Recognition of professional qualifications: European Professional Card supported by the Internal Market Information System (IMI)

Opinion of the European Data Protection Supervisor on the Commission proposal for a Directive of the European Parliament and of the Council amending Directive 2005/36/EC on the recognition of professional qualifications and Regulation […] on administrative cooperation through the Internal Market Information System

On 19 December 2011, the Commission adopted a Proposal for a Directive of the European Parliament and of the Council amending Directive 2005/36/EC on the recognition of professional qualifications and Regulation […] on administrative cooperation through the Internal Market Information System. The Proposal was sent to the EDPS for consultation on the same date.

Before the adoption of the Proposal, the EDPS was given the possibility to provide informal comments. Many of these comments have been taken into account in the Proposal. As a result, the data protections safeguards in the Proposal have been significantly strengthened. The EDPS welcomes the fact that he is also formally consulted by the Commission and that a reference to this Opinion is proposed to be included in the preamble of the instrument to be adopted.

Objectives and scope of the Proposal : the objective of the Proposal is to modernize and amend the existing text of Directive 2005/36/EC (the ‘Professional Qualifications Directive’).

From the data protection perspective, the two key aspects of the Proposal are (i) the introduction of an alert system (Article 56a) and (ii) the introduction on a voluntary basis of a European Professional Card (Articles 4a, b, c, d and e) ( 5 ). The processing of personal data in both cases is foreseen to take place via the Internal Market Information System (‘IMI’) :

• alerts are issued, in principle, after a decision has been made by a competent authority or a court in a Member State prohibiting an individual from pursuing his or her professional activities in its territory. Alerts can be issued concerning any professional subject to the Professional Qualifications Directive including professionals who have not applied for a European Professional Card. After being issued, alerts are stored in IMI and all Member States and the Commission have access to them;
• the introduction of a European Professional Card involves the creation and storage of an information file in IMI on the professionals who voluntarily subscribed to the card (the ‘IMI-file’). The information in the IMI-file is accessible by the professional, as well as by the ‘host’ and the ‘home’ Member States. At any time the professional can request the deletion, blocking or rectification of information in the IMI-file;
• the alert data and some of the data in the IMI file include information on offences or administrative sanctions, and as such, require heightened protection under Article 8(5) of Directive 95/46/EC and Article 10(5) of Regulation (EC) No 45/2001.

According to the EDPS, the alert system may affect the right to data protection of a large number of individuals of different professional groups in all Member States, including medical practitioners, whether or not they actually pursue or intend to pursue their activities outside their home countries.

Further, the Proposal also raises important issues on how the alert system and the repository function will develop in IMI in the future. This is a horizontal issue also relevant for administrative cooperation in other policy areas.

Conclusions: the EDPS takes note of the establishment of a limited alert system at the European level to exchange information about professionals who have been prohibited from pursuing their professions in a Member State, where this is justified for important public interests.

However, the EDPS considers that the alert systems must remain proportionate.

The EDPS recommends, in particular, that:

• the Proposal should specify unambiguously in which concrete cases alerts can be sent, more clearly define what personal data can be included in alerts, and limit the processing to the minimum that is necessary, taking into account proportionality and balancing of rights and interests;
• in this respect, the Proposal should unambiguously specify that alerts can only be sent after a decision has been made by a competent authority or a court in a Member State prohibiting an individual to pursue his or her professional activities in its territory;
• specify that the content of the alert must not contain more specific information regarding the circumstances and reasons for the prohibition;
• clarify and limit to the minimum strictly necessary, the period for which alerts are retained; and
• ensure that alerts are only sent to competent authorities in Member States and that these authorities shall keep alert information received confidential and not further distribute or publish it, unless the data were made public in accordance with the law of the sending Member State.

With regard to the European Professional Card and the related ‘IMI-file’, the EDPS recommends further clarifications on the conditions under which information concerning disciplinary action or criminal sanctions or any other serious specific circumstances must be included in the file, and the content of the information to be included, and also recommends clear limitation on the retention periods.

Further, the EDPS recommends that in the long term, if and when the use of Professional Cards and IMI will become widespread, the Commission undertake a review of whether the Article 56a alert systems are still necessary and whether they cannot be replaced by a more limited, and thus, from the data protection point of view, less intrusive, system.