The EDPS expressed an opinion on the Proposal for a Directive amending Directive 2003/98/EC on re-use of public sector information (PSI), observing that the authority has not been consulted as required by Article 28(2) of Regulation (EC) 45/2001 and that “this is regrettable in view of the large amount of personal data potentially concerned by this initiative”.
According to the EDPS, although the public sector information can be publicly available, the information referred to an identified or identifiable natural person remains subject to the prescriptions of data protection law.
EDPS remarked that “increased accessibility of information may also increase the risks of misuse of personal data” and, from this perspective, expressed different criticism to the proposal.
As observed by many legal scholars, the critical aspect concerning the re-use of personal data concerns the limit imposed by the Article 6 (1) (b) of the Directive 95/46, which provides that personal data should be collected for specified, explicit and legitimate purposes and “not further processed in a way incompatible with those purposes” (see in the same sense the article 5 (b) of the recent Proposal for a General Data Protection Regulation). Regarding to this aspect the EDPS affirmed that “the challenge is to clearly define in advance the personal data that could be made publicly available and the appropriate data protection safeguards which ensure legal certainty while allowing innovation and reuse for any (lawful) purpose”.
Considering that the legal framework for data protection is currently under review, the Authority suggested to take into account concepts such as privacy by design and accountability and procedural solutions such as data protection impact assessments.
In this perspective, the EDPS has given specific recommendations with regard to various provisions of the Proposal for a Directive amending Directive 2003/98/EC.
The EDPS recognized a fundamental role to the license conditions in order to guarantee the respect of the principle of the Directive 95/46 when the data are re-used, to introduce appropriate contractual clauses to permit the trans-border data flow and to prohibit re-identification of individuals where the data should be fully or partially anonymized.
Finally, the EDPS considered that the proposal should be modified in order to require that “an assessment be carried out by the public sector body concerned before any PSI containing personal data may be made available for reuse”.