Follow-up of the Work Programme for better implementation of the Data Protection Directive

Data protection Directive

• Communication on the follow-up of the Work programme for a better implementation of the Data Protection Directive

Follow-up of the Work Programme for better implementation of the Data Protection Directive

Action 1

Discussions with Member States and Data Protection Authorities

Action 2

Association of the candidate countries with efforts to achieve a better and more uniform implementation of the Directive

• Decision 1/2001 on the participation of representatives of Data Protection Supervisory Authorities from the candidate countries in Article 29 Data Protection Working Party meetings - 13 December 2001 - WP 52

Action 3

Improving the notification of all legal acts transposing the Directive and notifications of authorisations granted under Article 26(2) of the Directive

• Press Release  
• Note sent to Member States and Data Protection Authorities on 21 August 2003  
• Web-page on national policy documents at the Commission's website  
• Working Party document WP 98 "Strategy Document", adopted on 29 September 2004  
• Working Party document WP 92 "Work Programme 2004 of the Article 29 Working Party", adopted on 17 March 2004  
• Working Party document WP 109 "Work Programme 2005 of the Article 29 Working Party", adopted on 14 April 2005  
• Improving the notification of all legal acts transposing the Directive and notifications granted under Art. 26 (2) of the Directive

Action 4

Enforcement

• Declaration of the Article 29 Working Party on Enforcement  
• Annex: Some examples of enforcement in the field of data protection in the Member States  
• Press release  
• Working Party document WP 101 "Declaration of the Article 29 Working Party on Enforcement", adopted on 25 November 2004  

Action 5

Notification and publicising of processing operations

• Working Party document WP 106 "Article 29 Working Party report on the obligation to notify the national supervisory authorities, the best use of exceptions and simplification and the role of the data protection officers in the European Union", adopted on 18 January 2005  
• Working Party document "Vademecum on notification requirements"

Action 6

More harmonised information provisions

"The Art. 29 Working Party welcomes the efforts to develop a standard for comprehensible data protection information.
Comprehensive, intelligible and easily accessible information about the data processing is an indispensable condition to guarantee the data protection rights to the persons concerned.
We encourage the institutions and companies involved to continue their tasks." (Adopted by the Art. 29 Working Party in Brussels on 22 June 2004)

• Working Party document WP 100 "Opinion on more harmonised information provisions", adopted on 25 November 2004  
• Appendices  
• Working Party document WP 97 "Opinion 8/2004 on the information for passengers concerning the transfer of PNR data on flights between the European Union and the United States of America", adopted on 30 September 2004  

In order to ensure a more consistent approach to information requirements, the Commission included "More harmonized information provisions" as a specific action item (Action 6) of the work programme for a better implementation of the Data Protection Directive and called on the Article 29 Working party to co-operate in the search for a more uniform interpretation of Article 10. In the view of establishing a common approach for a pragmatic solution which should give a practical added value for the implementation of the general principles of the Directive the Art 29 Working Party hold a first discussion on this topic during its meeting on 22 June 2004 and adopted the following conclusion:

Action 7

Simplification of the requirements for international transfers a more extensive use of findings of adequate protection in respect of third countries under Article 25(6)

• Commission Decision of 30 June 2003 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Argentina, OJ No L 168, 5.7.2003, p.19
• Commission Decision of 21 November 2003 on the adequate protection of personal data in Guernsey, OJ No. L 308, 25.11.2003, p. 28
• Commission Decision of 28 April 2004 on the adequate protection of personal data in the Isle of Man, OJ No. L 151, 30.4.2004, p. 48; 2004/535/EC
• Commission Decision of 14 May 2004 on the adequate protection of personal data contained in the Passenger Name Record of air passengers transferred to the United States' Bureau of Customs and Border Protection, OJ No. L 235 , 06/07/2004, p. 11
• Further decisions on the basis of Article 26(4) so that economic operators have a wider choice of standard contractual clauses
• Commission Decision of 27 December 2004 amending Decision 2001/497/EC as regards the introduction of an alternative set of standard contractual clauses for the transfer of personal data to third countries, OJ No. 385, 29.12.2004, p. 84
• The role of binding (intra) corporate rules in providing adequate safeguards for intra-group transfers of personal data
• Working Party document WP 13, « Working Document : Transfers of personal data to third countries: applying Article 26 (2) of the EU Data Protection Directive to Binding Corporate Rules for International Data Transfers", adopted on 10 September 1998  
• Working Party document WP 107, "Working Document setting forth a co-operation procedure for issuing common opinions on adequate safeguards resulting from Binding Corporate Rules", adopted on 14 April 2005  
• Working Party document WP 108, « Working Document establishing a model checklist application for approval of Binding Corporate Rules", adopted on 14 April 2005  
• the more uniform interpretation of Article 26(1) of the Directive
• Working Party document WP 114, "Working document on a common interpretation of Article 26(1) of Directive 95/46/EC of 24 October 1995", adopted on 25 November 2005  

Action 8

Promotion of Privacy Enhancing Technologies

• Adoption of the Communication on Promoting Data Protection by Privacy Enhancing Technologies (PETs)
  IP/07/589: Promoting Data Protection by Privacy Enhancing Technologies (PETs)  
• Terms of reference of the technical workshop  
• Main outcomes of the technical workshop on 4th July 2003   
• Introductory speech of Philippe Renaudière  
• Technical Workshop on PETS  
• Working Party document WP 86 "Working Document on Trusted Computing Platforms and in particular on the work done by the Trusted Computing Group (TCG group)", adopted on 23 January 2004  

Action 9

Promotion of self-regulation and European Codes of Conducts

• Working Party document WP 77, "Opinion 3/2003 on the European code of conduct of FEDMA for the use of personal data in direct marketing", adopted on 13 June 2003   (Annex)  

 Action 10

Awareness raising

Results of the two Eurobarometer surveys on data protection awareness in the European Union carried out in autumn 2003

• European Union citizens' views about privacy (Special Eurobarometer 196)
  • Highlights
  • Executive Summary
  • Report
• European Union companies' views about privacy (Flash Eurobarometer EB 147)
  • Executive Summary
  • Report
• Results of the two Eurobarometer surveys on data protection awareness in the European Union carried out in 2008:
• Data Protection in the European Union : Citizens' perceptions (Flash Eurobarometer EB 225):
  • Summary  
  • Report  
• Data Protection in the European Union : Data controllers' perceptions (Flash Eurobarometer EB 226)
  • Summary  
  • Report  

Report on the First Report on the implementation of the Data Protection Directive 95/46/EC

• Report (24 February 2004) on the First Report on the implementation of the Data Protection Directive (95/46/EC)  
  (COM(2003)265 - C5-0375/2003 - 2003/2153(INI))
  Committee on Citizens' Freedoms and Rights, Justice
  Rapporteur: Marco Cappato

Report on the transposition of Directive 95/46/EC

• Commission's First Report   on the transposition of the Data Protection Directive
• Information collected for the preparation of the report
  • Data Protection Conference  , Brussels, 30.9./1.10.2002
  • Questionnaires   to Member States and Data Protection Authorities
  • Online consultation  
  • Position papers from interested parties  

• Status of implementation of Directive 95/46 on the Protection of Individuals with regard to the Processing of Personal Data