The European Commission submitted a first report on the implementation of Directive 95/46/EC and the identification of the actions necessary to address the main problems that had emerged.
The Commission considered that results of the public review which had preceded the preparation of this report on balance militated against proposing modifications to the directive at this stage. In the course of the consultations conducted, few contributors had advocated the modification of the directive. The most notable exception had been the detailed proposals for amendments submitted jointly by Austria, Sweden, Finland and the UK. These proposals for amendments concerned only a small number of provisions (notably Article 4 which determined the applicable law, Article 8 on sensitive data, Article 12 on the right of access, Article 18 on notification and Articles 25 and 26 on transfers to third countries), leaving most of the provisions and all of the principles of the directive untouched.
The Commission, along with a large majority of the Member States, believed that the following general considerations made it unwise to make proposals to amend this directive in the immediate future:
- Experience with the implementation of the directive was so far very limited. Only a few Member States had implemented the directive on time. Most Member States had only notified implementing measures to the Commission in 2000 and 2001, and Ireland had still not notified its recent implementation. Important implementing legislation was still pending in some Member States;
- Many of the difficulties that had been identified during the review could be addressed and resolved without amending the directive. In some cases, where problems were caused by incorrect implementation of the directive, they had to be solved by specific modifications of Member State law. In others, the margins of manoeuvre allowed by the directive permitted closer cooperation among supervisory authorities to achieve the convergence necessary to overcome difficulties arising from practices that diverged too widely from Member State to Member State;
- Where amendments had been proposed by stakeholders, the aim was often the reduction of compliance burdens for data controllers. While the Commission espoused this end, it believed that many of the proposals would also involve a reduction in the level of protection provided for. The Commission believed that any changes that might in due course be considered should aim to maintain the same level of protection.
The Commission considered that some of the issues that had emerged needed to be further analysed and could need in due course to be the subject of a proposal to revise the directive. The Commission's attention would continue to be focussed in particular on areas where Community law was clearly being breached and on areas where divergent interpretations and/or practices were causing difficulties in the Internal Market. The Commission also considered as a priority the harmonious application of the rules relating to the transfer of data to third countries, with a view to facilitating legitimate transfers and avoiding unnecessary barriers or complexities.
The Commission encouraged citizens to make use of the rights conferred by the legislation and data controllers to take all necessary steps to guarantee compliance with the legislation. The Commission would make proposals for further follow-up towards the end of 2004, by which time both the Commission and the Member States would have the benefit of considerably more experience than at present with the implementation of the directive.�