Cross-border threats to health

Opinion of the European Data Protection Supervisor

on the proposal for a decision of the European Parliament and of the Council on serious cross-border threats to health

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data,

HAS ADOPTED THE FOLLOWING OPINION:

I. Introduction

1. On 8 December 2011, the Commission adopted a Proposal for a Decision of the European Parliament and of the Council on serious cross-border threats to health ('the Proposal') and on the same day forwarded it to the EDPS for consultation. On 19 January 2012, the Council sent the Proposal for consultation as well.

2. Already before the adoption of the Proposal, the EDPS had the opportunity to provide informal comments on a draft text. The EDPS welcomes this consultation at an early stage and is pleased to see that some of his comments have been taken into account.

3. The Proposal aims at replacing Decision 2119/98/EC of the European Parliament and of the Council of 24 September 1998 setting up a network for the epidemiological surveillance and control of communicable diseases in the Community , which is the current legal basis (along with its implementing Commission Decision 2000/57/EC ) for the Early Warning and Response System ('EWRS'). The EWRS is operated by the European Centre for Disease Prevention and Control ('ECDC') on behalf of the Commission and is used by the competent authorities in the Member States to exchange information necessary for the epidemiological surveillance and control of communicable diseases at European level. The EWRS has been successfully used in a number of situations such as SARS, avian influenza in humans and other major communicable diseases. It constitutes an important tool to protect public health.

4. The Proposal aims at increasing cooperation between Member States as regards cross-border health threats. Among others, the Proposal extends the scope of the existing EWRS, which currently only covers communicable diseases, to other kinds of cross-border health threats, including hazards of biological, chemical, environmental or unknown origin which are likely to spread across national borders.

5. The EWRS itself has been the subject of a prior check Opinion of the EDPS issued on 26 April 2010. In the follow-up to that Opinion, the data protection safeguards for the EWRS have improved considerably. Among others, in the framework of the follow-up procedure, a Commission recommendation on data protection guidelines for the EWRS has also been adopted.

6. This Opinion should be read in the light of the progress already made and contains recommendations to further improve the level of data protection under the Proposal.

7. The EDPS welcomes the references to Regulation (EC) No 45/2001 and Directive 95/46/EC in recital 18 and Article 18 of the Proposal and that the reference to the applicable data protection legislation in Article 18 now encompasses all personal data processing under the scope of the Proposal. He also welcomes the specific data protection safeguards for contact tracing set forth, or required to be adopted by the Commission, under Article 18.

8. However, the following elements of the Proposal still require, or would benefit from, clarification, further detail or other improvements from the point of view of data protection:  contact tracing,  ad hoc surveillance,  controller-processor relationship,  retention period, and  security measures.

9. As a preliminary remark, the EDPS notes that several aspects of the Proposal are not elaborated in the text itself, but will be the subject of delegated and implementing acts, such as the list of communicable diseases to which the Proposal shall apply and the procedures for the information exchange in the EWRS. Other aspects will be clarified in guidelines and recommendations to be adopted by the Commission, such as the data protection guidelines for the EWRS.

10. Delegated acts are meant to amend and specify certain non-essential aspects of legal acts (Article 290 TFEU), while implementing acts aim to establish uniform conditions for the implementation of legally binding Union acts (Article 291 TFEU). While details can of course be regulated in delegated and implementing acts, and such additional provisions are certainly of great benefit, the EDPS recommends that the Proposal itself also provide more guidance on some of the points mentioned in point 8, as will be discussed below. II. The system of contact tracing

12. Contact tracing is defined in Article 3(c) of the Proposal. The definition refers to 'measures implemented at national level in order to trace persons who have been exposed to a source of serious cross-border threat to health, and who are potentially in danger of developing or have developed a disease'. The Proposal, thus, opens up the possibility of exchanging contact tracing information beyond communicable diseases, to a wide range of other types of health threats.

13. The EDPS welcomes the fact that this provision clarifies that contact tracing means measures implemented at national level and that no additional tracing mechanism on the European level is foreseen. Similarly, he welcomes the fact that pursuant to Article 18(3), contact tracing shall only be carried out using the selective messaging function of the EWRS, which, at the practical level, more strictly limits information sharing to recipients on a need-to-know basis and also limits retention periods.

14. The EDPS also welcomes the obligation in Article 18(5) for competent national authorities to inform their counterparts if they come to the conclusion that a 'notification' of personal data for the purpose of contact tracing was unlawful. This obligation also flows from the data quality principle enshrined in Article 6 of Directive 95/46/EC and the controller's task to ensure compliance with it.

15. However, the EDPS notes that the concept of contact tracing and its purposes are not more clearly defined in Article 3(c) and are nowhere else explained in further detail. It is not clear from the text of the Proposal what is the objective of contract tracing, how contacts will be determined, which sources might be used to obtain contact details of contacts, how individuals will be informed of the processing of their personal data, how long data will be retained, etc. While these issues can be addressed at national level, subject to national data protection safeguards, at least some basic clarifications should be made in the Proposal to ensure legal certainty, consistency across Europe and guarantee the necessity and proportionality of the exchange of contact tracing data via the EWRS.

16. In this regard, and in addition to a clearer definition of what is contact tracing, and what purposes it may serve, the EDPS considers it particularly important that the Proposal should also provide more guidance on criteria to be used when assessing whether contact tracing measures (or their exchange via the EWRS) are necessary and proportionate. While the ultimate decisions could be left to Member States, for the reasons noted above, general principles should be included in the Proposal.

17. For communicable diseases, these criteria could be modelled on the criteria used in practice in ECDC recommendations on contact tracing in specific cases, and could include at least such general criteria as the nature of the disease, its severity, its infectivity and the context in which exposure has occurred. The criteria used for other health threats should also be identified and set forth in the Proposal.

18. With respect to other health threats, it is also not sufficiently clear what is the purpose of contact tracing, and how the scope of the contact tracing and the contact tracing procedure will differ in cases where the individual will have no infectious disease, and therefore, there is no public health interest in limiting the spread of the disease via tracing contacts.

19. Article 18(6) requires the Commission to adopt a set of data protection guidelines for the EWRS and a recommendation providing an 'indicative' list of personal data that 'may or should' be exchanged for the purpose of contact tracing measures. While the EDPS welcomes the fact that the data categories shall be defined further by the Commission, the EDPS also stresses that at least the main categories of data to be processed (e.g. name and contact details of the individual concerned and who may have been in contact with him/her, travel routes, name of the disease) should already be outlined in the main Proposal. The main categories may be different for communicable diseases and for other health threats where contact with an exposed person does not lead to contamination/infection.

20. Finally, the EDPS welcomes the fact that Article 9(3) specifically mentions that in case of Article 9 alerts, personal data can only be exchanged for contact tracing purposes and subject to the safeguards of Article 18. However, this provision could be further clarified by deleting paragraph 9(3)(i) and instead, inserting a new paragraph 9(4) explicitly requiring that personal data processing under Article 9 of the Proposal should be restricted to what is necessary for contact tracing and should be processed subject to the safeguards set forth in Article 18. This could also help overcome the inconsistency in the current formulation of Article 9(3), which mentions 'useful' information in the introductory sentence and 'necessary' personal data for contact tracing in item (i) of the list in this Article. III. The system of ad hoc surveillance

21. Article 7 of the Proposal foresees the establishment of ad hoc monitoring networks in case of emergence of certain cross-border health threats (other than communicable diseases). These networks are to be established in response to a specific threat and will be shut down when it has passed, complementing the permanent surveillance of certain communicable diseases.

22. However, several aspects of these networks remain unclear: o Which kinds of data are to be processed in these networks? o What will be the relationship between the ad hoc networks and the EWRS? o What will be the role (if any) of the ECDC? o Who will be responsible for compliance with data protection rules?

23. It is not completely clear which types of data are to be exchanged in this network; paragraph 2 of Article 7 provides only some indication, stating that 'in particular any change in geographic distribution, spread and severity of the health threat concerned and of the means of detection' shall be included. Prima facie, these networks seem to be meant to process aggregate and/or to a large extent anonymised information, similar to the permanent monitoring of certain communicable diseases.

24. This aspect should be clarified. In any case, measures should be taken to minimise the processing of personal data, for example by applying appropriate anonymisation techniques and restricting the processing to aggregate data that cannot be traced back to individuals as far as possible. Indeed, it would be helpful if this requirement would be set forth in the Proposal with general applicability for all cases when personal data are processed, except for contact tracing.

25. It is not clear from the Proposal what the relationship between EWRS and these ad hoc networks will be. While they are to be established following an alert in the EWRS, they seem to be formally independent of it. This should be explained further.

26. Related to this, it is also not clear which role the ECDC would play in these networks. The wording of Article 7 gives no hint of ECDC involvement, mentioning that the networks shall be set up by the Commission; however, it is not clear whether this excludes any role for the ECDC. A comparison with the provisions on the EWRS is useful here: these do not mention any role for the ECDC either, but as mentioned in recital 5, the EWRS is managed by the ECDC. This should be clarified.

27. These previous two points are also important for the question of who is responsible for the compliance of these networks with the data protection framework, in other words, which bodies are controller(s) or processor(s) (see Section IV). IV. Controllership and responsibilities

28. An important issue is the distribution of responsibilities between the Commission, the ECDC and the competent authorities in the Member States for compliance with the data protection rules. This includes clear determination of which bodies are controller(s) or processor(s) and what are their tasks and responsibilities. This issue has already been discussed between the EDPS and the Commission in the follow-up of the prior check opinion on EWRS, and important clarifications have been achieved, which have also been reflected in the data protection guidelines for the EWRS.

29. However, to provide legal certainty, this should be clarified in the Proposal itself either by specifically mentioning which entity is considered as a data controller and which entity is considered as a processor, or by otherwise unambiguously indicating responsibilities, for example, by outlining the tasks and responsibilities of all actors involved. V. Retention periods

30. As it stands, the Proposal also does not include any indication of retention periods for personal data processed under its scope. As a general principle, personal data should not be kept longer than is necessary to fulfil the purpose for which it was collected, as established by Article 6(1)(e) of Directive 95/46/EC and Article 4(1)(e) of Regulation (EC) No 45/2001. This is a particularly important concern for contact tracing data, due to their sensitivity.

31. The EDPS notes that the already adopted recommendations on data protection guidelines for the EWRS establish a maximum retention period of 12 months for retaining contact tracing data and also encourage users to delete personal data before the end of this period if their retention is no longer necessary. Depending on the health issue at hand, necessary retention periods might well be significantly shorter than 12 months, for example for communicable diseases with short incubation periods.

32. The EDPS welcomes the recommendations. However, since these are only non-binding recommendations, the EDPS recommends that the Proposal itself should establish this 12 months period as a binding maximum retention period for contact tracing data. Should a longer period be necessary for contact tracing data for other health threats, this should be carefully considered, adequately justified, and specifically set forth in the Proposal. VI Data security

33. Finally, regarding data security, the EDPS encourages the legislators to include in Article 18 of the Proposal a more specific reference to the requirements on data security and confidentiality included in Articles 16 and 17 of Regulation (EC) No 45/2001 and Articles 21 and 22 of Directive 95/46/EC. This could be complemented with a requirement for a systemspecific security plan for the operation of the EWRS, including adequate control mechanisms that allow comprehensive monitoring of its effectiveness, with a security officer appointed to carry out this task. VII. Conclusion

34. In general, the EDPS recommends that some essential elements, including certain essential data protection safeguards, should be also included in the text of the Proposal itself. In addition, some clarifications are also necessary due to the expansion of the scope of the Proposal to additional health threats beyond communicable diseases, which have not been subject to the prior checking procedure and also not discussed in the guidelines.

35. More particularly, the EDPS recommends that the Proposal should:  Provide a clearer definition for contact tracing, including also its purposes and scope, which might be different for communicable diseases and other heath threats.  Define more clearly how the individuals used for contact tracing will be determined, which sources might be used to obtain contact details and how these individuals will be informed of the processing of their personal data.  Include criteria to be used when assessing whether contact tracing measures are necessary and proportionate.  Specify at least the main categories of data to be processed for contact tracing.  For the system of ad hoc surveillance, specify the kinds of data to be processed and take measures to minimise the processing of personal data, for example by using appropriate anonymization techniques and restricting the processing to aggregate data as far as possible.  Clarify the relationship between ad hoc surveillance networks and the EWRS.  Clarify the role of the ECDC in ad hoc surveillance networks.  Clarify the tasks and responsibilities of all actors involved from the data protection point of view in order to obtain legal certainty on the issue of controllership.  Establish legally binding retention periods at least for contact tracing.  Include in Article 18 a more specific reference to the requirements on data security and confidentiality. Brussels, 28 March 2012 (signed) GIOVANNI BUTTARELLI Assistant European Data Protection Supervisor