Drug precursors

Opinion of the European Data Protection Supervisor

on the Proposal for a Council decision on the conclusion of the Agreement between the European Union and the Russian Federation on drug precursors

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free 2 movement of such data , and in particular Article 28(2) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. INTRODUCTION 1.1 Context of the consultation of the EDPS

1. On 21 January 2013, the Commission adopted a Proposal for a Council decision on the conclusion of the Agreement between the European Union and 3 the Russian Federation on drug precursors (hereinafter: 'the Proposal') . The Proposal was sent to the EDPS for consultation on the same day.

2. The Proposal includes the text of the agreement between the European Union and the Russian Federation on drug precursors (hereinafter: "the agreement") . Annex II of the agreement contains a list of data protection definitions and principles (hereinafter: "data protection principles") .

3. The EDPS had been previously consulted by the Commission. The present Opinion builds on the advice provided at that occasion and on the EDPS Opinion on the amendments to the Regulations on EU internal and external trade in drug precursors . I.2. Aim of the agreement

4. The agreement aims at further strengthening cooperation between the European Union and the Russian Federation on the prevention of diversion from legitimate trade of the substances used to illicitly manufacture narcotic drugs and psychotropic substances (hereinafter: "drug precursors").

5. On the basis of the UN Convention of 1988 against Illicit Traffic in Narcotic Drugs and Psychotropic Substances (hereinafter "the 1988 Convention") , the agreement will allow the coordination of trade monitoring procedures and mutual assistance between the competent authorities of the Parties (the European Union and the Russian Federation), together with technical and scientific cooperation and the setting up of a Joint Follow-Up expert group. II. GENERAL COMMENTS

6. The EDPS is aware that the purpose of the agreement is not the processing of personal data. However, the agreement will imply the processing of personal data relating to natural persons, either directly or indirectly, for instance if a natural person can be identified through a legal person.

7. Therefore, the EDPS welcomes the references to the protection of personal data and the inclusion of data protection principles to be respected by the Parties.

8. The EDPS is nevertheless concerned about the actual enforceability of these principles and about the establishment of an authority in the Russian Federation which, according to the agreement, will be in charge of supervising the implementation of the data protection principles. III. SPECIFIC COMMENTS III.I. Applicability of EU data protection legislation

9. The agreement requires the exchange of data relating to operators importing or exporting drug precursors between the EU and Russia. The processing of data relating to legal persons is not covered by EU data protection legislation. However, these data might also relate to identified or identifiable natural persons, for example, if the name of the legal person includes the name of a natural person or if data about a small business contains information about one of its owners . In these cases, the data protection legislation applies.

10. The EDPS therefore welcomes the reference in the Explanatory Memorandum to the fact that the agreement may occasionally imply exchanges of personal data . He also welcomes that the Preamble states that "the agreement should ensure full respect of fundamental rights" and, in particular, "a high level of protection for the processing and transfer of personal data between the Parties" . However, he notes that this declaration by itself does not ensure that the agreement provides an adequate level of protection (see section III.5. below).

11. As the agreement implies the processing of personal data by Member States' authorities (together with Russian authorities) , Directive 95/46/EC is applicable. Therefore, the EDPS recommends including an explicit reference to the applicability of EU national laws implementing Directive 95/46/EC to the transfers of personal data by the EU to Russian authorities and to the processing of personal data by Member States’ authorities. The EDPS also suggests including references to Articles 7 and 8 of the EU Charter of Fundamental Rights. III.2. Categories of data to be processed

12. The EDPS welcomes the references in Articles 3(2) and 4(1) of the agreement to Article 12(10)(a) of the 1988 Convention, which lists the categories of data that can be exchanged for the purposes of trade monitoring and mutual assistance. However, Article 12(10)(a)(v) of the 1988 Convention allows the exchange of "any other information which is mutually agreed upon by the Parties".

13. In addition, Article 4(2) states that "the Parties shall also provide each other (...) with mutual assistance if there are reasons to believe that "other relevant information is of interest to the other Party". Similarly, Article 5(3), states that the information to be contained in the written requests to be sent to a Party shall contain "other information that may be used for the execution of the request".

14. The EDPS recommends specifying in an exhaustive manner in Articles 3(2), 4(1) and 5(3) all the categories of personal data that may be exchanged. This is all the more relevant taking into account the potential sensitivity of the data to be exchanged (see section III.3). III.3. Processing of special categories of data

15. Article 8 of Directive 95/46/EC explicitly prohibits, except under strict conditions, the processing of personal "data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life" and restricts the processing of personal data relating to offences, criminal convictions or security measures .

16. As previously noted by the EDPS , open data fields such as the ones contained in Articles 4(2) and 5(3) (as well as in Articles 3(2) and 4(1) which refer to Article 12(10)(a)(v) of the 1988 Convention) could potentially include sensitive data, e.g., if the information reported on suspect transactions includes health data or data revealing ethnic origin. In order to avoid this possibility, the EDPS recommends, as stated above, listing all the categories of data to be exchanged.

17. In addition, the agreement requires the competent authorities of the Parties to inform each other whenever they have reasonable grounds to believe that there may be a diversion of drug precursors from legitimate trade . Personal data contained in these reports on suspect transactions can thus be related to offences. Article 8 of Directive 95/46/EC only allows the processing of data relating to offences if it is carried out under the control of an official authority or if suitable specific safeguards are provided by law.

18. Although the agreement only provides for processing by the Parties’ competent authorities, the EDPS recommends including additional safeguards in the agreement or in Annex II, such as short retention periods and strict security measures. It should also be specified that once a suspicion is cleared, information transferred e.g., under Article 3(1), should be deleted. In addition, as recommended in section III.6, the Parties’ competent authorities should not transfer the data to other recipients, either national or of third countries, unless strict conditions apply. III.4. Purpose limitation and data retention

19. Article 5 of the agreement is entirely dedicated to confidentiality and data protection. The EDPS welcomes the principle of purpose limitation contained in Article 5(2), which states that personal data obtained under the agreement shall be used solely for the purposes of this agreement. However, he regrets the fact that Article 5(3) allows the processing for further purposes, without specifying them.

20. These other purposes should be explicitly stated in the agreement and should be compatible with the original purpose for which the data were transferred. This is especially relevant as regards the possible processing of sensitive data (for example, relating to suspicious transactions, see above). The processing for other incompatible purposes should only be allowed for any of the grounds contained in Article 13 of Directive 95/46/EC . Any exception to the principle of purpose limitation should be interpreted in a restrictive way, used only in specific cases and subject to strict conditions .

21. The EDPS also welcomes the prohibition of keeping the data for longer than 18 necessary , but he recommends specifying maximum retention periods. The EDPS is aware that the harmonisation of retention periods may be difficult, even within the EU. However, at least a maximum period could be determined, based on the experience of EU Member States and the Commission in the implementation of the 1988 Convention, Regulation (EC) No 273/2004 and Council Regulation (EC) No 111/2005 on drug precursors . The EDPS suggests taking this up further in the legislative process, and in this context asking further guidance to the national authorities concerned as well as to the Article 29 Working Party. III.5. Legal basis for international transfers

20. As a general rule, Directive 95/46/EC only allows transfers of personal data to 20 third countries which do ensure an adequate level of protection . Although some exceptions apply, e.g., if the transfer is necessary or legally required on important public interest grounds , these exceptions cannot justify repeated and structured transfers as the ones foreseen in the agreement .

21. The Russian Federation is not considered to grant an adequate level of protection for personal data. The EDPS also notes that the Russian Federation has not ratified the Council of Europe Convention No. 108 on automatic processing of personal data or its additional protocol on supervisory authorities and transborder data flows .

22. The EDPS therefore welcomes the inclusion of data protection principles which, according to Article 5 of the agreement, "are mandatory for the Parties". If the principles are respected and effectively enforceable, the transfers could take place on the basis of Article 26(2) of Directive 95/46/EC, which requires "adequate safeguards". These principles will be analysed below. III.6. The data protection principles

23. The EDPS welcomes the fact that Article 5(5) specifies that in case personal data are exchanged, their processing shall comply with the data protection principles. The EDPS also welcomes the list of principles contained in Annex II, which, if read together with Article 5, is very close to the basic list of minimum conditions for assessing "adequate protection" provided by the Article 29 Working Party and to the principles attached to the Commission Standard Contractual Clauses .

24. The EDPS would however recommend adding in the agreement or in Annex II the provisions on "data security" and "sensitive data" (see also point III.3 above), present in the two sets of principles listed above. In addition, as regards the principles of "transparency" and "rights of access, rectification, erasure and blocking of data", he would recommend specifying in the text of the agreement or in the Annex the procedures to give effect to these principles.

25. The EDPS welcomes the principle of "redress", including the right to administrative and judicial remedy to individuals "regardless of their nationality or country of residence" and the references to compensation and sanctions. The practical information on existing remedies should be mentioned in the agreement or at least in letters exchanged between the parties or in documents accompanying the agreement.

26. The term "competent authority" used under this principle is misleading. The EDPS understands that it refers to data protection supervisory authorities. However, this is the same term used to refer to authorities competent to monitor and report on trade in drug precursors. Therefore, the EDPS recommends specifying in the paragraph on "redress" that it refers to authorities competent for the protection of personal data and the supervision of their processing. The relevant authorities should be mentioned in the agreement or at least in letters exchanged between the parties or in documents accompanying the agreement.

27. The EDPS welcomes the provisions on "supervision of data processing". However, although there is a reference to supervision by independent public authorities, it is not specified which will be those authorities and whether they will be really independent in practice. As with the previous principle, this should be specified in the agreement or at least in letters exchanged between the parties or in documents accompanying the agreement.

28. As regards “onward transfers”, the EDPS welcomes the fact that Annex II states that transfers of personal data to other authorities and public bodies of a third country shall be allowed if this country provides an adequate level of data protection and for the purposes for which the data have been transmitted. It should also be added that the competent authorities of the Parties should not transfer personal data to other national recipients unless the conditions mentioned above are fulfilled. The EDPS also welcomes the fact that, “subject to reasonable legal limitations provided by national law the Parties shall inform the data subject on such onward transfer”.

29. The last principle provides for exceptions to the rights of transparency and direct access by data subjects. In cases where access cannot be granted to data subjects because it would "jeopardise an official investigation" or "violate the human rights of other persons" , indirect access through EU national data protection authorities should be provided. This should be clearly laid down in the agreement. III.7. Review and reporting

30. The agreement establishes a joint follow-up expert group entitled to make recommendations, administer the agreement and ensure its proper implementation .This group will consist of representatives of the authorities competent for the monitoring and reporting on trade in drug precursors. Participation of data protection supervisory authorities is not foreseen.

31. The EDPS suggests providing that the data protection supervisory authorities of the Parties should contribute to the review of the implementation of the agreement, either because invited in the framework of the joint follow-up expert group, or as a separate process. The independence of the relevant Russian supervisory authority should be carefully analysed on the basis of the requirements of EU data protection law and taking into account Council of Europe Convention No. 108. The result of this analysis should be laid down in the documents accompanying the agreement or in the letters exchanged between the parties.

32. If the independence of such authority cannot be established, EU national data protection authorities should be involved in the oversight of the implementation of the agreement both by EU and by Russian competent authorities. Therefore, it should be specified in the agreement or at least in the documents accompanying it or in the letters exchanged between the parties that the EU review team should include EU national data protection authorities.

33. In addition, it should be specified that Russian authorities competent for the implementation of the agreement should ensure access by EU data protection authorities to relevant documentation, systems and staff for the purposes of the review. The results of the joint review should be reported to the European Parliament and to the Council, where needed with full respect of confidentiality. III.8. Suspension and termination

34. Finally, the EDPS recommends completing Article 12 of the agreement with a clause allowing any Party to suspend or terminate the agreement in the event of a breach of the other Party's obligations under the agreement, including as regards compliance with the data protection principles. The EDPS notes that suspension and termination is in general provided by the Vienna Convention . However, he recommends adding this explicit reference to breaches of the data protection principles as a reason for suspending or terminating it. Such a clause could also include, for example, consultations between the Parties prior to any possible suspension. IV. CONCLUSIONS

35. The EDPS welcomes the provisions on the protection of personal data in the text of the agreement and the inclusion in the Annex of data protection principles to be respected by the Parties.

36. The EDPS suggests including an explicit reference to the applicability of EU national laws implementing Directive 95/46/EC to the transfers of personal data by the EU to Russian authorities and to the processing of personal data by EU authorities. He also suggests including references to Articles 7 and 8 of the EU Charter of Fundamental Rights.

37. He also recommends specifying in Articles 3(2) and 4(1) and 5(3) all the categories of personal data that might be exchanged. Furthermore, additional safeguards, such as shorter retention periods and stricter security measures should be included in the agreement or in Annex II for data relating to suspect transactions. The other purposes for which the data could be processed according to Article 5(3) should be explicitly stated in the agreement and should be compatible with the original purpose for which the data were transferred.

38. The EDPS also welcomes the prohibition of keeping the data for longer than necessary in Article 5(2) of the agreement, but he recommends specifying at least maximum retention periods.

39. The EDPS welcomes the inclusion of mandatory data protection principles. However, he would recommend completing them as follows:  adding the provisions on "data security" and the specific requirements for processing "sensitive data";  specifying the procedures for making effective the principles of "transparency" and "rights of access, rectification, erasure and blocking of data" in the text of the agreement or in the Annex;  as regards “onward transfers”, it should be added that the competent authorities of the Parties should not transfer personal data to other national recipients unless the recipient provides adequate protection and for the purposes for which the data have been transmitted.  as regards the principle of "redress", it should be specified that the term “competent authorities”, used in the rest of the agreement in a different context, refers here to authorities competent for the protection of personal data and the supervision of their processing;  the relevant authorities and the practical information on existing remedies should be mentioned in the agreement or at least in letters exchanged between the parties or in documents accompanying the agreement;  as regards the principle on “exceptions to the rights of transparency and direct access”: it should be specified that, in cases where the right of access cannot be granted to data subjects, indirect access through EU national data protection authorities should be provided.

41. It should also be specified that the data protection supervisory authorities of the Parties should jointly review the implementation of the agreement, either in the framework of the joint follow-up expert group, or as a separate process. In addition, if the independence of the relevant Russian supervisory authority is not sufficiently established, it should be specified that EU national data protection authorities should be involved in the supervision of the implementation of the agreement by Russian authorities. The results of the review should be reported to the European Parliament and to the Council, where needed with full respect of confidentiality.

42. The EDPS also recommends completing Article 12 of the agreement with a clause allowing any Party to suspend or terminate the agreement in the event of a breach of the other Party's obligations under the agreement, including as regards compliance with the data protection principles. Done in Brussels, 23 April 2013 (signed) Giovanni BUTTARELLI Assistant European Data Protection Supervisor