Drug precursors

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data ,

HAS ADOPTED THE FOLLOWING OPINION:

I. INTRODUCTION

I.1. Context of the Proposals

 On 27 September 2012 the Commission adopted the Proposal for a Regulation amending Regulation (EC) No 273/2004 on drug precursors and the Proposal for a Regulation amending Council Regulation (EC) No 111/2005 laying down rules for the monitoring of trade between the Community and third countries in drug precursors (hereinafter: “the Proposals”). The EDPS was consulted on the same day.

 The Proposals amend Regulation (EC) No 273/2004 and Regulation (EC) No 4 111/2005 (hereinafter: "the Regulations"), which implement the 1988 UN

 The UN Convention and the Regulations aim at recognising and protecting legal trade of drug precursors while, at the same time, discouraging their diversion for illicit purposes. Currently, Regulation (EC) No 273/2004 governs the monitoring of intra- EU trade, while the control of external trade is governed by Regulation (EC) No 8 111/2005. Both are implemented by Commission Regulation (EC) No 1277/2005 .

 Measures to control intra-EU trade imply the processing of data of operators since they include the obligation for certain industry operators to appoint a responsible officer and notify his contact details to the competent authorities, obtain a licence or registration, ask customers to declare the uses of the drug precursors provided to them and immediately notify the competent authorities in case they suspect an order or transaction might be aimed at diverting drug precursors for illicit purposes.

 As regards the control of external trade, the processing of data of operators is also necessary, as operators are obliged, for example, to apply to competent authorities for authorisation before importing or exporting drug precursors. Obligations for EU competent authorities include notifying certain third countries before an export of drug precursors takes place, and communicating to the Commission the result of their monitoring measures.

 Following criticisms by the UN International Narcotics Control Board (hereinafter: "the UN INCB") and by the 2010 Commission report on specific weaknesses of the current measures, the new Proposals include, among others, the following amendments to the Regulations:  the creation of a European Database on Drug Precursors ("hereinafter: the European Database);  the reinforcement of the harmonised registration provisions;  the extension of the registration requirement to users of acetic anhydride .

I.2. Aim of the Opinion

 Most of the measures required, such as the obligation for operators to report suspect transactions or the cooperation with third countries, imply the processing of data relating to operators which are usually companies and/or legal persons. However, in many cases natural persons will be also identifiable. The aim of the present Opinion is to analyse the impact of these control measures in the protection of privacy and personal data of such persons. As many of these measures are already currently laid down by the Regulations, the Opinion will not only refer to the new texts but also to parts of the current Regulations that are not being amended by the Proposals.

 Therefore, the present Opinion will address the following legislative texts:  Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EC) No 273/2004 on drug precursors (hereinafter: "the intra-EU trade proposal");  Regulation (EC) No 273/2004 on drug precursors (hereinafter: "the intra-EU trade regulation");  Proposal for a Regulation of the European Parliament and of the Council amending Council Regulation (EC) No 111/2005 laying down rules for the monitoring of trade between the Community and third countries in drug precursors (hereinafter: "the external trade proposal");  Council Regulation (EC) No 111/2005 laying down rules for the monitoring of trade between the Community and third countries in drug precursors (hereinafter: "the external trade regulation");  Commission Regulation (EC) No 1277/2005 (hereinafter "the implementing regulation"), which will be progressively replaced by the implementing and delegated acts to be adopted pursuant to the Proposals. Where needed, the Opinion will also refer to the UN Convention on which the Regulations are based.

II. ANALYSIS OF THE PROPOSALS

II.1. General remarks

 The EDPS welcomes the general references to the applicability of EU data protection legislation, the fact that most of the categories of data to be processed are defined and the inclusion, in one of the Proposals, of the principle of purpose limitation .

 However, the EDPS is concerned about the processing of data relating to suspicious offences, the international transfers of personal data, the inadequate definition of the categories of data in some cases and the lack of specific data protection provisions in the Proposals.

2. Specific remarks

II.2.1. References to the applicability of EU data protection laws are welcomed

 The Regulations require the processing of data of EU industry operators, importers and exporters, users, customers, persons involved in intermediary activities and ultimate consignees of drug precursors, which can be natural or legal persons . The processing of data relating to legal persons is in principle not covered by EU data protection legislation. However, these data might also identify natural persons, for example, if the official name of the legal person includes the name of a natural person . In these cases, the data protection legislation also applies.

 Examining whether the name of every legal person identifies natural persons could cause an unreasonable administrative burden to competent authorities . Therefore, the EDPS recommends applying the same data protection rules to data relating to natural and legal persons. In any event, the data protection rules should apply at least where natural persons are identifiable .

 Taking into account that not only Member States but also the Commission will process personal data, both Directive 95/46/EC and Regulation (EC) 45/2001 are applicable. The EDPS therefore welcomes the new Article 33 inserted in the external trade regulation and the new Article 13(b) inserted in the intra-EU trade regulation. Both articles specify that the processing of personal data by the competent authorities in the Member States will be subject to Directive 95/46/EC while the processing of personal data by the Commission, including for the purpose of the European Database, will be subject to Regulation (EC) No 45/2001. The EDPS recommends further specifying that "the processing of personal data by the competent authorities in the Member States shall be carried out in accordance with national legislation implementing Directive 95/46/EC".

 Recitals 11 of both Proposals also recognise that the data processed may include personal data, which should be processed in accordance with EU law. The EDPS also welcomes these references.

II.2.2 All the categories of data to be processed should be specified

 The EDPS welcomes the fact that most of the categories of personal data to be processed by operators and competent authorities are specified. As a general rule the EDPS recommends laying down in the main legislative texts the essential elements of the processing operations. Therefore, the categories of data to be processed should preferably be laid down in the Proposals. However, in case this is not possible, he recommends at least specifying in the Proposals that the processing of sensitive data is excluded and subsequently detail the categories of data to be processed by delegated

acts. Below the EDPS gives a description of the categories of personal data to be processed and, where relevant, recommendations on how to better specify them.

a) Details of appointed officers

 According to the intra-EU trade regulation and the implementing regulation, operators have to appoint an officer for trade in drug precursors and notify competent authorities of the name and contact details of that officer . The EDPS welcomes the specification of the categories of data to be processed for this purpose.

b) Licensing and registration of operators

 The intra-EU trade regulation, the intra-EU trade proposal and the external trade regulation require certain operators and users to obtain a licence . The implementing regulation further specifies that licence applications shall include the full name and address of the applicant; the full name of the responsible officer; a description of the position and tasks of the responsible officer; the full addresses of the business premises; and a certificate of good conduct of the applicant and the responsible officer or a document showing that they offer the necessary guarantee for the proper conduct of the operations, as appropriate . The EDPS welcomes the specification of this information in the implementing regulation but recommends, if possible, specifying in the Proposals themselves the categories of personal data to be processed.

 Operators and users of certain substances are only required to register . The EDPS understands that this process is simpler than obtaining a licence. However, he recommends specifying the data to be provided to competent authorities for this purpose preferably in the text of the Proposal or at least by delegated acts.

 When considering whether to grant a licence or a registration, competent authorities shall in particular take into account "the competence and integrity of the applicant" . Registrations and licenses can also be refused, suspended or revoked if there are reasonable grounds "for doubting the suitability and reliability” of the applicant or of the responsible officer, "for believing that the holder is no longer a suitable and fit person" or "for suspecting that the scheduled substances are intended for the illicit manufacture of narcotic drugs (...)" .

 It is not clear on the basis of which information competent authorities will evaluate "the competence and integrity" of the applicant to decide whether to grant him a licence. The same comment is valid for the evaluation of the reasonable grounds "for doubting of the suitability and reliability of the applicant or of the responsible officer",

"for believing that the holder is no longer a fit and proper person" or for suspecting that there might be a diversion. According to the EDPS, the categories of personal data to be processed for these purposes should also be laid down in the Proposals or in delegated acts. In addition, the processing of sensitive data should be explicitly excluded .

c) Customer declarations

 Customers have to provide operators with a declaration showing the specific use or uses of scheduled substances . The declaration, as specified in Annex III of the intra- EU trade regulation, should include the name and address of the customer, the name and position of the person signing on behalf of the customer and the purposes for which the drug precursors will be used . The EDPS welcomes the specification of the categories of personal data to be provided.

d) Demonstration of the licit purpose of the transaction

 Operators may be required to demonstrate the licit purposes of drug precursors entering the EU territory . The information to be provided to competent authorities for this purpose is currently listed in Annex III of the implementing regulation and includes the name, and contact details of the operator, as well as information on the substances to be imported and a signed declaration that these have been exported in accordance with the UN Convention. It may also include a copy of the export authorisation or of the licence or registration. The EDPS welcomes the specification of the categories of personal data to be provided but recommends trying to insert the specifications in the Proposals themselves.

e) Documentation

 The Regulations also require operators to document all imports, exports and intermediary activities by way of customs and commercial documents. These documents should include the names and addresses of the supplier or the exporter, the distributor or the importer, the consignee and, where applicable, of the person 28 involved in intermediary activities or of other operators directly involved . The intra- EU trade regulation also requires including the customer declaration referred to above in the documentation . As regards mixtures of certain scheduled substances, the requirements and conditions for the documentation may be specified by delegated acts . The EDPS recommends specifying in the Proposals all the categories of personal data to be included in the documentation.

f) Summaries of transactions

 Operators have to provide competent authorities with a summary of their export, import or intermediary activities. According to Article 17 of the implementing regulation, the summaries required by the intra-EU trade regulation currently contain “the quantities of scheduled substances used or supplied and, in the case of supply, of the quantity supplied to each third party”. Article 18 of the implementing regulation also requires operators to inform competent authorities of their exports, imports and intermediary activities. This information should be organised by third countries, quantities exported and the export authorisations' reference numbers.

 The summaries may therefore contain personal data, as the information will be related to operators and third parties. If this is the case, the categories of personal data to be processed should be specified, preferably in the Proposals, or at least by delegated acts (see also section II.2.8(b)).

g) Pre-export notifications, export authorisations and import authorisations

 Exports of certain drug precursors to specific countries of destination shall be preceded by a pre-export notification sent from EU competent authorities to the competent authorities of the country of destination . The UN Convention requires including in the notification the name and addresses of the exporter, the importer and, when available, the consignee, as well as “any other information". Article 21(2) of the implementing regulation states that the information to be supplied (only for simplified pre-export notifications) is specified in Article 13(1) of the external trade regulation, which requires at least, among other information, the names and addresses of the exporter, the importer in the third country, any other operator involved in the export operation or shipment, and the ultimate consignee. The EDPS welcomes these lists but recommends specifying what other categories of personal data might be processed for this purpose and to avoid an open-ended description of categories.

 Exporters and EU importers may have to apply for export or import authorisations to the competent authorities of the country where they are established. These applications shall also include at least the names and addresses of the exporter, the importer country, any other operator involved and the ultimate consignee . The complete lists of required information are specified in the forms included in the Annexes of the implementing regulation . The EDPS welcomes this specification but would recommend specifying the categories of personal data to be processed in the Proposals themselves.

 Competent authorities can refuse the granting of export and import authorisations if “there are reasonable grounds for suspecting that the details provided (…) are false or incorrect” or “for suspecting that the substances in question are intended for the illicit manufacture of narcotic drugs or psychotropic substances” . The Proposals should

specify the categories of personal data to be processed for this purpose or at least explicitly exclude the processing of sensitive data and subsequently specify the categories of personal to be processed by delegated acts.

h) Reporting of seizures and stopped shipments

 Article 32 (1) of the external trade regulation and Article 29 of the implementing regulation require Member States to communicate to the Commission all information on the implementation of the measures required by this regulation to monitor trade in drug precursors. This information includes in particular the type of substances and methods frequently used for illicit manufacture and diversion of narcotic drugs and psychotropic substances. The implementing regulation further specifies that Member States shall submit a list of the cases where the release of scheduled substances was suspended or the scheduled substances were detained. The list shall include the name of the scheduled substances, the quantity of the scheduled substances, their customs status and means of transport used and, if known, their origin, provenance and destination.

 Subsequently, the Commission shall communicate this information to all Member States and submit a summary to the UN International Narcotic Board, in accordance with the UN Convention. The information required includes the amounts seized of certain substances and their origin, as well as the methods used for illicit manufacture and diversion. According to the Proposals, these exchanges of information will be done through the European Database.

 The EDPS understands that the processing of personal data is not needed for this purpose. Therefore, he recommends specifying in the text of the Proposals that the reporting of seizures and stopped shipments by Member States to the Commission and by the Commission to Member States and the UN INCB will only include aggregated and anonymised data.

II.2.3 Personal data on suspect offences should be subject to specific safeguards

 The Regulations require EU operators to immediately report suspect transactions to competent authorities . Personal data contained in these reports on suspect transactions can thus be related to offences.

 According to Article 8 of Directive 95/46/EC, the processing of data relating to offences is restricted and subject to special protection. It should only be carried out under the control of an official authority or if suitable specific safeguards are provided by law.

 The data will not only be processed under the control of official authorities, as it will be initially controlled by operators. Therefore, the Proposals should require specific safeguards. In this regard, the EDPS welcomes the fact that the external trade proposal states that the data on suspicious transactions will only be used for the purpose of

 The EDPS also recommends specifying in the Proposals that operators have to delete data on suspicious transactions as soon as the suspicion is cleared by competent authorities, unless they need them for specific reasons, e.g. to demonstrate the correct fulfilment of their obligations. In addition, the Proposals should specify that operators should not disclose personal data to recipients other than the competent authorities. Operators should also, in accordance with national data protection laws, implement additional safeguards for the processing of these data.

II.2.4. The processing of sensitive data should be excluded

 The EDPS welcomes the minimum list of categories of data that operators shall provide to competent authorities for the reporting of suspect transactions, which is included in the external trade proposal . The EDPS recommends adding a similar provision to the intra-EU trade proposal. However, as the list is not exhaustive, the EDPS is concerned about the possibility of discriminatory practices by operators or competent authorities in determining suspect transactions, such as profiling according to ethnic origin or other categories of sensitive data.

 The EDPS reminds that the processing of sensitive data (i.e., personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, tradeunion membership, or concerning health or sex life) is in principle prohibited by EU data protection law . In the present situation the processing could only be allowed in case of substantial public interest if it is laid down by a law (or by decision of supervisory authorities) providing suitable safeguards. As sensitive data are not included in the list of minimum data to be reported, their processing does not seem necessary for a substantial public interest and should thus be excluded.

 The EDPS recommends listing all the categories of data to be processed for this purpose in the Proposals. In case it is not possible to establish an exhaustive list, it should at least be specified in the Proposals that the data reported by operators or processed by competent authorities for this purpose should not include special categories of data as defined by Article 8(1) of Directive 95/46/EC. The complete list of categories of personal data to be processed should be at least laid down by delegated acts.

 Article 10 of the external trade regulation and Article 1(7) of the intra-EU trade proposal foresee the adoption of guidelines explaining "how to identify and notify suspect transactions". These guidelines should also explain that the processing of sensitive data is excluded.

II.2.5. Retention periods should be specified

 The EDPS notes that the Regulations specify minimum retention periods for certain operations . He understands that these are the periods during which the retention is necessary. Personal data should thus not be retained after these periods, unless this is justified .

 Taking into account that competent authorities and operators have been implementing the Regulations for years with retention periods established at national level, the EDPS acknowledges that in some cases it might be difficult to completely harmonise these periods at EU level. However, the EDPS recommends laying down in the Proposals at least maximum retention periods for each processing operation. Moreover, the necessity of every specific retention period should be justified in the Preambles of the Regulations.

 The EDPS also questions the necessity of keeping the documentation for three years , since the UN Convention on which this obligation is based only requires keeping it for two years . He therefore recommends considering reducing the period referred to in Article 4 of the external trade regulation.

II.2.6. Data subjects should be informed

 In accordance with Directive 95/46/EC, competent authorities should inform operators and users, that their personal data will be collected and retained for the purposes of monitoring, licensing and registering trade of drug precursors. This information should include the categories of data that will be processed, including for the European Database, the identity of the controller, the recipients of the data, specifying where they are located in third countries, and information about how to exercise the rights of access and rectification . A new Article could be added to the Proposals in this regard.

 In addition, operators and users should be informed that orders relating to them might be reported as suspicious to competent authorities. All this information should be provided at the time of the collection of the data, for example, by means of a privacy notice included in the forms used to collect the data which are contained in the annexes of the Regulations. In addition, it could be made available on the websites of the competent authorities. This should also be specified in the Proposals.

II.2.7. International transfers should be subject to adequate data protection safeguards

 According to the UN Convention, if a Party has suspicions on a transaction, it should notify the competent authorities of the Parties concerned. The external trade regulation also requires determined categories of exports to be preceded by a preexport notification from the competent authorities in the EU to the competent

authorities in the country of destination. According to Article 12(10) of the UN Convention, these notifications should include the name and address of the exporter and importer and, when available, the consignee, as well as any other information which is mutually agreed by the parties.

 In addition, the external trade regulation requires certain exporters and importers to apply for export or import authorisations to the competent authorities of the country where they are established. If competent authorities consider that “there are reasonable grounds for suspecting that the details provided (…) are false or incorrect” or “for suspecting that the substances in question are intended for the illicit manufacture of narcotic drugs or psychotropic substances” , they can refuse the granting of export or import authorisations. Especially in the case of import authorisations, this might entail communicating data on a suspicious EU operator to third countries' competent authorities.

 Therefore, the implementation of the UN Convention and the external trade regulation involves transfers of personal data from the EU to third countries. In principle Directive 95/46/EC only allows transfers of personal data to third countries which do ensure an adequate level of protection . But most of the countries concerned are not considered to offer an adequate level of protection for personal data .

 Although under Directive 95/46/EC some exceptions apply, for example if the transfer is necessary or legally required on important public interest grounds , these exceptions cannot be the legal basis for repeated and structured transfers as the ones foreseen in the external trade regulation .

 However, in the present case, the transfers could take place in accordance with EU data protection law if it is ensured that adequate safeguards are in place . These safeguards could be based on the data protection principles contained in the Standard Contractual Clauses for the transfers of personal data to third countries adopted by the Commission . They should include the possibility for data subjects to seek administrative and judicial redress, as well as an independent oversight mechanism to ensure compliance with the safeguards.

 These adequate safeguards should be mentioned in the text of the external trade regulation and should also be included in binding agreements to be negotiated between the EU and the competent authorities of the relevant third countries. Alternatively and on longer term, whenever the UN Convention is renegotiated, the EU could propose adequate data protection safeguards to be included in a binding UN instrument.

 The EDPS understands that since 2006 most of these data have been exchanged via the Pre-Export Notification (PEN) Online System, developed and managed by the UN Office on Drugs and Crime (UNODC) and the UN INCB, and that neither the European Commission nor EU Member States have the capacity to impose data protection safeguards in the system.

 According to the UNODC, the PEN Online System "enables easy on-line exchange of information between Member States on shipments (export and import) of [drug precursors]. (...) The system facilitates full electronic reply to acknowledge receipt and notify the exporting country of clearance to export. An electronic copy is sent to UN 56 INCB by default. (...)" . Rights of access to the system can only be granted to government officials after approval by the relevant Member State's Mission Representative to the UN office in Vienna .

 The EDPS welcomes these specifications. However, additional data protection and security safeguards should be laid down, at least for personal data relating to EU operators, such as maximum retention periods for data stored in the system, the granting of access and correction rights to data subjects and the possibility to obtain 58 redress in case of misuse .

II.2.8. The European Database on drug precursors

 The European Database to be created by the intra-EU trade proposal aims at facilitating the reporting of seizures and stopped shipments ; creating a European register of operators and users holding a licence or a registration ; and enabling operators to provide competent authorities with information about their transactions .

The two last functions will be analysed below, as they will entail the processing of personal data.

II.2.8.1. General comments

 As regards the principle of purpose limitation, the EDPS would like to remind that the interconnection and exchange or correlation of data with other databases managed by the Commission or by other entities for different purposes would in principle not be allowed.

 As regards the supervision of the processing operations carried out through the European Database, the EDPS welcomes Article 1(16) of the intra-EU trade proposal and Article 1(10) of the external trade proposal which state that the processing of personal data by the competent authorities in the Member States will be supervised by national Data Protection Authorities; while the processing of personal data by the Commission, including for the purpose of the European Database, will be supervised by the EDPS.

 In addition, as regards the European Database, the EDPS recommends including a provision in the Proposal providing for coordinated supervision between the EDPS and national Data Protection Authorities. The Proposals could specify that national Data Protection Authorities and the EDPS, each acting within the scope of their competences, 'shall cooperate actively' and 'shall ensure coordinated supervision of the European Database'. The system of coordinated supervision could be similar to the one laid down with regards to the Internal Market Information System (IMI) .

II.2.8.1. Specific recommendations

a) European register of operators

 Article 1(2)(f) of the intra-EU trade proposal and Article 1(15) of the external trade proposal require competent authorities to enter operators which have obtained a licence or a registration in accordance with the intra-EU regulation in the European Database. Access by operators to the European Database is not allowed by the Proposals. However, the legislative financial statement of the intra-EU trade Proposals seems to suggest that it could be granted in the future. In case access by operators is envisaged, this should be clarified in the substantive part of the Proposals.

 Article 1(11) empowers the Commission to adopt delegated acts concerning the requirements and conditions for listing registered or licensed operators and users. According to the EDPS, this Article should also specify (or, if not possible, at least empower the Commission to lay down rules specifying) the following:  the rights of access to personal data contained in the European Database and how they will be controlled;  the procedures to grant operators and users the rights of access, rectification and, where appropriate, objection and blocking; how operators and users will be

informed about the processing of their data in the European Database and about their rights;  the maximum retention period for personal data contained in the database, which should be limited to the minimum necessary to fulfil its purposes;  a procedure to delete or update data where necessary, e.g., when an operator ceases its activities;  the role of the Commission, e.g., as responsible for controlling and managing the database and for ensuring its security.

 If the data on operators and responsible officers are to be cross-checked with other databases, this should be clarified in the Proposals. In any case, and in order to respect the principle of purpose limitation , it should be specified that only databases created for the same purpose (preventing illegal trade in drug precursors) should be used. In addition, checking against other databases should not be done in a systematic way, but only on a case by case basis where necessary.

b) Summaries of transactions

 Article 1(9) of the intra-EU trade proposal states that one of the purposes of the European Database is enabling operators to provide competent authorities with information about their transactions. The Commission is empowered to adopt delegated acts to determine how to provide this information in electronic form to the European Database .

 The EDPS welcomes Article 19 of the implementing regulation which states that this information has to be treated as confidential. However, in case it includes personal data, the following safeguards should also be specified, preferably in the Proposals or at least by delegated acts:

 the categories of personal data that will be processed in the Database;  the purposes for which these data can be used;  which entities will have access to personal data contained in the European Database and how access rights will be controlled;  the procedures to grant operators the rights of access, rectification and, where appropriate, objection and blocking;  how operators will be informed about the processing of their data in the European Database and about their rights;  the maximum retention period for personal data contained in the database, which should be limited to the minimum necessary to fulfil its purposes;  a procedure to delete or update data where necessary, e.g., when an operator ceases its activities;  the role of the Commission, e.g., as responsible for controlling and managing the database and for ensuring its security.

 Article 1(11) of the intra-EU trade proposal empowers the Commission to adopt implementing acts on how to provide customer declarations in electronic form, but does not provide for their processing through the European Database. The EDPS recommends clarifying this. If the European Database is to be used for purposes other than those stated in Article 1(9) of the intra-EU trade proposal, such as for the processing of customer declarations, this should be specified in the Proposals.

III. CONCLUSIONS

 The EDPS welcomes the general references to the applicability of EU data protection legislation, the fact that many of the categories of data to be processed are specified and the fact that the principle of purpose limitation is mentioned in the external trade proposal.

 However, he recommends laying down in the main legislative texts the essential elements of the processing operations such as the exclusion of the processing of sensitive data. All the categories of data to be processed should also be specified preferably in the Proposals, and at least by delegated acts.

 He also recommends:

 adding to the intra-EU trade proposal that personal data on suspicious transactions may only be used for the purpose of preventing the diversion of scheduled substances;  laying down maximum retention periods in the Proposals for all processing operations and specifying in the Proposals that data on suspicious transactions has to be deleted as soon as they are not necessary any more;  justifying in the Preambles of the Regulations the necessity of every specific retention period;  adding a new Article to the Proposals on how information on the processing operations should be provided to data subjects;  as regards international transfers of personal data, including data protection safeguards in the text of the external trade regulation and in an international binding text or in binding agreements with the recipient third countries;  as regards the European Database, if operators need to have access to it or it is to be used for additional purposes, this should be specified in the substantive part of the Proposals;  ensuring the supervision of the European database by a system of coordinated supervision between the EDPS and national Data Protection Authorities, similar to what is foreseen for the Internal Market Information System;  as regards the register of European operators and the processing of summaries of transactions through the European database, specific data protection and security safeguards should be added, preferably to the Proposals and at least by delegated or implementing acts;  if the European Database is to be used for purposes other than those stated in Article 1(9) of the intra-EU trade proposal (e.g., for the processing of customs declarations), this should be specified in the substantive part of the Proposals.

 As regards the principle of purpose limitation, the EDPS would like to remind that the interconnection and exchange or correlation of data of the European database with other databases managed by the Commission or by other entities for different purposes should in principle not be allowed.

Done in Brussels, 18 January 2013

(signed)

Giovanni Buttarelli Assistant European Data Protection Supervisor