Application of the law on customs and agricultural matters

Opinion of the European Data Protection Supervisor

on the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EC) No 515/97 of 13 March 1997 on mutual assistance between the administrative authorities of the Member States and cooperation between the latter and the Commission to ensure the correct application of the law on customs and agricultural matters

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, and in particular Article 28 (2) thereof,

Having regard to Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters,

HAS ADOPTED THE FOLLOWING OPINION:

1. INTRODUCTION 1.1. Consultation of the EDPS

1. On 25 November 2013, the Commission adopted a proposal for a Regulation of the European Parliament and of the Council amending Regulation (EC) No 515/97 of 13 March 1997 on mutual assistance between the administrative authorities of the Member States and cooperation between the latter and the Commission to ensure the correct application of the law on customs and agricultural matters, as amended by Regulation 766/2008 on 9 July 2008 . The Proposal was sent to the EDPS for consultation on 29 November 2013.

2. Before the adoption of the Proposal, the EDPS was given the possibility to provide informal comments to the Commission. Some of these comments have been taken into account. As a result, the data protection safeguards in the Proposal have been strengthened. 1.2. Background and objectives of the Proposal

3. The Proposal amends one of the most important legal instruments for action against breaches of customs legislation. The fight against breaches of Union customs legislation involves extensive exchanges of information - including personal data - in the context of cooperation between competent authorities in the Member States and between the latter and the Commission.

4. The Proposal´s stated aim is to render the enforcement and cooperation in this area of EU law more effective. In relation to the tracking of goods, it introduces new obligations for carriers to supply the Commission with information on container movements (the so-called Container Status Messages - 'CSM'); it also aims at streamlining the rules organizing the central database for import, export and transit data in order to improve the analysis of the flows of goods.

5. The Proposal also introduces the possibility for the Commission to obtain directly from private sector operators documents supporting import and export declarations, with the explicit purpose to speed up OLAF’s investigations.

6. The Proposal also has the stated aim to simplify and harmonise the data protection supervision rules applicable to the different databases set up on the basis of the Regulation. It introduces a maximum retention period for data 6 stored in the Customs Information System ('CIS') and in the other databases.

7. For the sake of clarity, the databases and directories covered by the Regulation are the following:  The 'European Data directory' - Article 18(a);  The 'CSM directory' - Articles 18(c), 18(d) and 18(e);  The 'Import, export and transit directory' - Article 18(g);  The CIS database - Articles 23 to 41;  The FIDE database - Articles 41(a) to 41(d).

2. COMMENTS 2.1. General comments a) Legal context

8. Presently, cooperation between competent authorities for enforcing EU customs legislation is based on two legal instruments: Regulation 515/97 and Council Decision 2009/917/JHA (hereinafter: 'the Decision'). This dual legal basis was needed because customs cooperation was governed, on the one hand, by the EC Treaty rules as regards the customs (former 'first pillar') aspects and, on the other hand, by the EU Treaty (notably, former Title VI of EU Treaty) rules on police and judicial cooperation in criminal matters in relation to the former 'third pillar' aspects.

9. As the entry into force of the Lisbon Treaty removed the pillar structure, currently the legal basis for both types of cooperation is to be found in the TFEU. The stated legal basis for the Proposal is Articles 33 and 325 TFEU . Although Council Decision 2009/917/JHA is still legally valid on the basis of transitory provisions , it should in any event be replaced by a legal instrument adopted through the ordinary legislative procedure under Article 87(2) TFEU.

10. The Proposal, however, does not modify the Decision nor does it foresee the intention to do so in the future. In the EDPS´ view, the Commission should have taken a more comprehensive approach to the legislation on mutual assistance in the customs area to bring it in line with the changes brought by the Lisbon Treaty. A framework encompassing all areas of cooperation would harmonize the mutual assistance rules and therefore improve legal certainty, and in particular it would allow the creation of a coherent and seamless data protection supervision system. Further changes to the supervision structure will be discussed in detail below.

11. The EDPS therefore regrets that the Commission missed the opportunity of proposing a comprehensive text to replace the previous two legal bases. b) Categories of data

12. The EDPS acknowledges that most of the data to be processed in the context of the Regulation relate to legal persons active in the international trade of goods. However, the Regulation itself expressly states that data of natural persons are processed (e.g., name, nationality, origin, birth date, sex and address of persons involved in movements of containers and means of 12 transport) . The personal information processed and further shared may include information relating to individuals' alleged or confirmed involvement in wrongdoing actions in the area of customs or agricultural operations. In addition, it should be highlighted that names of legal persons may also identify natural persons, as underlined by the Court of Justice . c) Applicability of data protection law

13. The EDPS welcomes the reference in recital 11 to the applicability of Regulation 45/2001 to the processing of personal data by Union institutions. However, for legal clarity and consistency, given that the Regulation also applies to processing of data by competent authorities in the Member States, a general provision in the text of the Proposal should be added in order to clarify that Regulation 45/2001 applies to processing of personal data carried out by Union institutions and that national laws implementing Directive 95/46/EC are applicable to the processing carried out by the relevant competent authorities in the various Member States. This general provision should be added all the more, since recital 10 specifically mentions Directive 95/46/EC alongside Regulation 45/2001 in relation to provisions introduced to ensure accuracy and transparency for data subjects. d) Supervision Shortcomings of the current data protection supervision system

14. The EDPS is concerned about the fact that the Proposal maintains the current dual data protection supervision system, based, respectively, on Article 37 of the Regulation (for the EDPS) and of Articles 24, 25 and 26 of the Decision (for the Joint Supervisory Authority). The unclear distinction of competences between the EDPS and the Joint Supervisory Authority (hereinafter 'JSA') is kept.

15. This dual supervision, as explained in point 1.3.5 of the Explanatory Memorandum, creates significant legal uncertainties, inefficiencies and generates additional costs. The EDPS shares this concern, which was already raised in the opinion he issued on the Initiative of the French Republic for a Council Decision on the use of information technology for customs 14 purposes .

16. In this respect, the Proposal only adds a new paragraph in Article 37, which states that the EDPS and the JSA shall co-ordinate with a view to ensuring coordinated supervision and audits of the CIS. Such a provision is not sufficient to address the inefficiencies highlighted in the Explanatory Memorandum, namely duplication of processes and lengthy procedures.

17. The EDPS considers that the most desirable solution to provide for a consistent and efficient supervision would be a uniform system, based on the model of coordinated supervision which has a three-layered structure: DPAs at national level, EDPS at central level and coordination between both. Such a structure is foreseen in several other Commission proposals . Efficient and independent supervision

18. In the EDPS' experience, effective supervision requires that a supervisory body can act quickly, and with a simple decision making structure. A body which consists of representatives of all Member States' data protection authorities - and which in practice would have to work on the basis of consensus - is not sufficiently effective.

19. When data are processed at EU level, the appropriate EU data protection authority should exercise the supervision. It follows that where the Commission is the controller, the EDPS should guarantee the supervision. The present system with a JSA has served its purpose for the 'intergovernmental' phase of customs cooperation, but is now no longer appropriate.

20. Such a choice would take into account the entry into force of the Lisbon Treaty and the abolition of the pillar structure. As mentioned above, the cooperation in the customs area involving detection, prevention and investigation of crimes is now one of the policies under the 'umbrella' of the TFEU, alongside customs cooperation and fraud combatting. Article 16 TFEU and Regulation 45/2001 apply to all these areas.

21. The EDPS has a strong experience in supervising OLAF´s activities in the 'first pillar' areas, and therefore also has the knowledge and capacity to deliver effective and independent supervision of all data processing taking place within its remit.

22. Furthermore, the EDPS embodies the criteria of independence of a data protection supervisory authority required by Article 16 TFEU and in the case law of the CJEU . The Court stressed that it is fundamental that the supervisory authorities have effective powers of investigation and of imposing sufficiently deterrent and remedial measures and sanctions. The JSA currently does not have these powers .

23. Certainly, when the processing takes place on the territory of a Member State, the relevant data protection authority of that Member State should be competent for supervising the processing. The role of the latter authority is indeed determinant and indispensable to assess whether data have been lawfully processed at national level. Since the Regulation leads to numerous exchanges of personal data between the national authorities involved and the Commission, cooperation between the EDPS and national supervisory authorities is also crucial.

24. The EDPS highlights the importance of providing for an appropriate structural involvement of the national data protection authorities. Consequently, national data protection authorities would be involved in the decision making process whenever specific issues arise which require a concrete assessment at national level. In this context, the EDPS has good experiences in cooperation, for instance relating to Eurodac, SIS II and VIS, through what is usually called 'coordinated supervision'.

25. In this perspective, the EDPS suggests envisaging the three-layered model for the supervision of all databases - which involve processing of personal data established on the basis of the Regulation and the Proposal (namely, CIS including FIDE -, the European Data directory, and the Import, export and transit directory) and would welcome that, in the future, the EDPS be designated as secretariat of supervision coordination under both the Decision and the Regulation . The shortcomings of the current Proposal

26. Notwithstanding the comments of general nature expressed in the paragraphs above, the newly introduced provisions based on the dual supervision model will be analysed below.

27. In an attempt to overcome the shortcomings of the current supervision system, the Proposal envisages clarifying the data protection law applicable to and the supervisory responsibilities related to the newly introduced directories and to CIS. The EDPS observes a certain inconsistency in the way the Proposal introduces new provisions referring to Regulation 45/2001 and to the EDPS´ role. More specifically: - Article 18(a)(5) - referring to the European Data directory - recalls that the EDPS should supervise the compliance of the database with Regulation 45/2001; - a similar provision has been inserted in Article 37(3)(a) as regards CIS. Furthermore, the modified Article 37(3)(a) establishes that the Regulation (notably, Regulation 515/97) 'particularises and complements' Regulation 45/2001; - as regards the Import, export and transit directory, Article 18(g)(4) states that Regulation 45/2001 applies to the processing by the Commission in the context of data included in the directory; that the Commission is the data controller and that the same directory is subject to prior-checking by the EDPS.

28. It seems clear that there is no consistency between the provisions related to the three directories.

29. Furthermore, the Proposal aims at allocating responsibilities also as regards the supervision and security of the technical aspects of the various databases. The Proposal introduces provisions regarding the security of technical systems: - for the European Data directory (Article 18(a)(5)); - in relation to the technical and logistical assistance and training activity and other support made available from the Commission to the Member States (Article 18(b)(3)); - for the Import, export and transit directory (Article 18(g)(5)); - and it also slightly modifies the provision on security in relation to the CIS database (Article 38).

30. The EDPS is pleased that the Proposal aims at specifying and updating the rules on supervision and security of the databases, however the legislative technique used is far from satisfactory.

31. Article 38 specifically lists the measures that the Commission and the Member States - within the areas of respective responsibility as regards CIS - shall take in order to ensure the technical security of the CIS database. In this respect, the EDPS recommends that the list of measures to be taken by the Commission and the Member States to ensure technical security should also include the requirement to record all actions taken on the data, the effect of the actions, at what time and by whom, in order to obtain a comprehensive log of actions taken in relation to the database.

32. Article 18(a)(5) does not specifically indicate the measures that should be taken in order to protect the personal data in the European Data Directory: the provision mostly replicates the content of Article 22 of Regulation 45/2001. The EDPS questions this choice, as such a generic provision does not add any element to the text, precisely because Article 22 is already per se applicable to the database. In this context, it would be necessary to list in the article the specific measures that should be put in place, taking into account the types of personal data that are supposed to be processed in the database, the structure of the database, the type of entities or persons having access to it. Simply restating the text of Regulation 45/2001 is not sufficient to ensure effective application of such provision. The same criticism applies to Article 18(g)(5).

33. Article 18(b)(2) generally requires the Commission to set up technical systems for the purpose of training and assistance between the Commission and the competent authorities. Using a different approach from the provisions mentioned above, Article 18(b)(3) states that the systems established by the Commission for this purpose are to be supervised by the EDPS.

34. Such a fragmented approach could lead to confused interpretation according to which different sets of data protection rules apply to the different databases, and the mistaken conclusion that the Commission is the data controller only in one case and a contrario not for other databases established by the Regulation. It is therefore crucial to clearly identify the relevant data protection legislation applicable to each area; to specify the provisions of Regulation 45/2001, where necessary, while at the same time avoiding redundant repetitions of provisions already applicable per se.

35. If the management or hosting of the different databases (and technical systems, such as the one set up on the basis of Article 18(b)) involves processing of personal data by the Commission in the exercise of its activities falling within Union law, then as a legal consequence Regulation 45/2001 will apply to these processing activities.

36. Consequently, the applicability of Regulation 45/2001 implies: - supervision - both in general and in relation to the technical aspects - by the EDPS; - the Commission is the data controller so long as it determines the means and purposes of the processing operations; - the possible requirement to notify certain processing activities for prior checking by the EDPS pursuant to Article 27 of Regulation 45/2001.

37. The EDPS therefore suggests substituting the various fragmented provisions with uniform provisions specifying for each database: (i) the role of the Commission as data controller or possibly joint data controller together with the relevant national competent authorities; (ii) if needed for the sake of clarity, the supervisory role of the EDPS where the Commission is the controller, as opposed to cases where the processing is under the supervision of national data protection authorities; (iii) the technical measures to be adopted by the Commission in order to ensure security of the processing (possibly, the specific measures could be inserted in a delegated act in order to ensure a more flexible updating); and (iv) the need for prior checking by the EDPS pursuant to Article 27 of Regulation 45/2001. e) Transfers of data

38. The Proposal includes two provisions stating that, without prejudice to Regulation 45/2001, transfers of data from the European Data directory (Article 18(a)(6)) and from the Import, export and transit directory (Article 18(g)(3)) to international organisations and/or EU institutions or agencies are possible. The EDPS welcomes the fact that the Proposal imposes as a condition for the transfer the conclusion of a memorandum of understanding ('MoU') between the Commission and the relevant recipient. Such MoUs shall include also data protection safeguards such as access and rectification rights of the data subject, right to judicial redress as well as an independent oversight mechanism.

39. The EDPS highlights that transfers of data within or between EU institutions or bodies should meet the requirements of Article 7 of Regulation 45/2001, whereas MoUs could be considered as an adequate safeguard for transfers to international organisations pursuant to Article 9 of Regulation 45/2001. Therefore, the text of the Proposal should, for the sake of clarity, distinguish the legal provisions applicable to these two categories of recipients and the different requirements applicable to the relevant transfers.

40. The two Articles also identify the purposes for the possible transfers: they can be either the general purpose of the Regulation (tackling breaches of customs legislation), the protection of financial interest of the Union and/or the risk management as set out in the Community Customs Code. The latter purpose raises concerns as it includes also risks related to the 'Community´s security'. This requires stronger data protection safeguards as it could imply that the data are used for law enforcement purposes (see below, section 2.1.g)

41. The EDPS would therefore invite the legislator to insert - in an Annex, for instance - an exhaustive list of international organisations which could be recipients of the data. The Annex should be regularly updated and published in order to guarantee a more transparent and efficient supervision of the compatibility of the transfers with the purpose limitation principles by the EDPS. Alternatively, the list could be inserted in an implementing act. f) Data retention

42. The Proposal introduces new rules on maximum data retention periods for CIS (Article 33), FIDE (Article 41(d)), the European Data directory (Article 18(a)(6)) and for the Import, export and transit directory (Article 18(g)(4)).

43. Article 33, while maintaining the obligation to keep data only for the time necessary to achieve the purpose for which they were introduced, introduces a maximum 'blanket' 10 year retention period, thereby eliminating the review procedure that was previously envisaged by the Regulation. The precedent provision required that the need for retention was to be reviewed annually by the national authority competent for introducing the data in the database.

44. The Proposal introduces the 10 years 'blanket' retention period also for the European Data directory (Article 18(a)(6)) and the Import, export and transit directory (Article 18(g)(4)).

45. According to recital 13, this modification is necessary 'because Member States do not systematically carry out the yearly reviews due to the administrative burden involved'. In order to simplify the procedure, the Proposal sets a 'maximum retention period of ten years, corresponding to periods provided for the directories established on the basis of this Regulation.' This period is considered necessary 'due to the long procedures for processing irregularities and because these data are needed for the conduct of joint customs operations and of investigations'.

46. The justification for this extensive retention however has not been concretely demonstrated and there is no trace of evaluation of its impacts on fundamental rights in the Impact Assessment or Explanatory Memorandum.

47. The newly introduced obligation to 'inform' the EDPS about cases where personal data are stored in the CIS (and in the other two directories) for a period exceeding five years cannot be considered as a satisfactory data protection safeguard, also since the need for retention of personal data for five years is not justified.

48. Furthermore, recital 13 explains that the maximum retention period of 10 years is aimed at synchronizing the rules governing the storage with periods provided for the directories established by the Regulation. The EDPS understands that, in practice, the provision refers to the 'FIDE' data base. However, FIDE is a sub-category of CIS including specific data on ongoing administrative enquiries and criminal investigations, aimed at accelerating detection and prosecution of illegal customs operation. On the other hand, other data contained in CIS, in the European Data directory and in the Import, export and transit directory are more general in nature and the databases are used as a tool for ongoing cooperation and investigations between the authorities or for analytical purposes.

49. Article 41(d)(1) justifies the retention periods for FIDE by referring to the national legislation and 'procedures' on retention periods of Member States, limiting the maximal retention period to 3 or 6 or 10 years pursuant to paragraph 1(a), 1(b) and (c). The 10 years retention period is applicable only for data concerning 'administrative enquiries or criminal investigations which have given rise to an administrative decision, a conviction or an order to pay a criminal fine or an administrative penalty', which is data related to an actual conviction.

50. There is no substantial connection between the 10 years data retention justification given for FIDE that could apply to CIS data, since the personal data contained in CIS (listed in Article 24 and 25 of the Regulation) are used for 'the purpose of sighting and reporting, discreet surveillance or specific checks' (Article 27(1) of the Regulation), hence investigative activities on cases that could lead or not lead to a conviction. The same criticism applies to the retention period applicable to the European Data directory and the Import, Export and transit directory, which are used as operational tools to follow and verify the movements of goods and the correspondence between declarations by the operators and movements of the containers.

51. The EDPS highlights that justifying the introduction of an extensive ten year retention period for personal data in a database only on the basis of 'coherence' with the retention rule elaborated for another database with different aims and requirements is contrary to the principles of data quality enshrined in Article 4 of Regulation 45/2001 and consequently not acceptable.

52. Therefore, since neither the Proposal nor the Impact Assessment provide any concrete justification as to the reasons for which these periods of retention are necessary, the provisions as such are not compliant with Regulation 45/2001 as regards the cases where the Commission is the controller - or Directive 95/46/EC - as regards the cases where the national competent authorities are the controllers.

53. The EDPS highlights that the justification of the need for retention periods for the different databases and directories must encompass a detailed evaluation of the duration in relation to the purpose of the retention for each specific case. The Proposal is lacking such analysis: the legislator should reconsider the justification for the newly introduced retention periods and carry out an evaluation of the relevant justification for each specific case.

54. Furthermore, the Proposal does not provide any justification as to why personal data should be anonymised instead of deleted after the maximum retention periods elapsed, as provided for by the modified Article 41(d)(3). Once the retention period expires, in the EDPS´ view data should be simply deleted. The EDPS highlights that the concept of anonymisation in the area of data protection corresponds to eliminating not only the direct identifiers but also indirect elements that, if combined, could lead to a re-identification .

55. Therefore, in order for the anonymisation process to be equivalent to deletion, the Proposal should provide more specific indications on how this procedure should be carried out, possibly in a way which respects technological neutrality in order to avoid the text becoming rapidly obsolete. Given the difficulties that this possible formulation could lead to, the EDPS strongly favours the solution according to which data should simply be deleted after the expiry of the retention phase. g) Purpose of the processing

56. While the main purpose of the Regulation and the Proposal is to address breaches of the legislation on customs and agricultural matters, the directories established by Article 18(a) of the Regulation and new Article 18(g) introduced by the Proposal will be used also for risk management purposes. The relevant risks are listed in Article 4(25) of the Community Customs Code , and are not only limited to risks relating to breaches of the legislation on customs and agricultural matters, but also include, e.g., events which 'pose a threat to the Community's security' .

57. If the need to process personal data for risk analysis regarding each of the risks listed in Article 4(25) is justified, the Proposal should provide more details on risk management procedures, further define the relevant risks, in particular by specifying which kind of risks that 'pose a threat to Community security' will be covered, and specify the criteria on which the risk analysis will be based. This would contribute to ensure the precision, accessibility and foreseeability required by the ECtHR .

58. In addition, Article 18(a)(2)(a) as modified by the Proposal provides for the 'reuse' of the data by the Commission for the purpose of administrative or judicial procedures in compliance with legislation applicable to intellectual property.

59. In order to ensure compliance with Article 4(1)(b) of Regulation 45/2001, the EDPS recommends clarifying for which specific purposes relating to administrative or judicial procedures the data can be 'reused'. The Proposal should also specify how this additional processing will take place and to which authorities the data can be possibly transferred.

60. It should also be ensured that no decisions are taken without human intervention and that data subjects are provided with the rights of access and rectification with regards to the data processed for this purpose. 2.2. Specific comments a) The 'Import, export and transit' and the 'European Data' directories

61. The EDPS welcomes the provision of Article 18(g)(3) which restricts within the Commission the departments empowered to process personal data contained in the 'Import, export and transit' directory. This is in line with Article 22 of Regulation (EC) No 45/2001 which requires data controllers, inter alia, to implement technical and organisational measures, such as ensuring that information is available on a ‘need to know’ basis, to ensure an appropriate level of security of the data. Such provision is also coherent with Article 18(a)(4) which applies the same 'need-to-know' principle to the general directory established in Article 18(a).

62. Also the new formulation of Article 29 is to be welcomed for the same reasons: it establishes that access to the CIS data is to be restricted to the national authorities designated by the Member States and by the departments designated by the Commission. Paragraph 2 of the same article also establishes rules on designation and publication of the list of competent national authorities. These rules implement de facto the principle of transparency which is a fundamental pre-requisite for data subjects to exercise the rights bestowed upon them by Regulation 45/2001 and by Directive 95/46/EC.

63. The EDPS welcomes the introduction of Article 18(g)(5) in that it excludes that special categories of data within the meaning of Article 10(5) of Regulation 45/2001 are included in the database. b) CSM directory

64. Article 18(c) introduces the so-called CSM directory. It contains information on the movement of containers into or from the EU territory. The aim of this novelty is to reach a more efficient tackling of breaches of customs legislation by comparing the data on the movement of containers with data on imports and exports and transits submitted to the Commission (through the so-called 'Import, export and transit' directory). Although the Explanatory Memorandum states that the CSM directory shall not include personal data, the text of the Proposal does not mention which categories of data are to be inserted in this database.

65. Article 18(f) provides that 'the minimum data elements' to be inserted in the Container Status Messages are to be laid down in a delegated act. The EDPS notes that the categories of data processed in the CSM directory are an essential element of the Proposal and therefore cannot be left to a delegated act. The text should indicate an exhaustive (not a minimum data set) list of data to be inserted. Alternatively, the text of the Proposal should explicitly prohibit that personal data are to be inserted in such database.

3. CONCLUSIONS

66. The EDPS welcomes the modifications that the Commission brought to the Proposal in order to enhance its compliance with the relevant data protection legislation. However, it should be noted that the Proposal also contains some rather serious weaknesses that need to be eliminated before its final adoption.

67. The EDPS wishes to highlight that the Commission should have taken a more comprehensive approach to the legislation on mutual assistance in the customs area to bring it in line with the changes brought by the Lisbon Treaty, namely by deciding to eliminate the Regulation/Decision dual basis and to substitute it with a single instrument based exclusively on the TFEU, in order to guarantee legal certainty and a seamless data protection regime.

68. For the reasons set out above, the EDPS would in any case recommend:  the introduction of a new model for the supervision of all databases which involve processing of personal data established on the basis of the Regulation and the Proposal (namely, CIS - including FIDE -, the European Data directory, and the Import, export and transit directory). Such model would be based on coordinated supervision which has a threelayered structure: DPAs at national level, EDPS at central level and coordination between both;  the designation of the EDPS as secretariat of supervision coordination under both the Decision and the Regulation;  the introduction of a general provision in the text of the Proposal to clarify that Regulation 45/2001 applies to processing of personal data carried out by Union institutions and that national laws implementing Directive 95/46/EC are applicable to the processing carried out by the relevant competent authorities in the various Member States;  the substitution of various fragmented provisions with uniform provisions specifying for each database (i) the role of the Commission as data controller or possibly joint data controller together with the relevant national competent authorities; (ii) if needed for the sake of clarity, the supervisory role of the EDPS where the Commission is the controller, as opposed to cases where the processing is under the supervision of national data protection authorities; (iii) the technical measures to be adopted by the Commission in order to ensure security of the processing (possibly, the specific measures could be inserted in a delegated act in order to ensure a more flexible updating); and (iv) the need for prior checking by the EDPS pursuant to Article 27 of Regulation 45/2001;  that the newly introduced retention periods are reconsidered on the basis of an evaluation of the necessity of the duration for each specific case; furthermore the provisions on anonymisation of data should be modified in order to require deletion of the data;  as regards the CSM database, the Proposal should indicate an exhaustive list of data to be inserted. Alternatively, the text of the Proposal should explicitly prohibit that personal data are to be inserted in such database. Done in Brussels, 11 March 2014 (signed) Peter HUSTINX European Data Protection Supervisor