European Voluntary Humanitarian Aid Corps

Opinion of the European Data Protection Supervisor

on the Proposal for a Regulation establishing the European Voluntary Humanitarian Aid Corps

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data ,

HAS ADOPTED THE FOLLOWING OPINION:

1. INTRODUCTION 1.1. Consultation of the EDPS

1. On 19 September 2012, the Commission adopted a Proposal for a Regulation establishing the European Voluntary Humanitarian Aid Corps ('the Proposal').

2. Before the adoption of the Proposal, the EDPS was given the possibility to provide informal comments. The EDPS welcomes the fact that the Commission also consulted him formally after the Proposal was adopted and that this Opinion is referred to in the preamble of the Proposal. 1.2. Objectives and scope of the Proposal

3. Pursuant to Article 214(5) of the Treaty on the Functioning of the European Union, this Proposal establishes the rules and procedures for the European Voluntary Humanitarian Aid Corps.

4. On the basis of the Proposal, trained volunteers are to be deployed as ‘EU Aid Volunteers’ in humanitarian projects worldwide. The EU AID Volunteers are to be selected and deployed by certified humanitarian organisations that adhere to a set of European standards on managing humanitarian volunteers. These standards as well as the certification procedure are to be developed by the Commission. The Commission is also foreseen to provide funding, a European training programme, a central registry to include all trained volunteers, as well as an IT network for volunteers to interact online before, during, and after deployment. 1.3. Relevance of data protection; objectives and focus of the Opinion

5. While it is not the main objective of the Proposal to process personal data, the Proposal nevertheless requires the processing of a personal data. These include personal data of volunteers registered in the Register of EU Aid Workers (Article 13) as well as personal data (of volunteers or third parties) that may be posted on the IT network provided for their on-line interactions (Article 16). The selection process of the candidates by the certified humanitarian organisations, as well as their subsequent management, which are to be standardized under Article 9, also requires processing of personal data.

6. These processing activities require adequate data protection safeguards. The practical implementation of these safeguards could and should be further developed in the standards to be set under Article 9 and in the data protection policies to be developed by the Commission and by the certified humanitarian organisations.

7. Articles 9 and 25 provide that the Commission shall adopt delegated acts to set the standards for the identification, selection and preparation of candidate volunteers' as well as for their subsequent management and deployment. The EDPS recommends that these standards should in particular be used to help ensure that data protection provisions are appropriately considered during the selection procedure, registration, as well as during deployment of the volunteers and that in these regards, a consistent approach be taken by the certified humanitarian organisations across Europe.

8. That said, certain essential elements regarding the application of the appropriate data protection safeguards should already be set forth in the proposed Regulation itself. To address these essential elements, Section 2 of the Opinion provides recommendations on Articles 13 and 16 of the Proposal.

9. Section 3 of the Opinion, in turn, calls for the consultation of the EDPS when developing the standards under Articles 9 and 25 of the Proposal. Section 3 also already briefly calls attention to some of the data protection issues that should be taken into account when developing the standards, as well as at the practical level, when implementing the proposed Regulation.

2. ESSENTIAL SAFEGUARDS TO BE SET FORTH IN THE PROPOSAL

10. The EDPS welcomes the references to the applicable data protection legislation in recital 22 of the Proposal, but suggests that the reference to Directive 95/46/EC is clarified by specifying that the provisions will apply in accordance with the national rules which implement Directive 95/46/EC.The EDPS furthermore recommends including a general reference to existing data protection legislation in a substantive provision of the proposal.

11. In addition, he recommends that certain essential elements of the data protection safeguards to be applied should be more specifically set forth in the body of the proposed Regulation. Article 13 - Register of European Volunteers

12. Article 13 foresees that the Commission shall establish, maintain and update a Register of European Volunteers, and shall regulate its access and use.

13. In order to ensure legal certainty, the EDPS recommends that essential elements such as (i) the purposes of this Register, (ii) the categories of data included in it, as well as (iii) the range of entities that may have access to the Register be clarified in Article 13.

14. In addition, the EDPS further recommends that Article 13 specifically require the adoption of a data protection policy for the Register, which could then provide more detailed and specific provisions implementing the necessary data protection safeguards. This is all the more important as - unlike for the standards to be developed under Article 9 in the form of delegated acts - no further delegated acts are foreseen to provide for detailed implementation of the Article 13 Register.

15. Presumably, the primary purpose of the Register is to allow the certified sending organisations to find suitable, already pre-selected, assessed and trained candidates for deployment in particular humanitarian aid missions. If this is the case, this should be specified in the Proposal. If additional purposes are foreseen, for example, if the Register were to also serve as a tool for receiving and processing on-line applications, this should also be clearly set forth in the proposed Regulation itself.

16. Once the purpose or purposes of the Register have been specified, it should then be also ensured and clearly specified in the Proposal that (i) the data included in the Register are relevant and proportionate for these purposes and that (ii) access be granted only on a need-to-know basis.

17. For example, if the purpose of the Register is to allow the certified sending organisations to find suitable, already pre-selected, assessed and trained candidates for deployment in particular humanitarian aid missions as noted above, (i) information about the skills relevant to the aid missions, including language skills and relevant information on education and professional experience could be included in the Register and (ii) could be made available to all certified humanitarian organizations who are seeking volunteers for a particular project.

18. If, in addition, the Register were to also serve the purposes of receiving on-line applications of candidates (for pre-selection, training, and ultimately inclusion in the Register), (i) it would be appropriate to include additional data in the Register that are relevant for purposes of such pre-selection, however, (ii) it would be disproportionate to give access through the Register to these additional data also to all other certified organisations who did not participate in the selection process. The purposes of processing, the categories of data to be included in the Register, as well as the recipients of such data, thus, should be clearly set forth in the Proposal.

19. Further, in order to clarify the allocation of responsibilities with regard to the processing of volunteers' data in connection with the Register, the EDPS recommends an additional paragraph in Article 13 to confirm that the Commission acts as a controller in accordance with Article 3(1) of Regulation (EC) No 45/2001, and the sending organisations in Member States as controllers in accordance with Article 4 of Directive 95/46/EC. Article 16 - European Humanitarian Voluntary Corps Network

20. Article 16 requires the Commission to establish and manage an EU Aid Volunteers' Network. The objective of the Network is to facilitate interaction and knowledge sharing and to support other activities such as seminars and workshops.

21. The EDPS recommends that Article 16 specifically require the adoption of a data protection policy for the Network. Further details on how the applicable data protection safeguards should be implemented can be established in this policy. Article 23 - Cooperation with other countries and international organisations

22. Article 23 of the Proposal opens the possibility of participation to citizens and sending organisations from third countries.

23. The EDPS here reminds that pursuant to Regulation EC (No) 45/2001 and Directive 95/46/EC, transfers of personal data to third countries are, in principle, only allowed if an adequate level of protection is ensured in the recipient country. The transfer to countries which do not provide for adequate protection can only be justified if any of the exceptions of Article 9 of the Regulation (EC) No 45/2001 and Article 26 of Directive 95/46/EC apply, for example, if the data subject has given his or her consent unambiguously to the proposed transfer.

3. STANDARDS, CERTIFICATION, AND DATA PROTECTION POLICIES Articles 9 and 25 - Delegated acts for standard setting

24. Articles 9 and 25 of the Proposal, taken together, provide that the Commission shall adopt delegated acts to set the standards for the identification, selection and preparation of volunteers as well as for their subsequent management and deployment.

25. The EDPS reminds the Commission that he should be consulted in the framework of the adoption of any delegated acts under Article 25 that would have an impact on the processing of personal data. This should specifically include the delegated acts to be adopted to set standards under Article 9.

26. With regard to the content of the standards, it is important that the standards require the organisations responsible for the selection of the candidates and subsequently, for the management and deployment of the volunteers, to have appropriate data protection policies in place.

27. It would be also desirable if these data protection policies were to provide a harmonised, consistent set of safeguards across Europe. Therefore, to the extent feasible, it would be helpful if the data protection safeguards were harmonized via the standards to be adopted.

28. This is particularly important for the selection process. The processing of any personal data required from candidates has to be justified and proportionate in view of the data quality principle. In this respect the EDPS refers to a pilot scheme supported by the Commission where applicants can already apply to become EU Aid Volunteers . The application forms appear to collect a large amount of data such as data about relationship status (including partner's name), information about children and other dependents, mortgages, disability. It should be carefully assessed whether the collection of all such data is clearly justified and proportionate and if so, whether their processing may require additional safeguards such as, among others, stronger measures to ensure confidentiality and security of the data, more limited retention periods, and specific arrangements to avoid unlawful discrimination on the basis of, among others, family, financial and relationship status or disability.

29. As a result of this assessment, the EDPS in particular recommends that the standards to be developed specify the categories of data that can be processed during the application procedure. The EDPS suggests that this intention for specification be mentioned in recital of the proposed Regulation.

30. This specification, for example, could take the form of a harmonized application form, that would clearly list all necessary information and documents that could be requested from the applicants. This application form could then constitute an appendix to the standards to be adopted. Availability of the EDPS for further guidance on certification and practical implementation

31. The Commission is also encouraged to seek further guidance from the EDPS when elaborating the certification scheme under Article 10 of the Proposal.

32. Further, the EDPS calls the attention of the Commission to the fact that -depending on the practical implementation foreseen for the Article 13 Register, including, in particular, on the purposes of its use and on the categories of personal data to be included in it- the establishment of the Register might also be subject to prior checking under Article 27 of Regulation (EC) No 45/2001. If in doubt, the Commission is encouraged to seek guidance from the EDPS whether a prior checking notification is necessary. Indicative list of items to be included in the data protection policies

33. The EDPS would like to support the creation of data protection policies and provides the following recommendations, for the development of these policies. The policies (applicable for the Article 13 Register, the Article 16 Network, and/or the selection process, as the case may be) may address, among others, issues such as:  The legal basis for the processing of personal data. A voluntary scheme is in principle based on the explicit consent for processing of personal data of those submitting their applications for enrolling as volunteers.  The specification of purpose. The purpose should be clear and explicit, and be limited to the purposes foreseen by the Proposal. Any personal data originally collected for a specific purpose cannot be accessed or used further for another purpose without a specific assessment of compatibility between both purposes. (See also para 12 above, which calls for specification of a purpose for the Register already in the main body of the Proposal.)  'Data minimisation'. According to this principle, personal data should be limited to the minimum necessary and should only be processed if the purpose of the processing could not be fulfilled by other means.  Disclosure of information to third parties. In principle, the personal information of volunteers included in the Register should not be disclosed to third parties and should only be used by the organizations that will deploy them. Any exceptions should be clearly explained and justified.  Use of cookies. Any use of cookies should be in line with Article 5(3) of the e-Privacy Directive , which requires information and where relevant consent of the user.  Updating registered user information:  All registered users should be able to correct, update or change their profile at any time from their profile page accessible from their user account.  Procedures should be in place to ensure that inactive users or those who wish to terminate their accounts should be deleted from the database in a timely manner and that any inaccurate information on active users is corrected promptly.  Changes to the data protection policy. Users should be informed about any change to the data protection policy.  Security policy. Appropriate technical and organisational measures should be in place designed to secure the user's personal information from accidental loss and from unauthorized access, use, alteration or disclosure.

4. CONCLUSIONS

34. The EDPS recommends that a reference to the applicable data protection legislation to be included as a substantive provision of the proposal.

35. The EDPS would recommend the following additional clarifications in the text:  Article 13 should specify the purposes of the Register, the categories of data included in it, as well as the range of entities that may have access to the Register, to ensure legal certainty.  Article 13 should also clearly identify the Commission and the user organisations as separate controllers.  Articles 13 and 16 each should require the adoption of a data protection policy, for the Register and the Network respectively.

36. Further, the EDPS recommends that the Commission should consult the EDPS before the adoption of any delegated acts under Article 25 that would have an impact on the processing of personal data, in particular, on the standards to be adopted under Article 9. These standards should require the adoption of appropriate data protection policies by the organizations carrying out the selection process for volunteers and managing and deploying volunteers. This may include harmonization of the categories of data collected, and may possibly lead to a standard application form to be used across Europe. Done in Brussels, 23 November 2012 (signed) Giovanni BUTTARELLI Assistant European Data Protection Supervisor