Deposit of the historical archives of the institutions at the European University Institute in Florence

Opinion of the European Data Protection Supervisor

on the Commission Proposal for a Council Regulation amending Regulation (EEC/Euratom) No 354/83, as regards the deposit of the historical archives of the institutions at the European University Institute in Florence

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data ,

HAS ADOPTED THE FOLLOWING OPINION:

1. INTRODUCTION 1.1. Consultation of the EDPS

1. On 16 August 2012, the Commission adopted a Proposal for a Council Regulation amending Regulation (EEC/Euratom) No 354/83, as regards the deposit of the historical archives of the institutions at the European University Institute in Florence (the 'Proposal') . The Proposal was sent to the EDPS for consultation on the same day.

2. Before the adoption of the Proposal, the EDPS was given the possibility to provide informal comments. Many of these comments have been taken into account in the Proposal. As a result, the data protections safeguards in the Proposal have been strengthened. The EDPS welcomes the fact that the Commission also consulted him formally after the Proposal was adopted and that this Opinion is referred to in the preamble of the Proposal. 1.2. Objectives and background of the Proposal

3. Council Regulation (EEC, EURATOM) No 354/83 of 1 February 1983 concerning the opening to the public of the historical archives of the European Economic Community 4 and the European Atomic Energy Community (the 'Archives Regulation') requires EU institutions and bodies to establish historical archives and to open them to the public once they are 30 years old. The Archives Regulation allows each institution and body to hold its historical archives in whatever place it considers most appropriate.

4. The objective of the Proposal is to amend the Archives Regulation and to make the deposit of paper archives at the European University Institute in Florence ('EUI') mandatory for all EU institutions and bodies (with the exception of the Court of Justice and the European Central Bank). In fact, the European Commission, the Council of the European Union and the European Parliament are already depositing their paper archives at the EUI on the basis of contractual arrangements. Thus, as the Explanatory Memorandum explains, the Proposal does not change the status quo but rather, 'aims to confirm the role of the EUI in managing the historical archives of the institutions. It will create a sound legal and financial basis for the partnership between the EU and the EUI.'

5. The Proposal will also not change the existing rules and procedures by which the EU institutions and bodies open their historical archives to the public after 30 years. The Proposal will furthermore not change the ownership of the historical archives, which will remain with the depositing institutions/bodies. In short: the Proposal contains limited and targeted amendments to the Archives Regulation, rather than proposing a comprehensive modernization and overhaul. 1.3. Relevance to data protection; objectives of the EDPS Opinion

6. In order to carry out their tasks, the European institutions and bodies process vast amounts of data, including personal data. Some of the personal data processed may be particularly sensitive from a data protection point of view and/or may have been given to the institutions or bodies concerned in confidence, without the expectation that they will one day become publicly available: for example, personal data contained in medical or personnel files of staff members, or personal data processed in connection with disciplinary and harassment procedures, internal audits, various types of complaints or petitions, and trade, competition, anti-fraud, or other investigations.

7. Some of these personal data, including some of those posing prima facie the greatest risks to the individuals concerned are destroyed after a specified period of time, once they are no longer in use for the initial purposes for which they were collected (or for other compatible 'administrative' purposes).

8. However, a significant portion of the documents held by the European institutions and bodies, including, possibly, the personal data in them, will not be destroyed but rather will ultimately be transferred to the historical archives of the European Union, and will be made publicly available for historical, statistical and scientific purposes.

9. It is important that European institutions and bodies have clear policies of what personal data should or should not go to the historical archives, and how to safeguard those personal data that will be preserved and made publicly available via the historical archives. These policies need to ensure protection of privacy and the personal data of the individuals concerned, and to balance the protection of these fundamental rights with the right of access to documents and the legitimate interests in historical research.

10. For the moment, although document management, data retention and archiving policies exist at many European institutions and bodies (see, for example, the Common Conservation List ('CCL'), an internal administrative document issued by the 7 Commission ), these policies provide only limited guidance on data protection. The CCL and similar documents should be further developed or complemented with more specific and more nuanced guidance on data protection.

11. In addition, it is to be noted that the existing policies are formulated in internal documents, rather than in a legislative instrument adopted by Council and Parliament. Indeed, beyond a brief reference in its Article 2(1) to 'documents covered by the exception relating to privacy and integrity of the individual, as defined in Article 4(1)(b) of Regulation (EC) No 1049/2001 ,' the current text of the Archives Regulation does not specify what personal data may be transferred to the historical archives, and thus, ultimately disclosed publicly.

12. The referred Article 4(1)(b) of Regulation 1049/2001, in turn, must be interpreted in accordance with applicable data protection laws, including Regulation (EC) No 45/2001, and in accordance with the jurisprudence of the Court of Justice of the European Union. To decide what personal data should be placed in the historical archives, thus, requires a complex case-by-case analysis.

13. The revision of Directive 95/46/EC and Regulation (EC) No 1049/2001 are currently both underway, and the revision of Regulation (EC) No 45/2001 should also follow in due course. While it is hoped that these legislative changes will contribute to clarity, due to their general nature, it is unlikely that they will provide sufficiently specific guidance to European institutions and bodies with regard to their archiving practices. As for the Archives Regulation itself, the Commission has proposed limited amendments only, not affecting Article 2(1) and other substantive provisions.

14. The EDPS, in this Opinion, will suggest a few targeted changes that can be included on the occasion of the current, more limited review of the Archives Regulation. Additionally, he will highlight the need for adoption of specific measures, including adequate implementing rules, to ensure that data protection concerns are effectively addressed in the context of legitimate record keeping for historical purposes.

15. To provide context, Section 2 will briefly discuss some general data protection issues and current trends related to the opening up and digitalization of EU historical archives, anonymization and de-anonymization, as well as the Commission's open data initiatives.

2. PRELIMINARY REMARKS 2.1. Personal data held in the historical archives

16. Personal data contained in the historical archives of an EU institution or body typically include information that is closely related to the official tasks/business of individuals, such as the names and statements of individuals present at meetings, as recorded in minutes of these meetings, or the names of persons authoring official documents, such as decisions signed by directors, commissioners and other office-holders, or internal briefings and memoranda prepared by staff. Other typical examples include the names, contact information and offices held by staff members listed in organisation charts and staff directories. Names, statements, activities, and other personal data of complainants, defendants, witnesses and others recorded in connection with official 11 procedures may also be included in the historical archives.

17. According to the CCL, certain file types held by the Commission, including the personnel and medical files of staff members or files on anti-fraud investigations, are ultimately destroyed, and thus, not transferred to the historical archives, and not made publicly available. This approach clearly limits the risks for the unjustified disclosure of personal data. However, the EDPS notes that this approach is laid down in the CCL for the Commission, but not necessarily applied by all EU institutions and bodies. Moreover, technological innovations and policies relating to those innovations have made the need for a thorough assessment of the risks more imminent. Some examples will be given in Sections 2.2 - 2.4. 2.2. Paper files vs digital (and searchable, machine-readable) files

18. Data protection risks related to the EU historical archives have been less imminent in the past, considering that typically paper files unless in a structured file are not easily searchable and that their use is also limited by the fact that they are available for consultation only in the premises of the EUI and the depositing institutions.

19. However, the Archives Regulation does not exclude that the EUI may, upon request, digitalize some of the collection and make it available to the requesting party in a digital (and possibly, in a searchable and machine-readable) format. The Archives Regulation also does not exclude that the existing paper collection be proactively digitalized and published on the Internet. In the future, as all EU institutions and bodies will progressively move away from paper-based information management systems, it is also foreseen that data will be increasingly available in digital, and conveniently searchable, form.

20. The digital, searchable, machine-readable documents contained in the archives can then be more easily searched, copied, combined with other information, and further distributed. With increased availability of personal data and the rise of innovative new computing techniques, ultimately, there is an increased opportunity for innovative new uses of data to facilitate transparency, accountability and historical research, but there is also an increasing risk that personal data contained in the historical archives may be misused. 2.3. Anonymization and the risks of de-anonymization

21. In many cases, knowing the exact identity of an individual whose name is mentioned in a particular document may be important for historical purposes. Data protection rules may, in many circumstances, allow conservation of such personal data in the historical archives. A typical example would be the name of a high-ranking official signing a previously highly classified, and with the lapse of 30-years, subsequently declassified, document.

22. However, in other cases, instead of disclosing documents containing directly identifiable personal data, other alternatives, such as disclosing aggregate, pseudoanonymized, or anonymized information may be feasible, and may provide a balanced solution addressing at the same time the concerns of data protection as well as the needs of transparency, accountability, and historical research.

23. In this context it must be emphasized that full anonymization is not always feasible, and is becoming increasingly difficult to achieve with the advance of modern computer technology and the ubiquitous availability of information. Re-identification of individuals (also referred to as 'de-anonymization' of anonymized data sets) is 12 becoming an increasingly common and present threat. In practice, there is a very significant grey area, where a data controller releasing the data might believe a data set is anonymized but a motivated interested party will still be able to identify at least some of the individuals from the data.

24. Despite their weaknesses and the risk of de-anonymization, anonymization techniques are nevertheless useful in many situations, when disclosure of raw personal data in their original form is not allowed under data protection laws and not necessary for historical research purposes. 2.4. Open data/public sector information reuse

25. On 12 December 2011, the Commission adopted a Proposal for a Directive amending Directive 2003/98/EC on re-use of public sector information (PSI) (the 'PSI Proposal'). The Proposal is part of the Commission's 'Open-Data Package'.

26. As explained in the EDPS Opinion issued on the Open Data Package on 18 April 2012 , one of the key novel policy objectives of the PSI Proposal is the objective to introduce the 'principle that all public information that is not explicitly covered by one of the exceptions is reusable for both commercial and non-commercial purposes'.

27. Once personal data are publicly available via the historical archives for reuse, and especially if the data are available in digital, searchable and machine readable format and via publication on the internet, it will be increasingly difficult, if not impossible, to ensure that the data will only be used for historical research purposes, or other purposes compatible with the purposes for which the data were initially collected. Hence it is all the more important that it would be carefully selected what information will or will not be transferred to the historical archives, and thus, be made publicly available and also available for reuse.

3. DATA PROTECTION PROVISIONS SHOULD BE FURTHER STRENGTHENED

28. The EDPS welcomes that the Proposal addresses data protection concerns. In particular, the EDPS welcomes: (i) the provisions on applicable law (see Article 8(9) of the Archives Regulation as proposed ), (ii) the determination of the supervisory authority (Article 8(10)), (iii) the specification of the EUI's role as a processor (Article 8(9)), and (iv) the requirement to adopt implementing rules to address data protection issues at the practical level (Article 9(1)).

29. Once these key provisions are in place , data protection issues can be addressed in the implementing rules, instructions can be given to the EUI by the EU institutions and bodies, and further measures can be taken at the practical level.

30. Nevertheless, to ensure legal certainty, the EDPS recommends that the Proposal itself be already more specific on some key data protection issues. In particular, the EDPS recommends that the Proposal: (i) specify the key objectives and minimum content of the implementing rules as well as the procedure for their adoption, including a governance structure to ensure a harmonized and coordinated approach, a clear time-frame for adoption, and consultation of the EDPS (see Section 5 below); (ii) clarify the rules applicable to security of personal data held in the historical archives (Section 7); (iii) provide safeguards with regard to the private archives held by the EUI (Section 8); and (iv) provide at least some minimum clarifications with regard to the privacy exception in Article 2 of the Archiving Regulation (Section 9). These remaining concerns and recommendations will be addressed in more detail below.

4. ROLE OF EUI AS A PROCESSOR

31. As an additional preliminary remark, the EDPS emphasises that in any situation where personal data are processed, it is crucial to correctly identify who the controller is. This has been underlined by the Article 29 Data Protection Working Party in its Opinion 1/2010 on the concepts of 'controller' and 'processor'. The primary reason why the clear and unambiguous identification of the controller is so crucial is that it determines who shall be responsible for compliance with data protection rules.

32. As noted in the Working Party Opinion, '[i]f it is not sufficiently clear what is required from whom - e.g. no one is responsible or a multitude of possible controllers - there is an obvious risk that too little, if anything, will happen and that the legal provisions will remain ineffective.' Clarity is especially needed in situations where multiple actors are involved in a cooperative relationship as is the case of the EUI and the multiple EU institutions and bodies whose historical archives the EUI holds.

33. In light of the importance of clear allocation of roles and responsibilities, the EDPS welcomes the fact that the Proposal specifies that the EUI acts as a processor on behalf, and upon instructions of, the depositing institutions/bodies, who, in turn, act as controllers (Article 8(9) of the Archives Regulation as proposed). This provision helps ensure legal certainty and that the tasks and responsibilities for compliance with data protection rules are clearly allocated.

34. The choice of describing the role of the EUI as a processor (rather than as a controller) also provides more control to the depositing institutions and bodies over the storage, dissemination and publication of information kept in the historical archives. In particular, the EU institutions and bodies depositing their historical archives at the EUI 20 retain the power to instruct EUI on all matters related to data protection.

5. IMPLEMENTING RULES 5.1. Objectives and content of the implementing rules

35. The EDPS welcomes the fact that the Proposal, in its Article 9(1), requires the adoption of implementing rules, which should specifically also include rules for the protection of personal data.

36. The EDPS recommends that these implementing rules should provide sound document management rules, including specific guidance on selecting what should or should not ultimately go into the historical archives. Ensuring an effective screening procedure to decide what personal data should be transferred to the historical archives is becoming increasingly important considering the current trends towards digitalization, machinereadable and searchable formats, the possibilities for de-anonymization and data mining and public sector information reuse (see Section 2 above).

37. Moreover, the implementing rules should also provide guidance on what happens to personal data after they have been transferred to the archives, and how they will be managed at the EUI. The mere fact that personal data are publicly available for a specific purpose does not necessarily mean that such personal data should also be open for reuse for any other purpose. Personal data, even when made publicly available, will continue to be subject to applicable data protection law.

38. The EDPS recommends that these two key objectives, as well as the minimum elements for the content of the implementing rules (as listed below) should already be specified in the Archives Regulation.

39. Considering the complexity of the task and the significant effect of the implementing rules on the protection of personal data, the EDPS recommends that the chair of the Inter-institutional Archives Group, or another joint representative of the institutions and bodies concerned informs under Article 28(1) and consults the EDPS in a timely manner before adopting the implementing decisions. The Archives Regulation should refer to this consultation. 5.2. Document management rules before the transfer to the historical archives Data minimization as a key guiding principle for the entire document management cycle

40. Sound document management policies should be adopted to ensure that the principle 22 of data minimization is adhered to during the full document management cycle, starting with the creation of a document and collection of any personal data all the way through to the moment when the final selection decision will be made whether to transfer any particular document/dataset to the historical archives. Minimization of personal data to be filed in the first place

41. It generally takes more resources to screen documents for personal data ex post, once these documents have been already filed and large volumes of documents accumulated over long periods of time. To minimize the need for such ex-post screening, to start with, the implementing rules should include procedures to ensure that no more personal data be included in any official files than necessary for sound record-keeping. Clear data retention rules

42. For certain categories of files, including in particular those where the individuals concerned are likely to have had a reasonable expectation that their data will not be made publicly available even after a 30-year period , clear data retention periods should apply and all personal data contained in those files should be deleted after the lapse of that retention period. Personal data in these files should not be transferred to the historical archives. As noted in para 17 above, this is already the case in the CCL at least with certain categories of files, including the personnel and medical files of EU staff. Similar rules should be applied by all EU institutions and bodies. Anonymization techniques and related safeguards

43. The implementing rules should address anonymization techniques and related safeguards. These techniques are also specifically referred to in Article 4(1)(e) of 25 Regulation 45/2001.

44. The data protection screening for purposes of transfer to the historical archives should help evaluate whether data protection law permits the personal data to be made available for the historical archives as is, or only after aggregation or full or partial anonymization and in the latter case, what level of anonymization is required in order to minimize the risk of re-identification and misuse of the personal data.

45. In principle, anonymization should be carried out to the extent appropriate, considering on the one hand the purposes of processing and on the other hand the nature of the data and the potential consequences for the individuals in case they are re-identified. In order to make an informed decision on whether or not to disclose data publicly, and what level of anonymization to apply, it is crucial to involve all stakeholders (including representatives of groups of individuals who are likely to be affected) in the decision-making. Sorting of data

46. For those documents that are to be transferred to the archives, it must be established in what form, and subject to what conditions and limitations the transfer can be made. The implementing rules should specify this.

47. With regard to the text of the Archives Regulation itself, the EDPS recommends that Article 7 be complemented by a requirement that the 'sorting process' must also include a screening for data protection purposes. Further, possibly in a recital, at least a brief reference should also be made to anonymization techniques as one possible safeguard to ensure the protection of personal data. 5.3. Document management rules after the transfer to the historical archives

48. With regard to management of personal data already transferred to the historical archives and held at the EUI, the implementing rules should include, among others: (i) rules on how to provide access to the public (e.g. in paper form, digital form, via publication on the internet); (ii) for what purposes (historical, statistical, scientific, or other) access can be granted; (iii) what license conditions to apply when providing access to the public or authorizing reuse (acceptance of applicable data protection law, limitation to compatible use, specific contractual clauses for users outside the European Union, etc); (iv) whether or not parts of the historical archives should be digitalized, and if so, what screening procedure needs to take place to ensure that no unintended personal data requiring continued protection will be disclosed inadvertently as a result of digitalization.

49. Finally, for the future, and in particular for partially anonymized, digital, searchable and machine-readable files, in light of future technological developments and the gradually increasing risks of de-anonymization, EU institutions and bodies should also consider periodically reviewing whether any such partially anonymized set of personal data may continue to be kept publicly available in its existing form. 5.4. Need for a coordinated approach across the institutions and bodies concerned

50. The European Union has a large number of institutions and other bodies, including agencies, each with its specific needs, own administrative structure, and document management policies. In order to ensure that the historical archives held by the EUI remain manageable, and compliance with data protection rules remain transparent and straightforward despite the large number of depositors, it is essential that the data protection rules that are applicable to document management by the EUI would not be fragmented, but rather, harmoniously applied, irrespective of the provenance of the documents in the first place.

51. To this end, the EDPS recommends that the implementing rules be adopted in a coordinated and harmonized manner. To achieve this, an inter-institutional governance structure should be developed (or an already available structure, such as the Interinstitutional Archives Group , can be adapted). This governance structure should ensure consistency, but at the same time should allow for the necessary institutional flexibility where appropriate. 5.5. Time-frame for the adoption of the implementing rules

52. To make sure that the EU institutions and bodies and the EUI start working on the implementing rules as soon as possible and that they will be adopted within a realistic timeframe, the EDPS further recommends that the Archives Regulation be amended to include the requirement that the implementing rules referred to in Article 9(1) be adopted within two years after the adoption of the amendment to the Archives Regulation.

6. APPLICABLE LAW AND SUPERVISION

53. The EUI is an international organisation, set up in 1972 by the then six Member States of the European Communities to provide advanced academic training to doctoral researchers and to promote research. As such, it is neither an EU institution or body nor an entity established under Italian law.

54. It is not explicitly stated, either in the existing text of the Archives Regulation, or, as the EDPS understands, in any other relevant key document (such as the Convention setting up the EUI, the Protocol on the Privileges and Immunities of the EUI, and the Headquarters Agreement with the Italian Republic) what data protection law applies to the activities of the EUI, who supervises the EUI and what Court is entitled to hear any disputes with regard to data protection matters relating to the historic archives that it holds on behalf of EU institutions and bodies.

55. The proposed amendment to the Archives Regulation brings welcome clarifications in these regards: (i) the Proposal clearly specifies that Regulation (EC) No 45/2001 will apply, in its entirety, to the EUI, insofar as it concerns activities which relate to hosting the historical archives of EU institutions and bodies (see Article 8(9) of the Proposal), and (ii) the Proposal also clarifies that the EDPS will be the competent authority to supervise data processing by the EUI (Article 8(10)) .

56. These clarifications help ensure that there is sufficient legal certainty on these matters and may also contribute towards a more consistent, Europe-wide approach.

7. SECURITY OF PERSONAL DATA

57. Article 8(3) of the Archives Regulation, as proposed, addresses the preservation and protection of deposited archives, and refers to 'recognized international standards' as well as 'technical and security rules' applicable to public archives in Italy. The EDPS recommends that a sentence be added to this Article 8(3), noting that these provisions are without prejudice to Articles 21-23 of Regulation (EC) No 45/2001 regarding the confidentiality and security of the processing of personal data.

8. PRIVATE ARCHIVES

58. In addition to the historical archives deposited by EU institutions and bodies, the EUI also holds and manages private collections of individual persons, public organs or private organization that have contributed to the construction of Europe. Although the Commission has considered including provisions in the Proposal regulating how the EUI acquires, describes, and prepares for public consultation these private collections, these provisions have ultimately not been included in the final Proposal.

59. Considering that private collections, while existing in reality, are not proposed to be regulated in the Archives Regulation, the EDPS here only briefly wishes to point out that management of any private collection must also comply with applicable data protection laws. As with the case of institutional archives, two of the first questions to be unambiguously resolved are whether the EUI acts as a controller or processor, and what law applies. As the documents here do not come from an EU institution or body, but rather, from various individuals or organizations that may be subject to a variety of data protection laws (or to no data protection law at all), the situation may be even more complex than in case of the institutional archives deposited by EU institutions and bodies.

60. It is also possible that the EUI might take a more substantial role in processing the personal data included in the private archives (for example, it may have a more significant role in the screening process to decide what may and what may not be publicly disclosed). This should be carefully considered. In either case, a future amendment to the Archives Regulation should clearly specify whether the EUI acts as a controller or as a processor with regard to the private archives.

61. All other data protection issues related to the private archives should also be addressed and clearly documented in a consistent fashion with the implementing rules applicable to the historical archives deposited by EU institutions and bodies, which are discussed in Section 5 above.

9. PRIVACY EXCEPTION

62. Article 2 of the Archives Regulation provides an exception to the general rule that historic archives should be opened up after 30 years, on grounds of the protection of the privacy and integrity of the individual, as defined in Article 4(1)(b) of Regulation (EC) No 1049/2001. This provision, adopted in 2003, when the Archives Regulation was modernized, now remains unaffected by the Proposal.

63. Considering the limited scope of the proposed amendment to the Archives Regulation, this Opinion is not the place for the EDPS to comment in detail on this provision. However, the EDPS suggests at least a small correction, to ensure a correct reading of this provision also for data that have been made public prior to the end of the 30-year period.

64. In particular, Article 1(3) provides that 'all documents available to the public before the expiry of the [30-year] period shall remain available without restriction'. The EDPS recommends that the following text, or equivalent, be added at the end of Article 1(3): 'This is without prejudice to Article 2(1) and (2) below.'

10. CONCLUSIONS

65. The EDPS welcomes that the Proposal addresses data protection concerns, involving in particular: - the provisions on applicable law, - the determination of the supervisory authority, - the specification of the EUI's role as a processor, and - the requirement to adopt implementing rules to address data protection issues at the practical level.

66. To address remaining data protection concerns, the EDPS recommends that the proposed amendment to the Archives Regulation: - specify the key objectives and minimum content of the implementing rules as well as the procedure for their adoption, including a governance structure to ensure a harmonized and coordinated approach, a clear time-frame for adoption, and consultation of the EDPS; - clarify the rules applicable to security of personal data held in the historical archives; - provide safeguards with regard to the private archives held by the EUI, and - provide at least some minimum clarifications with regard to the privacy exception in Article 2 of the Archives Regulation. Done in Brussels, 10 October 2012 (signed) Peter HUSTINX European Data Protection Supervisor