Madame la Présidente,
Members of Parliament,
Ladies and Gentlemen,
On 5 September, the European Union Agency for Fundamental Rights – FRA – was asked by the European Parliament to draft an Opinion on the data protection reform package. It is with great pleasure today that I present some key messages from our Opinion.
As an EU Agency set up in 2007 to contribute to ensuring full respect for fundamental rights in the Union, FRA addresses the data protection reform package from a comprehensive fundamental rights perspective, looking at the consequences of the proposal across a range of fundamental rights.
In providing independent, evidence-based advice on fundamental rights to the EU Institutions and Member States, a central point of reference for much of our work is the Charter of Fundamental Rights of the European Union.
For the first time since the entry into force of the Lisbon Treaty, the European Commission has proposed legislation that (to quote Article 1) “protects the fundamental rights and freedoms of natural persons, and in particular their right to the protection of personal data.”
I should like to begin by recognising the truly comprehensive work carried out by the drafters of the proposed reform. In our view, both documents – the draft Regulation and the draft Directive – provide an excellent basis for guaranteeing our fundamental right to data protection. In this regard, the FRA Opinion took into account the opinions of the European Data Protection Supervisor, the Article 29 Working Party and the European Economic and Social Committee, all of which were predominantly focused on data protection.
What lies at the core of FRA’s reading and critique of the data protection reform package is the absence of key fundamental rights language with reference to the Charter of Fundamental Rights.
We share the goal of putting in place a legal framework that will effectively and enduringly guarantee the fundamental right to data protection. It is however essential that all fundamental rights affected by the processing of data, in various situations, should be upheld independently of the technological evolution ahead of us. If the data protection reform package is going to withstand technological developments, then it also needs to ensure that fundamental rights are comprehensively addressed.
Thus our Opinion examines the reform package from the perspective of the other relevant Charter rights that were not explicitly addressed in the other Opinions I have referred to earlier.
Our considered view is that references to additional fundamental rights – alongside data protection – need to be included in the body of the drafts.
Why is this critical?
Because we not only would miss an opportunity to integrate data protection in a broader Charter environment; we would also run risks if we neglected to ground data protection laws within the context of the other relevant fundamental rights provided under the Charter.
We note, for example, that some fundamental rights are mentioned in the package, while others are not.
In the draft Directive Recitals, there are references to only few fundamental rights – including non-discrimination, rights of the child, and the right to an effective remedy and to a fair trial.
However, there is a need to include reference to more rights, such as the right to freedom of expression and information, for example. This is particularly the case in view of the extensive case law of the European Court of Human Rights relating to the tapping of journalists’ telephones and the seizure of their material – along with personal data – in the context of law enforcement procedures.
Likewise, the draft Directive does not mention Article 35 of the Charter on healthcare, despite the fact that data concerning health is considered to be sensitive data in the Draft Directive.
While recognising that both the draft Regulation and Directive aim to protect fundamental rights in general, we believe that legal clarity would be greatly enhanced by a specific reference in the body of the legislation stating that these instruments are to be applied in line with the Charter. Furthermore, a clear reference to the Charter would facilitate the work of data protection authorities or indeed national judges who implement the reformed legal framework.
Referring to the Charter in the first Article of both drafts would also clarify the interaction between the right to data protection and other Charter rights, which is crucial when courts are called upon to determine the balance of rights. We expand on this in our Opinion, providing examples drawn from such diverse areas as freedom of expression, rights of the child and freedom to conduct a business.
Let me expand on this last area.
Freedom to conduct a business, as interpreted by the Court of Justice of the European Union, entails an obligation to observe the principle of proportionality in the measures imposed on business. Much discussion has taken place on the threshold to be adopted in respect of business vis-à-vis new obligations imposed upon them by the reform package. A specific reference to Article 16 of the Charter recognising freedom to conduct a business would send a reassuring signal to the business community while also providing national judges with tools to solve cases brought against businesses that do not obey the new data protection rules.
Another example is in the area of non-discrimination.
Prohibition on processing of sensitive data is typically undertaken in an effort to enhance privacy. At the same time, reference to Article 21 of the Charter, which addresses non-discrimination, would remind judges that sensitive data that does not identify individuals can also be important to highlight possible patterns of discrimination. The Opinion addresses this in more detail, so that barriers to processing of sensitive data are also looked at alongside possibilities for using such data for the purpose of tackling discrimination.
Ladies and Gentlemen,
Let me now turn to two proposals that, based on FRA research findings, would foster access to justice and effective redress mechanisms in cases of data protection breaches.
The reform package strengthens the role of national data protection authorities, their independence and their powers. We have commented that there is a need to ensure access to these institutions is also strengthened. Specifically, we suggest a broadening of the rules of legal standing, so that consideration can be given to initiatives such as public interest actions that may be lodged before data protection authorities and courts, while being subject to specific conditions.
Furthermore, in order to facilitate the often long and complicated path to appropriate and effective redress of a data breach, consideration could be given to streamlining current redress mechanisms by providing data protection authorities not only with sanctioning powers but also with the competence to allocate compensation to victims.
These proposals would not only help provide access to justice as upheld by Article 47 of the Charter, but also effective implementation of the new data protection rules outlined in the package.
In conclusion, we believe we would miss a valuable opportunity if we failed to ground data protection laws within the context of other fundamental rights provided under the Charter. For this reason, we would suggest adding explicit reference to relevant Charter rights in the body of the new legislation.
We look forward to following the legislative process and we are ready to further assist the drafters if Parliament expresses such a wish.