of personal data. The first is the collection by the Member States of information about the oil stocks and the subsequent transfer of this information to the Commission. The second activity relates to the power of the Commission to perform controls in the Member States. The collection of information about the owners of oil stocks could include personal data, such as the names and contact details of directors of the companies. This collection as well as the subsequent transfer to the Commission would then constitute the processing of personal data and would determine the applicability of either the national legislation implementing the provisions of Directive 95/46/EC or Regulation (EC) No 45/2001 depending on who is actually processing the data. Also granting the Commission a power to perform checks on emergency stocks in the Member States, which includes the power to gather information in general, could include the collection and therefore processing of personal data.

7.

During the informal consultation, which was restricted to the provision on the power of investigation of the Commission only, the EDPS advised the Commission to determine whether the processing of personal data in the context of a Commission investigation would only be incidental or would occur on a regular basis and serve the purpose of investigation. Following the outcome of this assessment two approaches were suggested.

8.

If the processing of personal data was not envisaged and would therefore be purely incidental, the EDPS recommended to, first, explicitly exclude the processing of personal data as serving the purposes of the Commission investigation and, second, to state that any personal data which the Commission would come across in the course of the investigation would not be collected or taken into account and in case of accidental collection would immediately be destroyed. As a general backup clause the EDPS furthermore suggested to include a provision which stated that the directive would be without prejudice to the rules on data protection as laid down in Directive 95/46/EC and Regulation (EC) No 45/2001.

9.

If, on the other hand, it was foreseen that data processing would take place on a regular basis in the context of a Commission investigation, the EDPS recommended the Commission to include a text which reflected the result of a proper data protection assessment. This should include the following elements: (i) the actual purpose of the data processing, (ii) the necessity of the processing of the data for achieving this purpose, and (iii) the proportionality of the data processing.

10.

Although the EDPS’ informal advice concerned the Commission's power of investigation only, his comments just as well applied to the other main activity explained in the proposed directive, namely collection and transfer to the Commission of information by the Member States.

11.

The final proposal for a directive clearly shows that the Commission concluded that for the purposes of the directive no processing of personal data is envisaged. The EDPS is glad to see that his first suggested approach is fully reflected in the proposal.

12.

The EDPS therefore expresses his support to the way in which the Commission assured compliance with data protection rules in the proposed directive. In the remainder of this advice only some detailed recommendations will be provided.

13.

Article 15 of the proposed directive deals with the obligation on Member States to send to the Commission weekly statistical summaries of the levels of commercial stocks held within their national territory. Such information will normally contain little personal data. It could however contain information about the natural persons who own the oil stocks, or who work for a legal entity that owns the stock. In order to prevent the Member States from providing the Commission with such information paragraph 1 of Article 15 states that if Member States do so, they ‘shall abstain from mentioning the names of the owners of the stocks concerned’. Although one should be aware of the fact that removing a name will not always result in data which cannot be retraced to a natural person, it looks as though in the current situation (statistical summaries of oil stock levels) this additional phrase will be sufficient to assure that no transfer of personal data to the Commission takes place.

14.

The Commission's power of investigation is laid down in Article 19 of the proposed directive. The article clearly shows that the Commission has followed the first approach as explained in point 8 above. It states that processing of personal data may not be part of the checks carried out by the Commission. And even if the Commission comes across such data it may not be taken into account and must be destroyed in case of accidental collection. In order to align the wording with the wording used in the data protection legislation and prevent any misunderstanding, the EDPS recommends replacing the word ‘gathering’ in the first sentence by the word ‘processing’.

15.

The EDPS is satisfied to see that also a general backup clause on the relevant data protection legislation is included in the proposal. Article 20 clearly reminds the Member States as well as the Commission and other Community bodies of their obligations under Directive 95/46/EC and Regulation (EC) No 45/2001 respectively. The clause furthermore underlines the rights data subjects have under these rules, such as the right to object to the processing of their data, the right of access to their data and the right to have their data rectified in case of inaccuracy. One comment could perhaps be made on the positioning of this provision in the proposal. Because of its general nature, it is not restricted to the investigative power of the Commission only. The EDPS therefore recommends moving the article to the first part of the directive, for instance after Article 2.

16.

Also in recital 25 reference is made to Directive 95/46/EC and Regulation (EC) No 45/2001. The objective of the recital is however rather unclear since it only mentions the data protection legislation as such and does not state anything further. The recital should clearly state that the provisions of the directive are without prejudice to the legislation mentioned. Furthermore, the last sentence of the recital seems to imply that the data protection legislation explicitly demands controllers to destroy data accidentally gathered immediately. Although it can be a consequence of the rules set out, such an obligation cannot be found in that legislation. It is a general principle of data protection that personal data are no longer kept than necessary for the purposes for which they were collected or are further processed. If the first part of the recital is adjusted in the way just proposed, the last sentence has become superfluous. The EDPS therefore proposes to delete the last sentence of recital 25.

17.

The EDPS wishes to express his support to the way in which the Commission assured compliance with data protection rules in the proposed directive.

18.

At a detailed level the EDPS recommends the following: