Comments

The EDPS has provided comments on the Commission proposal for establishing the European Border Surveillance System (EUROSUR). EUROSUR is meant to enhance cooperation between Member States' authorities competent for border surveillance and control on the EU's southern and eastern borders.
 
While the proposal is not meant to establish a system for the processing of personal data, they may be processed in certain exceptional cases. The EDPS calls on the legislator to clearly delineate and regulate these exceptions.

The EDPS has provided comments in relation to the Commission's intention to establish a European regulatory framework on eCall. One of its major components will consist in putting forward a proposal for a Regulation providing for the mandatory introduction of the in-vehicle part of the eCall service in new type-approved vehicles in Europe.

The EDPS particularly welcomes a harmonised European approach to eCall, which should contribute to setting consistent data protection standards for its deployment and use. However the EDPS underlines that the choice of a mandatory introduction of eCall will have to be properly justified in terms of data protection. Furthermore, appropriate guarantees will need to be set forth in the Regulation which take into account data protection principles, including clarifying the responsibilities of the different operators and adopting rules for the processing of eCall data by all actors of the eCall chain. Given the data protection implications of the envisaged Regulation, the EDPS and the Article 29 Working Party should be duly consulted on the proposal from the Commission for a Regulation on eCall.

On 20 September 2011 the EDPS commented on the proposal for a Regulation on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters. The EDPS highlighted the importance, also in the area of data protection, of facilitating the settlement of cross-border disputes. The EDPS emphasized the need for further reflection on some of the issues raised in the proposal, also in the context of the ongoing review of the data protection framework in the EU.

- In particular, the EDPS encouraged further reflection on whether jurisdictional rules should protect the weaker party also in data protection litigation (as is already the case in employment, insurance and consumer protection matters).
- With regard to the retention of the exequatur for privacy, defamation, and rights relating to personality, and the possibility to deny recognition of judgments on public policy grounds in these cases, the EDPS noted the need for a strict interpretation of those exceptions, since there is a risk that the public policy ground could be used to deny recognition of judgments, and thus, ultimately discourage cross-border litigation within the EU.
- The EDPS further emphasized that it is not clear whether the above exception for privacy rights is intended to cover also violations of legal rules for the processing of personal data as provided for in the Data Protection Directive, and if so, to which extent this may be the case. This may create problems of interpretation and will not contribute to the legal certainty that the proposal aims to establish.
- Finally, the EDPS also encouraged further reflection on how to better align the courts' jurisdiction with the competence of data protection authorities. The two sets of jurisdictional rules should be aligned to avoid, whenever possible, that a data protection authority in one Member State, and a court in another Member State would be competent to handle disputes arising out of the same facts.

On 20 July the EDPS sent a letter to the three Commission, European Parliament and Council reaffirming his position that data protection principles and necessary restrictions to them should be comprehensively and clearly laid down also in the area of restrictive measures taken by EU institutions with regard to certain individuals.

The Commission proposals envisage fighting terrorism or human rights abuses by imposing restrictive measures - notably, asset-freezing and travel bans - on natural and legal persons suspected of being associated with terrorist organisations and/or on certain governments. To this end, the European Commission publishes and publicises "blacklists" of the natural or legal persons concerned. In this case, the restrictive measures are proposed with regard to Mr Milosevic and persons associated with him, in support of the mandate of the International Tribunal for the Former Yugoslavia, and in respect of Eritrea.

By referring to two previous EDPS opinions of July and December 2009, the letter recalls that ensuring data protection in this area entails providing adequate information, access of listed individuals to their own personal data, adequate protection when data are exchanged with third countries or international organisations, the effectiveness of judicial remedies, and that necessary restrictions to data protection rights are clearly defined and thus foreseeable.

In conclusion, the EDPS stresses that - one year after the first EDPS opinion in this area and several months after the entry into force of the Lisbon Treaty - it is now the right time for the EU legislator to address in a detailed, comprehensive and consistent way the issue of data protection in relation to restrictive measures, developing a policy that would enhance not only the protection of fundamental rights, but also the legal certainty and the effectiveness of the measures taken.