Market surveillance

Opinion of the European Data Protection Supervisor on the Commission Proposal for a Regulation of the European Parliament and the Council on market surveillance of products and amending various legislative instruments of the European Parliament and of the Council

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, and in particular Article 28 (2) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. INTRODUCTION

1. On 13 February 2013, the Commission adopted its Product Safety and Market Surveillance Package, including a proposal for a Regulation of the European Parliament and of the Council on market surveillance of products and amending Council Directives 89/686/EEC and 93/15/EEC, and Directives 94/9/EC, 94/25/EC, 95/16/EC, 97/23/EC, 1999/5/EC, 2000/9/EC, 2000/14/EC, 2001/95/EC, 2004/108/EC, 2006/42/EC, 2006/95/EC, 2007/23/EC, 2008/57/EC, 2009/48/EC, 2009/105/EC, 2009/142/EC, 2011/65/EU, Regulation (EU) No 305/2011, Regulation (EC) No 764/2008 and Regulation (EC) No 765/2008 of the European Parliament and of the Council (hereinafter: 'the Proposal'). On the same day, the Proposal was sent to the EDPS for consultation. 1.1. Consultation of the EDPS

2. Before the adoption of the Proposal, the EDPS was given the opportunity to provide informal comments. The EDPS welcomes the reference to the present consultation in the preamble of the Proposal.

3. In the present Opinion, the EDPS wishes to highlight those elements of the Proposal which have personal data processing implications and to reiterate some of his earlier comments which, if taken on board, would further improve the text from a data protection perspective. 1.2. General background

4. The Proposal is part of the “Product Safety and Market Surveillance Package” which also includes a proposal for a Regulation on consumer product safety (replacing the General Product Safety Directive 2001/95/EC, the ‘GPSD’) and a multi-annual action plan for market surveillance covering the period 2013-2015. The overall objective is to clarify the regulatory framework for market surveillance in the field of non-food products (both for harmonised and nonharmonised products, whether intended for consumers or for professionals) and consolidate it in a single instrument. To this end, the Proposal merges the rules on market surveillance of the GPSD, Regulation (EC) No 765/2008 and several sector-specific instruments of EU harmonisation legislation.

5. In particular, the provisions regarding the functioning of the EU Rapid Information System (RAPEX) that are currently contained in the GPSD have been transferred to the Proposal, according to which RAPEX would become the single alert system regarding products presenting a risk to EU consumers.

6. The Proposal will also formally establish the Information and Communication System for Market Surveillance (ICSMS) which will serve as a database of market surveillance information as well as a communication channel for market surveillance authorities.

2. ANALYSIS OF THE PROPOSAL 2.1. General comments

7. At first sight, the Proposal does not deal with the processing of personal data, as understood under EU law as any information related to an identified or identifiable individual, i.e. a natural person . It focuses instead on the measures to be taken in order to recognise unsafe or otherwise harmful products and keep or take them off the market (and punish the responsible market operators), including the use of RAPEX, ICSMS and the publication of certain information. Nevertheless, since the Proposal may require the processing of personal data there is a personal data protection component.

8. Whenever the exchange of information through RAPEX or ICSMS involves the processing of personal data –as explained below- national rules transposing Directive 95/46/EC on the one hand, and Regulation (EC) No 45/2001 on the other hand become applicable, with specific consequences. The EDPS therefore welcomes the reference in recital 30 to the EU data protection legislation in force, i.e. (national rules implementing) Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (although the precise drafting of that recital could be improved, as set out below). 2.2. Specific comments Personal data processing in the context of market surveillance

9. In order for market surveillance to be effective in the single EU market, information about unsafe products must be exchanged among competent authorities of the Member States and between the Member States and the Commission. According to Articles 19 and 20 of the Proposal, the EU rapid information system RAPEX (which is used for such purposes today) will continue to be used for alert notifications relating to products presenting a risk. In addition, a clear legal basis (Article 21) is provided for the functioning of the information and communication system for market surveillance ICSMS which will store information related to market surveillance and serve as a communication channel for market surveillance authorities.

10. Pursuant to Article 20(2) of the Proposal, information provided through RAPEX must include inter alia: (i) the data necessary to identify the product’, and (ii) 'the origin and the supply chain of the product’.

11. The information is to be transmitted using a ‘standard notification form made available by the Commission in the RAPEX system’. While this standard form is not part of the Proposal, the RAPEX operational guidelines provide useful insights into the precise contents of a typical notification, which includes inter alia contact details of the manufacturer or his representative, as well as those of the exporter(s), importer(s), distributor(s) and/or retailer(s) of the product in question.

12. Pursuant to Article 3 of the Proposal, ‘manufacturer’, ‘authorised representative’, ‘importer’, and ‘distributor’ (collectively, the ‘economic operators’) can be either legal or natural persons. The EDPS wishes to reiterate that where contact details of natural persons (i.e. personal data) are processed in RAPEX, such processing will trigger the application of national rules transposing Directive 95/46/EC (at Member State level) and of Regulation (EC) No 45/2001 (with respect to the Commission). This will also be the case where personal data of natural persons connected to economic operators (e.g. contact details of a legal representative or of an employee) are processed or if the official title of the legal person identifies one or more natural persons .

13. Given that these data protection-related aspects of market surveillance are not necessarily self-evident, the EDPS recommends clarifying that the proposal is not meant to provide for general derogations from data protection principles and that relevant personal data processing legislation remains fully applicable in the market surveillance context. This should be done in a substantive provision in the operative part of the text, possibly supplemented by a dedicated recital.

14. In this context, the EDPS considers unfortunate that recital 30 as proposed by the Commission may appear (in particular to the non-expert) to reduce personal data to only one of the elements of the necessary balance to be struck between transparency and the need to maintain confidentiality of certain information (e.g. commercial secrets). In fact, the need to respect confidentiality of information exchanged (whether or not such information includes personal data) or to balance confidentiality and the need for transparency and legal obligations to grant access to certain documents are separate issues, that are not equivalent to personal data protection. The EDPS wishes to stress that the data protection principles encompass a far broader range of issues than confidential handling of personal data, such as inter alia the requirement to process data fairly and lawfully, for specific purpose(s), while ensuring their quality and allowing the individuals concerned to exercise their rights . He recommends redrafting recital 30 so as to make it clear that data protection implications of the proposal are not limited to the issue of a balance between confidentiality and transparency.

15. Similar issues are likely to arise in connection with ICSMS. The ICSMS will contain ‘a record of references’ to the notifications made under RAPEX in accordance with Article 20, but also information about ‘complaints or reports about issues relating to risks arising from products’ which at first sight seem likely to contain at least contact details of either the complainants or the economic operators concerned. In addition, pursuant to Article 21(2), Member States will be under obligation to register in the ICSMS ‘any information at their disposal […] about products presenting a risk regarding, in particular […] contacts with economic operators concerned’.

16. The EDPS draws attention to the fact that, whenever personal data are processed in the context of market surveillance, whether in RAPEX, the ICSMS or by any other means on the basis of the Proposal, data protection legislation in force will become applicable. Practical consequences of this will include, for example, the requirement that the personal information is relevant and not excessive in relation to the market surveillance purposes .

17. Consequently, the Proposal should ensure that only personal information which is strictly necessary is processed for market surveillance purposes, in accordance with the principles of proportionality and data minimisation. With respect to RAPEX, this is currently achieved in practice by means of a standard notification form annexed to the RAPEX Guidelines adopted by the Commission. However, in the interest of legal certainty, an addition to that effect should be included in Article 19. Moreover, since no rules of this kind appear to exist at this time for ICSMS, the EDPS recommends that it is specified in more detail in Article 21 what types of personal information may be processed in ICSMS (e.g. the name and contact details of the economic operator(s) and/or the person(s) filing a complaint, and/or the victim(s) of an unsafe product).

18. As an example, pursuant to Article 21(1)(d), ICSMS shall store information about complaints or reports about issues relating to risks arising from products. Such complaints are likely to include personal information of the complainant. However, it is not immediately clear whether and to what extent the processing of such personal data can be justified on market surveillance grounds. The EDPS recommends that Article 21 be amended in order to clarify what types of personal data may be processed in ICSMS for which specific purposes. Retention periods

19. One of the fundamental principles of data protection requires that personal data is not kept (in a form which permits identification of the individual concerned) for longer than necessary for the purpose(s) of the processing . In practice, this means that in most situations a fixed retention period is determined, following the expiry of which the personal data is deleted.

20. The EDPS notes that the Proposal does not contain any provisions which would limit in time the storage of personal data in RAPEX or the ICSMS. However, according to section 3.8 of the RAPEX operational guidelines, notifications distributed through the application are kept in the system for an unlimited period of time. The EDPS draws attention to the fact that, while an unlimited retention period may be justifiable in case of information about products, it would be difficult to justify it with respect to personal data (even if such personal data are only ancillary to the product information). He therefore recommends that fixed retention periods for the personal data processed in RAPEX and ICSMS are provided for in the proposed Regulation. Publication of information

21. Article 10(6) of the Proposal provides for publication of information about unsafe products and measures taken in respect of them ‘to the fullest extent necessary to protect the interests of users of products in the Union’. The Proposal further states that, ‘[t]his information shall not be published where it is imperative to observe confidentiality in order to […] preserve personal data pursuant to national and Union legislation […]’.

22. The EDPS notes that the Proposal does not state explicitly that such publication could include personal data. However, published information concerning measures taken in respect of unsafe products is likely to include personal information of the economic operator(s) concerned. This seems also implicit in the provision quoted above which appears to exclude publication of any information about a given case where such publication would imply the publication of personal data.

23. In this respect, the EDPS wishes to underline that the objective of informing the public about unsafe products subject to measures taken by market surveillance authorities may be achieved without necessarily rendering personal information of economic operator(s) responsible for those products public. Indeed, this appears to be how information is published on the RAPEX website today . The EDPS recommends that the same approach is adopted for any publication of information by market surveillance authorities in the context of the Proposal.

24. On the other hand, if it is the intention of the legislator to provide for the publication of personal information of economic operators, for example as a sanction in cases of repeated breaches or an additional deterrent for unscrupulous operators, the EDPS recommends including explicit provisions to that effect in the Proposal. As a minimum, a substantive provision should clarify what kind of personal data may be made public and for what purpose(s). In this context, attention is drawn to the Schecke judgment in which the Court of Justice underlined that, in order to strike a proper balance between the various interests involved, the EU institutions must take into consideration methods of publishing information which would be consistent with the objective of such publication while at the same time causing less interference with an individual’s right to respect for their private life and to protection of their personal data . International transfers of data Finally, the EDPS notes that, insofar personal data of economic operators that are natural persons are processed in the context of market surveillance, certain elements of the Proposal would imply transfers of such data to third countries. For instance, pursuant to Article 19(4), participation in RAPEX shall be open to applicant countries, third countries and international organisations. Under EU data protection law, transferring of personal data to a third (i.e. non-EU/EEA) country is, in principle, only allowed on the condition that adequate level of protection is 18 19 ensured . A limited number of countries is currently considered to offer such adequate level of protection. However, transfers to other destinations may only take place under strict conditions.

25. With this specific legal context in mind, the EDPS suggests clarifying that any agreements between the EU and those countries/organisations should not only include provisions on confidentiality, but also specific provisions about personal data protection corresponding to those applicable in the Union, as required by Article 25 of Directive 95/46/EC and Article 9 of Regulation (EC) No 45/2001.

26. Moreover, Article 22 of the Proposal would allow the Commission and the Member States to exchange information shared through RAPEX with regulatory authorities of third countries or international organisations with which ‘confidentiality arrangements based on reciprocity’ have been concluded. The EDPS wishes to underline that whenever such information exchange would include personal data, rules on international data transfers set out in Directive 95/46/EC and Regulation (EC) No 45/2001 become fully applicable. He therefore recommends including the explicit reference to data protection suggested in the preceding paragraph also in Article 22.

27. It is the EDPS’ understanding that the Proposal does not provide for any cooperation with applicant countries, third countries or international organisations regarding information processing in ICSMS pursuant to Article 21. Nevertheless, he notes that, should cooperation of this kind be considered, a similar clause referring to data protection should be included in Article 21.

3. CONCLUSIONS

28. The EDPS appreciates that data protection issues have been taken into account in the Proposal to a certain extent. However, in the present Opinion he gives some recommendations on how the Proposal could be further improved from a data protection perspective.

29. In particular, the EDPS recommends:  including a substantive provision to clarify that the Proposal is not meant to provide for general derogations from data protection principles and that relevant personal data processing legislation (i.e. national rules implementing Directive 95/46/EC and Regulation (EC) No 45/2001) remain fully applicable in the market surveillance context. In addition, recital 30 would benefit from some redrafting;  amending Articles 19 and 21 of the Proposal so as to ensure that only personal information which is strictly necessary is processed for market surveillance purposes in RAPEX and ICSMS, respectively, in accordance with the principles of proportionality and data minimisation;  providing in the proposed Regulation (e.g. in Articles 19 and 21) for fixed retention periods for the personal data processed in RAPEX and ICSMS, keeping in mind that an unlimited retention period for personal data would be difficult to justify under EU data protection law (even though it may be justifiable in case of information about products);  maintaining the approach by which the public is informed about unsafe products (via the RAPEX website) without rendering personal information of economic operator(s) responsible for those products public, and applying a similar approach in all instances where information is published by market surveillance authorities in the context of the Proposal;  should it be the intention of the legislator to provide for the publication of personal information of economic operators (for example as a sanction in cases of repeated breaches or an additional deterrent), including explicit substantive provisions that would at least specify what kind of personal data may be made public and for what purpose(s). In this context, attention is drawn to the need to consider modalities of publication which would cause less interference with an individual’s right to respect for their private life and to protection of their personal data, in line with the Schecke judgment of the Court of Justice;  supplementing the provisions on participation of applicant countries, third countries or international organisations in RAPEX (Article 19(4)), as well as on international exchange of confidential information (Article 22) with explicit references to specific provisions about personal data protection corresponding to those applicable in the Union, as required by Article 25 of Directive 95/46/EC and Article 9 of Regulation (EC) No 45/2001. Done in Brussels, 30 May 2013 (signed) Giovanni BUTTARELLI European Data Protection Assistant Supervisor