European e-Justice Portal

Opinion of the European Data Protection Supervisor

on the Commission Decision on the protection of personal data in the European e- Justice Portal

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of 2 such data, and in particular Article 41(2) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. INTRODUCTION 1.1. Consultation of the EDPS

1. On 5 June 2014, the Commission adopted a Commission Decision on the protection of 3 personal data in the European e-Justice Portal ('the Decision').

2. We welcome the fact that we were consulted on this Decision prior to its adoption and that we were given the possibility to provide informal comments to the Commission. The Commission took into account several of these comments. As a result, the data protection safeguards in the Decision have been strengthened. We also welcome the reference in the preamble to the consultation of the EDPS. 1.2. Context, objective and scope of the Decision

3. As explained in recitals 1-3 of the Decision, in its communication of May 2008 , the Commission stated that it would design and set up the European e-Justice Portal ('Portal'), to be managed in close cooperation with the Member States. The Portal was launched on 16 July 2010 and is now ready for the first interconnection of national registers involving the processing of personal data. The Portal's objective is to contribute to the achievement of the European judicial area by facilitating and enhancing access to justice and leveraging information and communication technologies to facilitate cross-border electronic judicial proceedings and judicial cooperation.

4. Recitals 4-5 of the Decision highlight the importance of data protection and provide that since the various Portal-related tasks and functions of the Commission and the Member States will entail different responsibilities and obligations as regards data protection, it is essential to delimit them clearly. Accordingly, the Decision aims at providing more clarity and legal certainty with regard to the responsibilities of the Commission as a controller in connection with its activities relating to the operation of the Portal.

2. ANALYSIS OF THE DECISION 2.1. Introduction and general comments

5. Article 1 of the Decision (under the heading 'Subject matter') provides that the 'Decision lays down the functions and responsibilities of the European Commission in relation to data protection requirements whilst processing personal data in the European e-Justice Portal'.

6. We welcome the fact that the Commission adopted the Decision with the aim to provide clarifications regarding the roles and responsibilities of the Commission with respect to the processing of personal data through the e-Justice Portal.

7. As a general comment, we highlight the importance of ultimately adopting a new legal instrument (the future Regulation on e-Justice) under the ordinary legislative procedure, in order to establish a comprehensive legal basis and provide more transparency, specificity and legal certainty with regard to the processing of personal data through the Portal and the data protection safeguards that apply under Regulation 45/2001, Directive 95/46/EC and national data protection law.

8. A clear legal basis is especially important as the Portal is an ambitious project that already facilitates the processing of large amounts of personal data and will only grow in volume and complexity over time.

9. We highlighted the need for such a legal basis in previous communications with the Commission services, and also in our Opinion of 27 March 2013 on the Commission proposal for a Regulation amending Council Regulation (EC) No 1346/2000 on insolvency proceedings.

10. The adoption of the Decision is a significant and welcome step towards transparency, legal certainty, and specific safeguards to protect the personal data processed via the Portal. We certainly understand the Commission's preference for a step-by-step approach and also acknowledge that in some areas separate legal bases are already in place or are currently in the legislative process (e.g. insolvency, ECRIS and business registers).

11. We understand that the work on the development of a draft Regulation on e-Justice has already started. We encourage the Commission to increase its efforts for a swift adoption of the future Regulation on e-Justice. The following specific comments, while directly reflecting on the text of the Decision itself, are primarily aimed at providing preliminary guidance with regard to drafting the future e-Justice Regulation. 2.2. Specific comments 2.2.1. Scope of the e-Justice Portal

12. Article 3 of the Commission Decision (under the heading 'Data processing') provides that the 'Commission shall process personal data in the Portal only in so far this is necessary for the purposes of: (a) providing access to interconnected national databases holding personal data; (b) providing interactive services allowing registered users to communicate directly with the appropriate authorities in another Member State; (c) providing access to public information targeted towards registered users;(d) providing contact information'.

13. Pursuant to the e-Justice Communication of 30 May 2008, examples of what the e- Justice Portal may be used for include interconnection of national criminal records, inter-connection of insolvency registers, business registers, land registers, and others.

14. To help ensure legal certainty, the future Regulation on e-Justice should more clearly specify the current and possible future scope of the e-Justice Portal. This could include a list of the various interconnected national databases and inter-active services (now only generally referred to in Article 2(c) and in Article 3 of the Decision), to be updated where necessary. A similar technique has already been used, for example, in connection with defining the scope of the Internal Market Information System in the IMI Regulation (Regulation (EU) No 1024/2012). 2.2.2. Legal grounds for the processing of data in the e-Justice Portal

15. The Decision is silent on the legal basis for the processing of personal data via the Portal. Here it is useful to point out that the Commission Decision in itself does not provide a sufficient legal ground for the processing of personal data via the e-Justice Portal.

16. As the Article 29 Data Protection Working Party provided in its Opinion on legitimate interest 'sufficiently detailed and specific authorisation by law is ... required ... in case the processing by public authorities interferes with the privacy of the data subjects'.

17. This 'sufficiently detailed and specific authorization by law' can, of course, be given in separate legislation, for example, for each interconnected system, such as, in the legislation that provides a legal basis for the interconnection of the insolvency registers or the interconnection of criminal records. In addition, it is also possible that the future e-Justice Regulation may itself provide a legal basis for some types of processing operations. 2.2.3. Responsibilities of the Commission as a controller within the Portal as referred to in this Article'.

19. We welcome this statement and the clarifications of the role of the Commission in the remainder of Article 4. Further, we also welcome the fact that Article 5(2) imposes additional requirements on the Commission to provide information to data subjects, including 'on whom to contact for the effective exercise of their rights to information, to access, to rectify and to object according to applicable data protection legislation'.

20. We also welcome the efforts of the Commission in Article 4(6) and 4(7) to make it clear for which aspects of the operation of the e-Justice Portal it is not responsible for.

21. At the same time, we would welcome further clarifications on who bears responsibility and needs to take action if something goes wrong, legally, technically, or otherwise, with the operation of the Portal or the operation of one or another of the interconnected public registers.

22. These specifications can also be made in separate legislation, for each interconnected system, such as, for example, in the legislation that provides a legal basis for the interconnection of the insolvency registers. In the long term, a more horizontal approach, with general rules in the future e-Justice Regulation and, as needed, specific rules in specific thematic legislation if needed could perhaps be most workable.

23. These provisions could specify, for example:  who is responsible for erroneous machine translations or any errors arising out of the pre-determined text and terminology used across linguistic/legal differences ;  who is responsible for eventual design faults of the portal, or any interfaces with national systems.

24. With regard to security of the personal data, we welcome the fact that Article 4(5) requires the Commission to implement the necessary technical measures not only with regard to the data while 'in transit' but also 'during their display on the Portal'. Indeed, the Commission has responsibility for security of data processing in all cases when personal data are in the Commission's control.

25. In this respect, we also note that while Article 3 mentions different types of processing that may happen via the Portal, Article 4 appears to focus almost exclusively on the interconnection of national databases. Less attention is paid to other important potential data processing activities such as the 'interactive services allowing users to communicate directly with appropriate authorities in another Member States'. Dealing with these types of processing activities should also be addressed in the future e-Justice Regulation.

26. Finally, we would also recommend that a governance system will be put in place for the e-Justice Portal to ensure that:  each party involved in the operation and design of the portal and the inter-connected national databases clearly understands its respective tasks and responsibilities;  proactive measures are taken to implement the data protection by design principle;  swift and efficient measures are taken in case anything goes wrong, and  any decisions taken by the Member States to make data available through the e- Justice Portal from their national databases can be better considered at an early stage.

27. These requirements should also be clearly reflected in the future e-Justice Regulation. 2.2.4. Purpose limitation

28. With the interconnection of various databases concerns invariably arise as to what extent information gathered for one purpose can be used for another purpose, and to what degree, personal data can be combined.

29. Recital 11 of the Decision specifies in this respect that 'it should not be possible to combine information from different interconnected national databases for different purposes through the Portal'. We welcome that the issue of purpose limitation is specifically raised in the Decision and we look forward to cooperate with the Commission, with particular regard to the future e-Justice Regulation, in order to ensure that the purpose limitation principle will be adhered to in practice, while at the same time not presenting unnecessary obstacles to the development of new value-added services and access to information.

3. CONCLUSIONS

30. We welcome the fact that we were consulted on this Decision prior to its adoption and that the Commission took into account several of our comments.

31. In the present Opinion we encourage the Commission to increase its efforts for a swift adoption of the future Regulation on e-Justice. This Opinion contains preliminary guidance to drafting such a future Regulation and provides a non-exhaustive list of items that should be addressed in this future Regulation, including:  Scope of the Portal  Legal grounds for processing of data in the Portal  Responsibilities of the Commission and the various other parties involved as controllers, including with regard to security and data protection by design  Purpose limitation and restrictions, where applicable, on data combination. Done in Brussels, 05 September 2014 (signed) Giovanni BUTTARELLI Assistant European Data Protection Supervisor