Die EU insgesamt und ihre einzelnen Mitgliedstaaten sehen sich neuen, vielfältigen und komplexen Sicherheitsbedrohungen gegenüber, die zunehmend internationalen und grenzüberschreitenden Charakter haben. Zur Bekämpfung von Terrorismus und grenzüberschreitendem Verbrechen wurden mehrere rechtliche und praktische Instrumente eingerichtet. Insbesondere wurden der Informationsaustausch und die operative Zusammenarbeit zwischen den Strafverfolgungsbehörden ausgebaut.
Second opinion on the review of Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), OJ C 128, 06.06.2009, p. 28
Opinion of 15 December 2008 on a notification for prior checking regarding the database ARDOS (Case 2007-380)
The Security Service of the Joint Research Centre (JRC) at Ispra put in place a processing operation called "nulla osta". The purpose of the "nulla osta" procedure is to ascertain and confirm a selected candidate's good conduct. Information collected through this procedure is stored in a database called ARDOS with all documents requested by and presented to the Security Service of the JRC Ispra. It has to be noted that the "nulla osta" processing operation concern the candidates of all JRC sites except Karlsruhe.
The EDPS examined the processing operation and in particular the legal basis provided by the JRC Ispra to conduct such assessment of the candidate's good conduct. The EDPS concluded that the processing operation appears to be in breach of the provisions of Regulation (EC) No 45/2001 unless a clear legal basis is identified, produced or established by the institution. Indeed the processing operation described by the Security Service goes far beyond a checking of the candidate's good conduct, notably by collecting excessive and non relevant data (data quality principle).
The EDPS moreover recommended that in order to ensure compliance with the Regulation, the JRC Ispra should made several amendments to the privacy statement to fully respect the information that should be given to the data subject following Article 12 of the Regulation. The EDPS also insisted on the fact that the retention period foreseen by the institution should be implemented as soon as possible.
Opinion on the Proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) data for law enforcement purposes, OJ C 110, 01.05.2008, p. 1
Opinion on the Initiative of the Federal Republic of Germany, with a view to adopting a Council Decision on the implementation of Decision 2007/…/JHA on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime, OJ C 89, 10.4.2008, p. 1
