Commission Decision

of 5 June 2014

on the protection of personal data in the European e-Justice Portal

(2014/333/EU)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

After consulting the European Data Protection Supervisor,

Whereas:

(1)
In its communication of May 20081, the Commission stated that it would design and set up the European e-Justice Portal (hereinafter ‘the Portal’), to be managed in close cooperation with the Member States.
(2)
The Multi-annual European e-Justice Action Plan 2009–20132 of 8 November 2008 entrusted the European Commission with the implementation of the Portal. The Portal was launched on 16 July 2010. The adoption of this Decision has become necessary only now since the Portal is only now ready for the first interconnection of national registers involving the processing of personal data.
(3)

The Portal's objective is to contribute to the achievement of the European judicial area by facilitating and enhancing access to justice and leveraging information and communication technologies to facilitate cross-border electronic judicial proceedings and judicial cooperation.

(4)

The institutions, bodies, offices and agencies of the European Union as well as the Member States when they are implementing Union law must respect fundamental rights and observe the principles recognised by the Charter of Fundamental Rights of the European Union, in particular the right to the protection of personal data stipulated in Article 8 of that Charter.

(5)

Since the various Portal-related tasks and functions of the Commission and the Member States will entail different responsibilities and obligations as regards data protection, it is essential to delimit them clearly.

(6)

In accordance with the specific nature of activities linked to the e-Justice Portal, developed in cooperation between the Commission and the Member States, the role of the Commission in processing personal data through the Portal is limited. It should be clarified that the Commission has no responsibility for the content of interconnected national databases made available through the Portal.

(7)
Regulation (EC) No 45/2001 of the European Parliament and of the Council3 applies to the processing of personal data by the Commission in the Portal. In this context, the Commission is in particular responsible for providing the IT infrastructure for the Portal functionalities, including the interconnection of national databases.
(8)

In accordance with Regulation (EC) No 45/2001 the purposes of processing of personal data should be explicitly specified. Therefore, the processing of personal data by the Commission in the portal should only take place if it is done to provide access to interconnected national databases holding personal data, to provide interactive services allowing users to communicate directly with the appropriate authorities in another Member State, to provide access to public information targeted towards registered users, or to provide contact information.

(9)

The Commission should embed in the system technologies that reflect the concept of ‘data protection by design’. In implementing that concept, a privacy and data protection impact assessment should be carried out during the design phase of the functionality associated with the processing of personal data through the Portal, as well as of other Portal functionalities. That assessment will identify the potential data protection risks involved. It will also define the appropriate measures and safeguards to be incorporated in the system to protect personal data.

(10)

The Commission should perform continuous and appropriate security assessments insofar as work related to the interconnection of national databases is carried out.

(11)

Only publicly available information in the interconnected national databases can be accessed through the Portal. It should not be possible to combine information from different interconnected national databases for different purposes through the Portal,

HAS ADOPTED THIS DECISION: