Rights, support and protection of victims of crime: minimum standards

2011/0129(COD) 17/10/2011

Opinion of the European Data Protection Supervisor on the legislative package on the victims of crime, including a proposal for a Directive establishing minimum standards on the rights, support and protection of the victims of crime and a proposal for a Regulation on mutual recognition of protection measures in civil matters

It is recalled that on 18 May 2011, the Commission adopted a package of legislative instruments on the protection of the victims of crime consisting of: (i) a proposal for a Directive establishing minimum standards on the rights, support and protection of victims of crime and a (ii) a proposal for a Regulation on mutual recognition of protection measures in civil matters. Both proposals are accompanied by a Commission communication on strengthening victims' rights in the EU.

However, the EDPS notes that he was not consulted under Article 28(2) of Regulation (EC) No 45/2001, and this Opinion is therefore based on Article 41(2) of the same Regulation.

Whilst the EDPS welcomes the policy objectives of the two proposals under consideration and generally shares the approach of the Commission, he finds that the protection of privacy and personal data of the victims in the proposed Directive could be in some instances strengthened and clarified.

The EDPS' comments focus mainly on the following aspects:

· Article 23 of the proposed Directive dealing with the right to protection of privacy and relations with media;

· victims' rights of information and access to their own personal data; and

· the protection of the confidentiality of communications between the victim and victim support services.

1) Protection of the victim’s privacy (Article 23 of the proposed Directive): the EDPS notes, inter alia, that the Article does not cover the full right to protection of privacy of the victims of crime. The provision is much more limited in scope as it simply provides for the power of ‘judicial authorities’ to issue protective measures ‘during the court proceedings’. However, the protection of privacy should not only be guaranteed during the court proceedings, but also during the investigation and pre-trial phase. More generally, privacy should be ensured where necessary from the first contact with the competent authorities and also after the termination of court proceedings. Furthermore, the Article does not contain any indication about the content of the specific measures that may be adopted by judicial authorities to preserve the victim's right to privacy, nor does it contain any provision guaranteeing the confidentiality of the information held by public authorities.

EDPS advises the legislator to:

· include in Article 23 a general provision on the protection of privacy and personal data stating that Member States shall guarantee as far as possible the protection of the private and family life of victims and protect personal data of the victims from the first contact with the official authorities, throughout any court proceedings and after such proceedings;

· the current Article 23(1) should be modified so as to enable judicial authorities to issue protective measures ‘during criminal investigation’;

· specify under Article 23(1) a list of minimum measures (such as non-disclosure or limitation of the disclosure of information concerning the identity and whereabouts of the victims or family members) which judicial authorities may adopt in order to protect the privacy and photographic images of the victims and their family members ;

· provide that Member States shall require all authorities in contact with victims to adopt clear standards by which they may only disclose to a third party information received from or relating to a victim under the condition that the victim has explicitly consented to such disclosure or that there is a legal requirement or authorisation to do so.

As it deals with the relationship between privacy and the media, the EDPS notes that the proposal has adopted a minimalistic approach, by simply referring to the instrument of self- regulation. The EDPS understands the reasons for adopting a cautious attitude with regard to this subject and generally agrees with the Commission's approach.

2) Specific rights to information and access: the EDPS notes that Article 3 of the proposed Directive, dealing with the right to receive information from the first contact with a competent authority, does not mention information relating to data protection. In order to ensure adequate protection of their personal data, victims should receive at appropriate times all the information necessary to enable them to fully understand how their personal data will be processed. The EDPS asks the legislator to:

· include in Article 3 a requirement to provide victims with information concerning further processing of his/her personal data in conformity with Article 10 of Directive 95/46/EC and consider whether to include specific provisions on the right to access his/her personal data;

3) Confidentiality of communications between victims and support services: certain categories of victims, such as victims of sexual violence, gender, racial hatred or other bias crimes, or victims of terrorism, may require specialist support services, including psychological support. In these cases, the communications between the victim and the professionals providing support services should be adequately protected from disclosure. The EDPS suggests that the legislator:

· clarify the scope of the confidentiality requirement of victim support services under Article 7, by specifying that the victim shall have the right to refuse disclosure in any judicial or administrative proceedings of confidential communications with a support service provider and that in principle such communications may be disclosed by a third party only with his/her consent.

Regulation on mutual recognition of protection measures in civil matters: the proposed Regulation complements the EPO initiative concerning mutual recognition of protection measures in criminal matters. Since the proposed Regulation concerns judicial cooperation in civil matters having cross-border implications, its application falls within the scope of Directive 95/46/EC. This was not the case for the EPO initiative.

Furthermore, it is not sufficiently clear from the proposal which personal data of the protected person will be communicated to the person causing the risk, in particular pursuant to Article 13.

The EDPS advises the legislator to:

· insert, at least in the recitals of the proposal, a reference to Directive 95/46/EC stating that personal data processed under the regulation should be protected in accordance with the national laws implementing Directive 95/46/EC;

· state clearly in Article 13 that the person causing the risk should be provided only with those personal data of the protected person that are strictly necessary for the execution of the measure. The communication in question should, as far as possible, avoid disclosing the address or other contact details concerning the protected person.