Posting of workers in the framework of the provision of services: enforcement of Directive 96/71/EC

OPINION OF THE EUROPEAN DATA PROTECTION SUPERVISOR

on the Commission proposal for a Directive of the European Parliament and of the Council on the enforcement of Directive 96/71/EC

concerning the posting of workers in the framework of the provision of services and on

the Commission proposal for a Council Regulation on the exercise of the right to take collective action

within the context of the freedom of establishment and the freedom to provide services

The EDPS recalls that the proposal concerning the Posting of Workers requires the processing of a significant amount of personal data. These personal data may relate to the posted workers as well as to individuals acting on behalf of the posting undertakings such as their corporate officers, management, company representatives, or employees.

From the data protection perspective, the three most relevant provisions of the Posting of Workers proposal are those

• which allow bilateral information exchanges (consisting of ‘(replies) to reasoned requests for information’),
• which require Member States to ensure that registers of service providers may be consulted by competent authorities of the other Member States ‘in accordance with the same conditions’, and
• which require the Member State of establishment, on its own initiative, to communicate to the Member State to which the posting takes place relevant information regarding possible irregularities.

The EDPS welcomes that the Posting of Workers proposal addresses data protection concerns. The EDPS also welcomes the fact that the use of an existing information system, IMI, is proposed for the administrative cooperation, which already offers, at the practical level, a number of data protection safeguards.

To address any remaining data protection concerns, the EDPS provides the following recommendations:

• the reference to the applicable data protection framework should be set forth in a substantive provision rather than in a recital;
• on bilateral information exchanges under the Posting of Workers proposal, the permissible purposes of information exchange should be more clearly specified in the proposal;
• on access to registers of service providers by competent authorities of other Member States, the proposal should more clearly specify what registers are actually concerned;
• lastly, if and when interconnection of registers is planned as a common European project in this area as well, data protection safeguards must be carefully considered at the European level.

With regard to the alert system on possible irregularities, the EDPS recommends that the proposal:

• unambiguously specifies that alerts can only be sent in case of a ‘reasonable suspicion’ of possible irregularities,
• should require closure of cases automatically upon receipt of an alert, to help ensure that the alert system will function as a warning mechanism, rather than as a long-term blacklist, and
• ensures that alerts are only sent to competent authorities in Member States and that these authorities shall keep the alert information received confidential and not further distribute or publish it.