EU Directive 95

The European privacy Directive - completed

Published in Privacy Law & Policy Reporter (1995) 2 PLPR 81

Graham Greenleaf reports on the most significant privacy law in a decade

Introduction

The European Union Council personal data protection Directive has completed its five year passage through the EU legislative process, having been formally adopted by the Council of Ministers on 25 July 1995 (see the European Commission's Press Releasein this issue). The Directive on the protection of individuals with regard to the processing of personal data and on the free movement of such data is the most important international development in data protection in the last decade. It is important for two principal reasons.

First, it establishes a Europe-wide set of legal principles for privacy protection, to be enacted in all EU member states. EU member states are now allowed three years to amend their laws to conform with the Directive (A 32(1)). Its content therefore represents the most modern international consensus on the desirable content of data protection rights, and may be a valuable model for Asia-Pacific countries. The first part of this article gives an overview of this 'privacy content' of the Directive, pointing out how it differs from the 1992 and 1990 versions.

Second, it prohibits the transfer of personal data from EU countries to any countries which do not have 'adequate' data protection laws, and will therefore place significant international pressure for increased data protection on countries in the Asia-Pacific region and elsewhere, particularly in relation to the private sector. It has already resulted in the new Hong Kong law imposing similar restrictions on `data exports' (see Private Parts in this issue). The second part of this article will explain how this 'data export' or 'transborder data flow' aspect of the Directive will work.

Earlier this year the European Commission said that the Directive 'gives a signal to the EU's trading partners, such as Canada, Japan and the United States, of the importance the EU gives to the protection of the individual's rights in the application of new technological developments'.

The Directive was the subject of substantial lobbying by business interests, particularly the International Chamber of Commerce (ICC), which argued that international privacy laws should be harmonised on the model of the OECD Guidelines and the Council of Europe Convention, rather than the model proposed by the EU[1]. This was not to be.

History of the Directive

The European Commission's original draft Directive was issued in September 1990[2], and was originally proposed to take effect on 1 January 1993. The European Parliament approved the draft Directive in 1992, subject to the adoption of extensive recommended amendments[3]. In October 1992 the Commission released its Amended Proposal for a Council Directive[4], which was said by the Commission[5] to take into account the comments of the Parliament, the Council of Minister's own Working Group, the views of the European national Data Protection Commissioners and industry submissions.

A Working Party of the Council of Ministers then negotiated for three years to reach a 'common position' on the Amended Proposal[6]. On February 20 1995, the EU's Council of Ministers adopted a 'common position' on the Directive, making significant amendments in the process[7]. The United Kingdom abstained. This `common position' draft Directive went to the European Parliament for a `second reading', which resulted in its approval with monor proposed amendments on 15 June 1995. The Council of Ministers then adopted the Directive on 25 July.

References are to the completed Directive unless otherwise noted. The original draft will be referred to as the '1990 draft', and the Commission's subsequent amendments will be referred to as 'the 1992 draft'.

Structure and scope of the Directive

It must be remembered that the Directive is a directive to Member States of the EU to amend their respective laws (where necessary) to comply with the requirements of the Directive. The requirements listed below are phrased in that way in the Directive.

General structure

The two overall objects of the Directive are the protection of information privacy by Member States of the EU (A1(1)), and the prevention of restrictions on free flow of personal information between EU Member States for reasons of privacy protection (A1(2)). The Directive therefore aims to create 'a European zone of free information flow'[8] in relation to personal information, by requiring a uniform minimum standard of privacy protection across the EU.

The heart of the Directive is a set of information privacy principles set out in Chapter II ('General rules on the lawfulness of the processing of personal data'). The methods by which these are to be enforced in national law and by the EU are set out in Chapters III ('Judicial remedies, liabilities and penalties'), V ('Codes of conduct'), VI ('Supervisory authority and Working Party ...') and VII ('Community implementing measures'). Chapter V deals with prohibitions on transfers of personal data to third countries. Chapter I provides definitions and covers the scope of the Directive. A sixteen page preamble to the Directive provides comments on the objectives behind many of the provisions, and aids therefore interpretation.

The requirements of the Directive are, for the most part, in very general terms. Article 5 provides that `Member States shall, within the limits of [Chapter II] determine more precisely the circumstances in which the processing of personal data is lawful'. However, specific national implementations pursuant to A5 cannot impose restrictions or prohibitions in relation to exchange of personal information between countries within the EU because of A1(2).

It is clear from its preamble that the Directive should not be seen as a 'minimum' standard for privacy laws within the EU. It is a standard to be complied with as both the minimum and maximum information privacy protection allowable under EU laws, subject to what the preamble refers to as 'a margin for manoeuvre' left to Member States. The preamble refers to the need to 'approximate' the laws of Member States, to make the protection offered by them 'equivalent', and to reduce 'divergences' between national laws. All this is said to be in order to prevent restrictions on transfer of data between Member States. Many of the Directive's Articles include exceptions to the general privacy protections that constitute the 'general rule' of the Article. These exceptions are just as mandatory as the general rules that they qualify, and national laws which attempted to provide a stricter standard of privacy protection by not recognising or limiting such exceptions would breach the Directive. However, there is room for argument within the language of some Articles which do not make it clear than what is not forbidden is allowed (eg A7 says 'data many be processed only if...', not 'if and only if ...'). The Directive is therefore best seen as a consensus of EU states on the 'desirable' level of privacy protection, not a minimum level. The preamble makes clear, however, that the Directive is considered to exceed the standard of protection required by the Council of Europe data protection Convention[9].

Scope of the Directive

The level of protection is essentially the same in both the public and private sectors, with no formal distinction made between the rules applying in the two sectors[10].

The Directive applies `to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which forms part of a filing system or is intended to form part of a filing system' (A 3.1), a `filing system' being any structured set of personal data (A2(c)[11]). The Working Group's most important decision was that structured manual data will remain in the Directive, despite opposition from the UK, Denmark and Ireland.

Processing in the course of activities falling outside Community law is exempted (A3.2), including 'processing operations concerning public security, defence, State security (including the economic well-being of the State) and the activities of the State in areas of criminal law'. Processing by a natural person in the course `of a purely personal or household activity' is exempted (A3.2)[12]. Member States are also required to provide exemptions for 'processing carried out solely for journalistic purposes', and where necessary to reconcile freedom of 'artistic or literary expression' with privacy (A9).

The Directive's 'information privacy principles'

The 'general rules' set out in Chapter II are framed in terms of 'processing' personal data, but are in general terms similar to the information privacy principles found in the OECD Guidelines and the Council of Europe Convention. A rough comparison of the Articles in Chapter II with the titles of the OECD's 8 principles is as follows: Collection limitation principles (A10, A11, parts of A7); Data quality principles (A6); Purpose specification principle (A6); Use limitation principle (A16); Security safeguards principle (A17); Openness principle (A21); Individual participation principle (A12, A14); and Accountability principle (definition of 'controller'). Other articles cover matters not always found in previous sets of principles, such as purpose justification (A7), 'sensitive' data (A8), automated decision-making (A15), and notification (A18, A19, A20).

The content of these principles is summarised or paraphrased below, emphasising those elements which are unusual.

Data quality requirements

The principle of data quality (A6) requires that personal data must be (a) processed fairly and lawfully; (b) collected for specified, explicit and legitimate purposes and used in a way compatible with those purposes; (c) adequate, relevant and not excessive in relation to those purposes; (d) accurate and, where necessary, kept up to date; and (e) not kept in identified form for longer than is necessary for those purposes.

Legitimate processing

`Processing of personal data' (including collecting, recording, using and communicating it: A2(b)) is only lawful if it comes within one of the following conditions (A7):

(a) It is with the unambiguous consent of the data subject. Consent is only valid if the data subject receives prior notification of the purposes of collection and any proposed recipients, and may be withdrawn prospectively (A2(g)).

(b) It is necessary for the performance of a contract with the data subject, or for steps requested by the data subject prior to a contract[13]; or

(d) It is necessary to protect the vital interests of the data subject;

(e) It is `necessary for the performance of a task in the public interest or carried out in the exercise of public authority vested in the controller or in a third party to whom the data are disclosed' or

(f) It is 'necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject ...'. Article 7 does not elaborate on how this balancing is to be achieved, but the preamble says that Member States remain free to determine the appropriate balance in relation to use of information for 'legitimate ordinary business activities' and conditions of disclosure for marketing purposes. The Commission commented on the 1992 draft that `[t]his balance-of-interest clause is likely to concern very different types of processing, such as direct-mail marketing and the use of data which are already a matter of public record'[14]. Many of the most contentious privacy decisions are therefore still left to the Member States to make.

These six very general conditions apply to both public and private sector processing of personal data. Their generality will obviously allow for a variety of specific implementations in national laws.

Use and disclosure - the `finality' principle

The principle of `finality' is that use and disclosure of personal information are limited to the original purposes of collection. The Directive retains[15] a general requirement that data must be used in a way compatible with the purpose of collection (A6(1)(b)), but lays out the above-listed six general grounds for processing (which includes use and disclosure) in A7, which act in part as justifications for exceptions to the principle of finality.

Other rights of data subjects

The other rights of the data subject may be summarised as follows (subject to exceptions not listed here[16]):

(i) Rights to be informed of the purposes of collection, obligatory nature thereof, intended recipients, and subject rights, at the time of collection (A10). Where information is obtained from someone else other than the data subject, there are similar rights to be informed (A11);

(ii) Rights to obtain a copy of data about himself or herself, including information about its use; rights to obtain corrections, or erasure or blocking (suppression) of data processed in violation of the Directive; and to have such corrections, erasures or blocking communicated to third parties to whom the data has been disclosed (A12);

(iii) Rights to object to processing on 'compelling legitimate grounds' (A14(1)), and an opportunity to object to data being used for direct marketing[17] (by various forms of 'opting out'[18]) (A14(2)) .

(iv) Rights not to be subject to decisions significantly affecting him which are based solely on automated processing intended to evaluate personal aspects relating to an individual[19], except where pursuant to a contract or legislative authority and there are suitable measures to safeguard the data subject's legitimate interests (A15). The subject's right of access must also include a right to know 'the logic involved' in any such automated decisions (A12(1)). It has been claimed that these provisions, which derive from French law, will cause considerable difficulties for US companies[20].

Security

Appropriate security safeguards must be adopted by controllers, and controllers must have significant responsibilities in relation to anyone who processes personal data for them (A17).

Notification

Automated processing operations carried out by private and public sector bodies must be notified in advance to the national supervising authority (A18 - A19). This need not be a licensing system, and exemption from or simplification of notification is allowed for processing which is unlikely to adversely affect people's rights and freedoms, or where the organisation concerned has appointed an independent data protection official (A18(2)). The notified data is to be used so that a register can be kept by the supervisory authority, and may be inspected by any person (A21).

National laws are to specify 'processing operations likely to present specific risks', so that 'prior checking' of such systems by the supervisory authority can occur (A20). The authority must be notified of such proposed operations by the controller or the data protection official (A20(2)).

Public registers are exempt from the notification requirements (A21(3)), implying that they are generally subject to the principles.

Special categories

The processing of personal data 'revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership' and health or sex life is generally prohibited (A8(1)), subject to numerous exceptions (A8(2)-(4)). Data concerning offences or 'security measures' can only be kept under official authority (A8(5). Derogations must be notified to the Commission.

Enforcement of the Directive at national level

Powers of the supervisory authorities

One or more public authorities must be responsible for monitoring the application of the Directive ('supervisory authority') (A28). The supervisory authorities must 'act with complete independence', and must have investigative powers, 'effective powers of intervention' in processing, and powers to take court action where national legislation implementing the Directive is infringed (A28(3)). They must be consulted concerning legislation affecting privacy (A28(2)). They must be able to hear complaints concerning breaches of information privacy (A24(4)), but nothing is specified concerning the remedies available from a supervisory authority.

Individual rights of enforcement

An individual must have rights to seek a judicial remedy for any breach of the national law (A22). There must also be a right to recover compensatory damages (A23), but it appears that this can be provided as either a judicial or administrative remedy. Dissuasive penalties for breach are also required (A24).

The Directive therefore requires both a data protection authority with appropriate powers to supervise the information privacy principles, and individual rights of enforcement independent of those authorities. The enforcement mechanisms it requires are therefore quite strong.

Codes of conduct

Codes of conduct are to be encouraged, and national laws are to make provision for trade associations and other bodies to submit them to the national supervising authorities for opinion as to whether they comply with the national laws (A27). EU-wide draft codes are to be submitted to the EU Working Party (see below) for opinion concerning compliance with the various national laws (A27(3)). Such codes cannot in themselves satisfy the requirements of the Directive: A27(1) states that they are to 'contribute to the proper implementation of the national provisions', and A27(2) states that they are to be measured against such provisions. However, it would seem possible that a legally enforceable code of conduct which implements fully the national legislative provisions could supplant those provisions, as can occur under the New Zealand Privacy Act 1993.

Reach of national laws

Member states are required to apply the national provisions they adopt to processing of personal data in two principal situations (A4): (i) where it is 'carried out in the context of the activities of an establishment of the controller on the territory of a Member State'; and (ii) the controller is not established on the territory of an EU Member State, but makes use of equipment situated in a Member State for purposes of processing (except mere transit). Berthold characterises this as a 'control test' supplemented by a 'processing test'[21].

Under the control test, a company which carries out activities in an EU Member State (even if it is not based there), but which processes personal data relating to those activities in a non-EU state, will find that its activities are subject to the privacy laws of the EU state.

Under the processing test, a company based in a non-EU state which merely uses processing facilities in an EU Member State will still find itself bound by the EU state's privacy law. Not surprisingly, Europe cannot be used as a 'data haven' to avoid the reach of privacy laws.

Time limits for national implementation

Member States are required to change their laws to comply with the Directive within three years of it coming its adoption (A 32(1)). A further three years may be allowed in national laws for 'processing already underway' to be brought into conformity (A32(2)). Some rights need not be applied to data held in manual filing systems for twelve years after the national law comes into force, a provision to appease the United Kingdom.

Supra-national supervision of the Directive

The 'EU-level' supervision of the Directive is distributed between three bodies: the Commission of the EU; a Committee of representatives of EU Member States (and in some circumstances, the EU Council itself); and an advisory Working Party of the national data protection authorities. In the 1995 Directive, significant power has shifted from the Commission to the Committee, with the role of the Working Party remaining unchanged. The role of these various bodies in making decisions concerning the adequacy of protection in third countries is discussed in more detail later.

The EU Commission's role

The Commission is to report to the Council and the Parliament at regular intervals on the implementation of the Directive, with any proposals for amendment. It is also required to examine the application of the Directive to sound and image processing (A33). The Commission is also required to advise the Working Party of what action it has taken concerning its opinions and recommendations (A30(5)), and to negotiate with non-EU countries concerning 'adequate protection' (A25(5)).

The Commission proposed it should have a rule-making power to adopt such `technical measures' as are necessary to apply the Directive, including drawing up sectoral applications of the Directive (1992 draft A33), but the 1995 Directive does not provide for any delegated legislation.

The Committee of Member States, and the EU Council

Chapter VII ('Community implementing measures') provides for a Committee comprised of representatives of each Member State and chaired by a non-voting Commission representative (A31(1)). The Committee acts by majority, but the votes of each representative are weighted according A148(2) of the Treaty establishing the European Community (A31(2)).

The EU Commission's main role in the Directive is to submit to this Committee a draft of the 'community implementing measures' it considers should be taken (A31(1)). If the Committee approves the proposed measures, the Commission must then adopt them. If the Committee disapproves, or fails to approve them within the time limit set by the Chairman, then the proposed measures are to be referred to the Council of Ministers of the EU (which is to vote by qualified majority) (A31(2)).

The types of 'implementing measures' which will be dealt with by this process include decisions on adequacy of third country laws (A25(4)), and proposed authorisations of data transfers (A26(3), (4)).

The Working Party of supervising authorities

There is to be a Working Party on the Protection Individuals with regard to the Processing of Personal Data composed of representatives of national data protection authorities (one for each EU state), a representative of EU institutions, and a representative of the Commission (A29). It will take decisions by simple majority.

The Working Party's functions include examining issues of uniformity in EU national laws, giving opinions on the level of protection in the EU and in third countries, advising the Commission on any proposed additional measures, and giving opinions on codes of conduct drawn up at community level (A29(1)). It can also, on its own initiative, make recommendations on all matters concerning processing of personal data in the EU (A29(3)). The Commission is required to produce an annual report on the responses it has made to the Working Party's opinions and recommendations (A29(5)), and the Working Party is to publish an annual report concerning the processing of personal data in Europe and in third countries (A29(6)).

The Parliament recommended the Working Party's expansion into, in effect, a supra-national data protection agency, comprising representatives of business and civil liberties groups as well as national authorities, and with a right to be heard on a wide range of issues and to take various independent initiatives, but this approach has not been adopted.

[This article will be continued in the next issue]