Legislative Observatory
European Parliament
Please fill in this field to find a procedure

Investigations by the European Anti-Fraud Office (OLAF)

2006/0084(COD)

OPINION OF THE EUROPEAN DATA PROTECTION SUPERVISOR on the proposal for a Regulation of the European Parliament and of the Council amending Regulation (EC) No 1073/1999 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing Regulation (Euratom) No 1074/1999

The proposal was sent by the Council to the EDPS on 8 April 2011.

The importance of the Proposal and the EDPS advice: the Proposal includes provisions which have a strong impact on individuals’ rights. OLAF will continue to collect and further process sensitive data relating to suspected offences, offences, criminal convictions as well as information that would serve to exclude individuals from a right, benefit or contract insofar as such information represents a particular risk to the rights and freedoms of the data subjects

The fundamental right to the protection of personal data is relevant not only for its own sake, but also has strong connections with other fundamental rights, such as non-discrimination and due process of law, including the right of defence in OLAF investigations.

The respect of due process has an impact on the validity of evidence and should be considered a priority by OLAF to reinforce its accountability.

It is therefore essential to ensure that, in carrying out its investigations, fundamental rights including the rights to data protection and privacy of the persons implicated therein are properly guaranteed.

The EDPS supports the objectives of the proposed amendments and, in this respect, welcomes the proposal. The EDPS particularly appreciates the introduction of the new Article 7(a) which is dedicated to the procedural guarantees afforded to individuals. In relation to individuals’ rights to the protection of their personal data and privacy, the EDPS considers that on the whole the proposal contains improvements vis-à-vis the current situation.

Improving the proposal: despite the overall positive impression, the EDPS considers that from the point of view of the protection of personal data, the proposal could be further improved without jeopardising the objectives that it pursues. In particular, the EDPS is concerned that, because of the lack of coherence on certain aspects, the proposal may be interpreted as a lex specialis regulating the processing of personal data collected in the scope of OLAF investigations, which would take precedence over the application of the general data protection framework contained in Regulation (EC) No 45/2001. Thus, there is a risk that the data protection standards contained in the proposal could be interpreted ex contrario as being lower than those contained in the Regulation.

In order to avoid this outcome, the EDPS provides an analysis of the proposal which, on the one hand, describes its shortcomings and, on the other hand, suggests specific ways to improve upon them. The EDPS would also like to highlight a number of shortcomings that should be addressed by the modification of the text, and most importantly, the Proposal should:

  • clearly mention the right to information of the different categories of data subjects, as well as the right of access and rectification in relation to all the phases of the investigations carried out by OLAF;
  • clarify the relationship between the need for confidentiality of the investigations and the data protection regime applicable during the investigations: the EDPS suggests that the rights of the data subjects should be clearly defined and separated as well as possible exceptions due to confidentiality requirements, and that the safeguards provided for by Article 20 of Regulation (EC) No 45/2001 should be explicitly introduced;
  • clarify OLAF's information policy to the public in relation to data protection;
  • introduce specific provisions for the confidentiality of whistleblowers and informants;
  • clarify the general data protection principles on the basis of which OLAF can transmit and receive information, including personal data, with other EU bodies and agencies, third countries and international organisations;

Strategic planning: besides all the specific points mentioned above, the EDPS would like to encourage the Commission to propose a more open approach to the EU data protection regime by OLAF. It would be the right moment for OLAF to develop a strategic planning of its data protection compliance by voluntarily clarifying the practical approach to the treatment of its numerous files containing personal data.

Accordingly, the EDPA suggests that the provisions of the Proposal should give the Director- General the task of ensuring that a strategic and comprehensive overview of the different processing operations of OLAF is carried out, kept up to date and made transparent, or at least that the need for this should be explained in a recital.