Opinion of the European Data Protection Supervisor on
the proposal for a regulation of the European Parliament and of the
Council on European statistics on safety from crime.
On 8 June 2011, the Commission adopted a proposal for
a regulation of the European Parliament and of the Council on
European statistics on safety from crime.
Objectives and scope of the proposal: to recall, the proposal aims at implementing a new
survey in the European Union on safety from crime. It will set up a
common framework for producing comparable European statistics
through the collection, compilation, processing and transfer of
harmonised European data. The categories of data to be processed
are detailed in Annex I to the proposal, and include detailed
questions on the socio-demographic background of respondents to the
survey, possible incidents of sexual and physical violence that
they might have suffered, their feelings of safety and their
attitudes to law enforcement and security precautions.
The proposal regulates the transmission of
confidential data from Member States to the Commission (Eurostat),
as well as the dissemination and the access to data for scientific
purposes. Practical arrangements for the data coding scheme and for
exchanging micro-data will be adopted by means of implementing
acts.
EDPS conclusions: concerned about the processing of
sensitive data in this specific survey and the possibility of
identifying victims and aggressors of physical and sexual violence,
the EDPS recommends, in particular, the following:
- the description of the variables ‘identification
of respondent’ and ‘who did it’ should be modified
to avoid unnecessary direct identification of data subjects.
In addition, in order to also avoid indirect identification, the
EDPS recommends anonymising the micro-data as soon as possible in
the sense of Directive 95/46/EC and Regulation (EC) No 45/2001 (no
possibility of identification, taking into account all the means
likely reasonably to be used);
- in case that, due to the level of detail that is
necessary for the survey, anonymisation of the micro- data in the
sense of Directive 95/46/EC and Regulation (EC) No 45/2001 cannot
be guaranteed before transmission to Eurostat or before granting
access to researchers, data which are anonymised in the sense of
Regulation (EC) No 831/2002 (minimisation of the risks of
identification) might be processed;
- confidential data should only be used if it is
necessary, i.e. if the same purposes
cannot be achieved using anonymous micro-data data, and if this
necessity is clearly justified in the proposal;
- in these cases, the ‘substantial public
interest’ justifying the processing of sensitive data should
be further clarified and explicitly stated in the text of the
proposal. It should also be ensured that all the categories of
personal data to be collected and processed are relevant and not
excessive for this specific purpose;
- until data are anonymised in the sense of Directive
95/46/EC and Regulation (EC) No 45/2001, adequate technical and
organisational measures to ensure the confidentiality and security
of personal data processed should be implemented, taking into
account the risks represented by the processing and the sensitive
nature of the data to be protected. In addition, the processing
will be subject to prior checking by the EDPS;
- lastly, the EDPS would welcome a request for
consultation as regards the review of Regulation (EC) No 831/2002
and the practical arrangements for the data coding scheme and for
exchanging micro-data that will be adopted by means of implementing
acts.