The latest published comments of the EDPS concern the proposal for a Council Directive amending the Directive 2011/16/EU on administrative cooperation in the field of taxation. The full comments can be viewed here. The comments, signed in this case by Giovanni Buttarelli, the Assistant European Data Protection Supervisor, arise following a reference by ‘a political group in the European Parliament’ and not from a standard reference from the Commission.
Perhaps the Commission’s reluctance to refer the amended proposal to the EDPS arises from the fact that, in January 2010, the EDPS published an Opinion analysing the data protection aspects of the original proposal (Directive 2011/16/EC) – he was not much impressed by the treatment of, and level of concern for, data protection issues then. The latest comments focus on the changes to Article 8 of the Directive introduced by the current proposal.
The EDPS ‘understands the need to share information, but at the same time wishes to underline that the processing of such data must at all times take place in conformity with the EU rules on data protection’. He is concerned that the proposal will lead to an increase in the trans-border exchange of personal data of EU citizens and does not think that his original concerns have been addressed. The comments state:
‘One of the fundamental principles of data protection law is that personal data must be processed for specified, explicit and legitimate purpose(s) and that it may not be further processed in a way incompatible with those purposes. The data used to achieve the stated purpose(s) should furthermore be necessary and should be adequate, relevant and not excessive in relation to the purpose. The EDPS therefore urges the legislator to specify the types of personal data that may be exchanged pursuant to the Directive and to better define the purposes and the context for which personal data can be exchanged. In addition, it must be ensured that the necessity and proportionality principles are respected under the Directive.
…
The EDPS notes that neither the current Directive nor the new proposal contain provisions which spell out how the transparency principle should be complied with in practice, for instance on whether (and how) the exchange of information is communicated to the public at large or how data subjects will be informed about the data processing. The EDPS therefore urges the legislator to adopt a provision in which the transparency of the proposed information exchanges is addressed.’
