5139/99/EN/FINAL
WP 30

Adopted on 3^rd February 2000

set up by Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995[1],

having regard to Articles 29 and 30 paragraphs 1 (a) and 3 of that Directive,

having regard to its Rules of Procedure and in particular to articles 12 and 14 thereof,

Whereas the objectives of the Community as laid down in the Treaty, as amended by the Amsterdam Treaty, include creating an ever closer union among the peoples of Europe, ensuring economic and social progress by common action to eliminate the barriers which divide Europe, encouraging the constant improvement of the living conditions of peoples, preserving and strengthening peace and liberty and promoting democracy on the basis of the fundamental rights recognised in the Treaty, the constitutions and laws of the Member States, and in the European Convention for the Protection of Human Rights and Fundamental Freedoms.

Whereas Directive 95/46/EC on the protection of individuals with regard to the processing of their personal data and the free movement of such data calls upon Member States to protect the fundamental rights and freedoms of individuals, and in particular their right to privacy with respect to the processing of personal data.

Whereas the Directive is part of the Community measures necessary to remove obstacles to flows of personal data in the various spheres of economic, administrative and social activity within the internal market, and that to this end it aims at harmonising the rules on processing of personal data by affording a high level of protection in the Community.

Whereas the Council and the European Parliament agreed unanimously that the Directive must be implemented into national law by 24 October 1998.

The Working Party notes that so far a large number of Member States still have not enacted relevant legislation for the implementation of Directive 95/46/EC into national law[2].

The Working Party, created by Directive 95/46/EC, is the independent EU advisory body on data protection and privacy[3]. It has in particular the mandate to examine any

question covering the application of national measures adopted under the Directive in order to contribute to the uniform application of such measures[4].

The Working Party regrets that not all Member States have implemented the Directive in time. The consequence of this delay is the continuation of a patchwork of divergent national rules that maintains legal uncertainty as regards the obligations of controllers of personal data such as business and administrations, as well as the rights of individuals.

In its work accomplished so far[5], the Working Party based its considerations on the Directive and, to the extent possible, on national laws implementing it. However, the Working Party can only give full effect to its mandate and thus contribute to the uniform application of national measures ensuring free flow of personal data within the Union and beyond if it disposes of the whole picture of national laws.

The Working Party wishes to draw the attention also to the efforts made by third countries to protect the fundamental right to privacy within their jurisdictions and to furthermore provide an adequate level of protection for transfers of personal data from the European Union[6] as requested by the Directive.

The Working Party is concerned that where such efforts have not been made and in the lack of implementation of the Directive, transfers of personal data to such countries would result in violations of individuals’ fundamental rights and freedoms guaranteed by the Directive.

Given these considerations, the Working Party recalls Member States the overall importance of their obligation to comply with the Directive in view of the protection of fundamental rights and freedoms. The Working Party is aware of the action taken by the European Commission initiating infringement procedures against failing Member States for non-compliance with the obligation to notify implementation measures[7], and fully supports all appropriate efforts to ensure a rapid implementation of the Directive.

The Working Party therefore recommends Member States, including Governments and Parliaments, to take urgently the necessary measures for the implementation of the Directive as soon as possible.

[1] Official Journal no. L 281 of 23/11/1995, p. 31, available at: http://europa.eu.int/comm/dg15/en/media/dataprot/index.htm

[2] See implementation table of DG Internal Market, available at: see footnote 1.

[3] See Article 29 paragraph 1, second sentence of Directive 95/46/EC.

[4] See Article 30 paragraph 1 (a) of Directive 95/46/EC.

[5] See opinions, recommendations and working documents adopted by the Working Part at: see footnote 1.

[6] See the principle of adequate protection established in Article 25 paragraph 1 of Directive 95/46/EC. See also Opinions 5/99 concerning the level of protection in Switzerland and Opinion 6/99 concerning the level of protection in Hungary, as well as Opinions 1/99, 2/99 and 4/99 and other documents concerning the ”Safe Harbor” dialogue with the United States: available at, see footnote 1. Many other countries are currently in the process of consolidating or developing their data protection and privacy policies.

[7] See Article 32 paragraph 4 of Directive 95/46/EC. The Commission has sent reasoned opinions to failing Member States and is currently preparing further action (see press release of 29 July, available at: see footnote 1).