EDPS opinion on EU Financial Regulation: EU budget needs clear rules on transparency, also to protect individuals' personal data

On 15 April 2011, the European Data Protection Supervisor (EDPS) adopted an opinion on the Commission's proposal aimed at revising the financial rules applicable to the annual budget of the European Union ("EU Financial Regulation"). The proposal covers several matters which involve the processing of personal data by the EU institutions and by entities at Member State level.

One of the most significant new elements introduced by the proposal is the possibility to publish decisions on administrative and financial penalties. Such publication would entail the disclosure of information about the person concerned in an identifiable way. The EDPS believes that this provision does not meet the requirements of data protection law. To better comply with data protection rules, it should be improved by explicitly indicating the purpose for the disclosure and by ensuring the consistent application of the possibility of what is in fact naming and shaming of persons, with use of clear criteria to demonstrate the necessity of the disclosure.

Giovanni Buttarelli, Assistant Supervisor, says: “The role of privacy and data protection is not to prevent public access to information whenever personal data are involved and to unduly limit transparency of the EU administration. Transparency and data protection are two principles that strengthen each other. However, synergy between these two principles in the new Regulation can only be ensured if the rules on transparency and processing of personal information are sufficiently clear and precise”.

In addition to this main new aspect of the proposal, the EDPS recommendations include the following:

• whistleblowers: the legislator should ensure the confidentiality of whistleblowers' identity during investigations, except in cases where it contravenes national rules regulating judicial procedures;
• publication of information on the recipients of funds deriving from the budget: the Regulation should explicitly indicate the purpose and explain the necessity of the disclosure of information on the recipients of funds deriving from the budget;
• Central Exclusion Database: the proposal provides for the setting up of a database containing details of individuals and companies candidates excluded from participation in tenders. The EDPS underlines that access to the database by third countries' authorities should comply with the specific data protection rules related to third countries transfers.