• Lodge a complaint
  • Request for information
Questions about Europe?Your Europe - The portal to on-line European and national public servicesTreaty of Lisbon

Decision of the European Ombudsman on complaint 2467/2004/PB against the European Commission

Available languages: de.en
  • Case: 2467/2004/PB
    Opened on 14 Sep 2004 - Decision on 09 Jun 2006
  • Institution(s) concerned: European Commission
  • Field(s) of law: People's Europe
  • Types of maladministration alleged – (i) breach of, or (ii) breach of duties relating to: Lawfulness (incorrect application of substantive and/or procedural rules) [Article 4 ECGAB]

Strasbourg, 9 June 2006

Dear Mr D.,

On 7 August 2004, you made a complaint to the European Ombudsman concerning the European Commission's decision to end its inquiry into your infringement complaint no. 2003/4734, SG 03 A/5938/2.

On 14 September 2004, I forwarded the complaint to the President of the Commission. The Commission sent its opinion on 17 November 2004. I forwarded it to you with an invitation to make observations, which you sent on 15 December 2004. On 12 April 2005, you sent me an additional set of observations.

On 7 June 2005, I decided to invite the European Data Protection Supervisor to submit comments, and informed you accordingly on that same date. The European Data Protection Supervisor sent his reply on 29 June 2005. I forwarded it to you with an invitation to make observations, which you sent on 27 July 2005.

On 13 December 2005, I made a proposal for a friendly solution to your case, and informed you accordingly on the same date. The Commission sent its reply on 12 May 2006. I forwarded it to you with an invitation to make observations, which you sent on 29 May 2006.

I am writing now to let you know the results of the inquiries that have been made.

To avoid misunderstanding, it is important to recall that the EC Treaty empowers the Ombudsman to inquire into possible instances of maladministration only in the activities of Community institutions and bodies. The Statute of the Ombudsman specifically provides that no action by any other authority or person may be the subject of a complaint to the Ombudsman.

The Ombudsman's inquiries into your complaint have therefore been directed towards examining whether there has been maladministration in the activities of the European Commission.


THE COMPLAINT

The complainant, a German citizen, submitted infringement complaint no 2003/4734, SG 03 A/5938/2 to the Commission. This infringement complaint concerned the Registration Act of the State of Hamburg ("the Registration Act"). According to the complainant, this act breached Directive 95/46 of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data(1) ("the Data Protection Directive"). According to the complainant, the Registration Act allowed personal data in the State of Hamburg's possession to be handed over to third persons without the data subject's being informed or having the opportunity to object, and this was so even when it was clear that these third persons intended to sell the data for the purpose of direct marketing. In the complainant's view, this was a breach of Article 14(1)(b) of the Data Protection Directive. Article 14 provides as follows:

"Article 14

The data subject's right to object

Member States shall grant the data subject the right:

(a) at least in the cases referred to in Article 7 (e) and (f), to object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise provided by national legislation. Where there is a justified objection, the processing instigated by the controller may no longer involve those data;

(b) to object, on request and free of charge, to the processing of personal data relating to him which the controller anticipates being processed for the purposes of direct marketing, or to be informed before personal data are disclosed for the first time to third parties or used on their behalf for the purposes of direct marketing, and to be expressly offered the right to object free of charge to such disclosures or uses.

Member States shall take the necessary measures to ensure that data subjects are aware of the existence of the right referred to in the first subparagraph of (b)."

In support of his interpretation of Article 14(1)(b), the complainant referred to an opinion of the "Article 29 Data Protection Working Party" ("Opinion 7/2003 on the re-use of public sector information and the protection of personal data - Striking the balance", adopted on 12 December 2003(2)). The opinion was issued in relation to the Commission's proposal for a directive on the re-use of public sector documents(3). In this opinion, the Data Protection Working Party mentioned the right provided for in Article 14(1)(b) of the Data Protection Directive and - although not dealing with the issue specifically - mentioned the issue of direct marketing in various parts of the opinion.

The complainant also referred to a decision of the Administrative Court of Hamburg (VG Hamburg - reference 6 VG 3795/99) in which the court had found in favour of the complainant in a case against the State of Hamburg. The complainant had challenged a decision of the State of Hamburg to reject his request for an "information block" ("Auskunftssperre") in respect of his personal data in the public register. The complainant had requested such an information block in order to avoid direct marketing. The court found (i) that Article 14(1)(b) of the Data Protection Directive was directly applicable; (ii) that this article had not been properly implemented in the legislation of the State of Hamburg; and (iii) that the article should, on balance, be applied in the complainant's favour. The State of Hamburg appealed the decision.

By letters dated 14 January and 2 February 2004, the Commission informed the complainant that a separate right to object to all public bodies, including a public register, could not be deduced from Article 14(1)(b) of the Data Protection Directive. Specifically with regard to direct marketing, the Commission informed the complainant that Article 14(1)(b) only concerns the entity that actually intends to use the personal data for direct marketing. The public register, which collects and manages the personal data concerned, did not fall within this category.

In his complaint to the European Ombudsman, the complainant alleged, in summary, that the Commission's response to his infringement complaint was wrong in law. He claimed that the Commission should reopen its inquiry into his infringement complaint.

THE INQUIRY

The Commission's opinion

The complaint was forwarded to the Commission for an opinion.

In its opinion, the Commission stated that it had based its decision to close the case on the following considerations:

Article 14(1)(b) of the Data Protection Directive does indeed confer on data subjects the right to object to the use of personal data for the purpose of direct marketing. However, this right is directed against the controller, that is, the body planning to use the data for the purpose of direct marketing.

It is true that the wording of Article 14(1)(b) of the Data Protection Directive is not entirely clear in this respect, especially when read in conjunction with Article 2 b) and d) of the Directive.

However, the interpretation of the Directive should also take account of the legislator's intention, which was to ensure that Article 14(1)(b) applies only to those bodies which themselves intend to use personal data for their own direct marketing purposes.

This intention is clear from Article 14(1)(b), which refers to the anticipated processing for the purpose of direct marketing and which specifies, moreover, that public bodies which release such data are not themselves planning to process the data for direct marketing. The data are released pursuant to the public bodies' legal obligation to release such data (in this case Section 34 of the Registration Act).

Article 14(1)(b) of the Data Protection Directive has been transposed by Germany by means of Section 28(4) of the Federal Data Protection Act, which forbids non-public bodies and competitive public-law enterprises - and thus potential advertisers - from using personal data if the data subject files an objection.

However, an inherent right to object to the use of personal data by public bodies, such as a registration authority, cannot be inferred from either the wording or the intent of Article 14(1)(b) of the Data Protection Directive.

Opinion 7/2003 of the Article 29 Data Protection Working Party, to which the complainant had referred, does not change this legal assessment. Although reference was made in this opinion to the right of objection set out in Article 14 of the Data Protection Directive, this related to the direct marketing body itself, not to the public body.

This being the case, the Commission had seen no reason why it should reconsider its position.

At the end of its opinion, the Commission stated that it was holding bilateral talks with the Member States and national data protection authorities in order to discuss implementation of the Data Protection Directive. The Commission stated that it was considering bringing up the issue of the release of registration data in these talks.

The complainant's observations

The Commission's opinion was forwarded to the complainant who submitted observations.

In his observations, the complainant maintained his complaint.

Further inquiries

After careful consideration of the Commission's opinion and the complainant's observations, the Ombudsman considered that it would be appropriate to consult the European Data Protection Supervisor ("EDPS"). On 7 June 2005, the Ombudsman therefore invited the EDPS to submit comments on the interpretation of Article 14(1)(b) of the Data Protection Directive.

The opinion of the European Data Protection Supervisor

The EDPS replied on 20 June 2005, making the following comments:

Article 14(1)(b) of the Directive provides for the data subject's right to object to the processing of his personal data for the purpose of direct marketing. Unlike the right to object on "compelling legitimate grounds relating to his particular situation", as referred to in Article 14(1)(a), which requires a further evaluation to determine whether an objection is justified or not, the right to object as described in Article 14(1)(b) is absolute in the sense that no further balancing of interests is required.

It should be noted, however, that Article 14(1)(b) provides for alternative options concerning individuals' control over the disclosure of their personal data, from which Member States may choose.

The first option concerns the right for the data subject to object, on request and free of charge, to the processing of personal data relating to him/her which the controller anticipates being processed for the purpose of direct marketing. The second option ensures the right to be informed before personal data are disclosed for the first time to third parties or used on their behalf for the purpose of direct marketing, and to be expressly offered the right to object free of charge to such disclosures or uses.

Where a Member State prefers the first option, it has to take the necessary measures to ensure that data subjects are aware of the existence of the right referred to in that option. This is stated in Article 14(2), which refers to "the first subparagraph of (b)". The structure of these provisions is clearly evident in the French text of the Directive and implicit in the English and the German versions.

The options mentioned in Article 14(1) do not seem to be fully equivalent. The first option aims at the controller and seems to require that the controller himself/herself "has the intention" to process data for the purpose of direct marketing. The second option concentrates on disclosure to or use on behalf of third parties for the purposes of direct marketing. However, in reality, there is likely to be some overlap between the two options, particularly where a controller processes data with a view to making them available to third parties for the purpose of direct marketing.

Whatever the scenario might be, it seems clear that Article 14(1)(b) only applies to cases where personal data are to be processed "for the purposes of direct marketing". In other words, it does not provide for a general right to object to a transfer to third parties, where there is only a possibility that personal data will be processed for direct marketing, as will be the usual case for public access to data in public sector files.

Although the Commission's opinion does not seem to fully reflect the scope of Article 14(1)(b) as indicated above, a broader analysis along these lines would most probably not lead to different conclusions.

The complainant's observations

On 27 July 2005, the complainant submitted his observations. He essentially maintained his views and stated that, if the EDPS's interpretation were to be confirmed, the matter ought to be submitted to the European Parliament for examination. He added that the EDPS's opinion was formulated in cautious or even uncertain terms, and that the EDPS appeared to recognise that there was a discrepancy between the Directive and practice(4).

THE OMBUDSMAN'S EFFORTS TO ACHIEVE A FRIENDLY SOLUTION

After careful consideration of the opinions and observations, the Ombudsman was not satisfied that the Commission had responded adequately to the complainant's allegation and claim. In accordance with Article 3(5) of the Ombudsman's Statute(5), the Ombudsman therefore wrote to the President of the Commission to propose a friendly solution on the basis of the following analysis of the issues in dispute between the complainant and the Commission:

The reasons for a proposal for a friendly solution
1 Allegation of wrong interpretation - scope of Article 14(1)(b) of the Data Protection Directive

1.1 The complainant, a German citizen, submitted infringement complaint no 2003/4734, SG 03 A/5938/2 to the European Commission. This infringement complaint concerned the Registration Act of the State of Hamburg ("the Registration Act"). According to the complainant, this act breached Directive 95/46 of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data(6) ("the Data Protection Directive"). According to the complainant, the Registration Act allowed personal data in the State of Hamburg's possession to be handed over to third persons without the data subject's being informed or having the opportunity to object, even when it was clear that these third persons intended to sell the data for the purpose of direct marketing. In the complainant's view, this was a breach of Article 14(1)(b) of the Data Protection Directive. By letters dated 14 January and 2 February 2004, the Commission informed the complainant that a separate right to object to all public bodies, including a public register, could not be deduced from Article 14(1)(b) of the Data Protection Directive. Specifically with regard to direct marketing, the Commission informed the complainant that Article 14(1)(b) only concerns the entity that actually intends to use the personal data for direct marketing. The public register, which collects and manages the personal data concerned, did not fall within this category. In his complaint to the European Ombudsman, the complainant alleged that the Commission's response to his infringement complaint was wrong in law. He claimed that the Commission should reopen its inquiry into his infringement complaint.

1.2 In its opinion, the Commission maintained the view it had already provided to the complainant. It stated that the wording of Article 14(1)(b) of the Data Protection Directive is not entirely clear, especially when read in conjunction with Article 2 b) and d) of the Directive. However, the interpretation of the Directive should also take account of the legislator's intention, which was to ensure that Article 14(1)(b) applies only to those bodies which themselves intend to use personal data for their own direct marketing purposes. This intention is clear from Article 14(1)(b) as it refers to the anticipated processing for the purpose of direct marketing. (Public bodies which release such data are not themselves planning to process the data for direct marketing. They forward the data pursuant to their legal obligations conferred upon them - in this case Section 34 of the Registration Act.) Article 14(1)(b) of the Data Protection Directive has been transposed by Germany by means of Section 28(4) of the Federal Data Protection Act, which forbids non-public bodies and competitive public-law enterprises - and thus potential advertisers - from using personal data if the data subject files an objection. However, an inherent right to object to the use of personal data by public bodies, such as a registration authority, cannot be inferred from either the wording or the intent of Article 14(1)(b) of the Data Protection Directive.

1.3 In his observations on the Commission's opinion, the complainant maintained his allegation and claim.

1.4 After careful consideration of the Commission's opinion and the complainant's observations, the Ombudsman considered that it would be appropriate to consult the EDPS. On 7 June 2005, the Ombudsman therefore invited the EDPS to submit comments on the interpretation of Article 14(1)(b) of the Data Protection Directive. In his opinion, the EDPS noted, in particular, the following:

Article 14(1)(b) of the Directive provides for alternative options concerning individuals' control over the disclosure of their personal data, from which Member States may choose. The first option concerns the right for the data subject to object, on request and free of charge, to the processing of personal data relating to him/her which the controller anticipates being processed for the purpose of direct marketing. The second option ensures the right to be informed before personal data are disclosed for the first time to third parties or used on their behalf for the purpose of direct marketing, and to be expressly offered the right to object free of charge to such disclosures or uses. Where a Member State prefers the first option, it has to take the necessary measures to ensure that data subjects are aware of the existence of the right referred to in that option. This is stated in Article 14(2), which refers to "the first subparagraph of (b)". The structure of these provisions is clearly visible in the French text of the Directive and more implicit in the English and the German versions. The options mentioned in Article 14(1) do not seem to be fully equivalent. The first option aims at the controller and seems to require that the controller himself/herself "has the intention" to process data for the purpose of direct marketing. The second option concentrates on disclosure to, or use on behalf of, third parties for the purposes of direct marketing. However, in reality, there is likely to be some overlap, particularly where a controller processes data with a view to making them available to third parties for the purpose of direct marketing. Whatever the scenario might be, it seems clear that Article 14(1)(b) only applies to cases in which personal data are to be processed "for the purposes of direct marketing". In other words, it does not provide for a general right to object to a transfer to third parties, where there is only a possibility that personal data will be processed for direct marketing, as will be the usual case for public access to data in public sector files.

1.5 In its opinion, the Commission essentially explained that it considered Article 14(1)(b) to apply only in respect of those bodies which themselves intend to use personal data for their own direct marketing purposes. The Commission furthermore appeared to consider that such bodies could only be non-public bodies or competitive public-law enterprises(7). In his opinion, the EDPS stated that Article 14(1)(b) may also cover the situation where a controller processes data with a view to making them available to third parties for the purpose of direct marketing. The EDPS concluded, however, that Article 14(1)(b) does not provide for a general right to object to a transfer to third parties, where there is only a possibility that personal data will be processed for direct marketing, as will be the usual case for public access to data in public sector files.

1.6 The Ombudsman noted that, according to Article 2(b) of the Data Protection Directive, "processing" of personal data "shall mean any operation or set of operations which is performed upon personal data [...]"(8). Furthermore, Article 2(d) of the Directive provides that "'controller' shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data". "Processing" and "controller", as referred to in Article 14(1)(b) of the Directive, cannot be interpreted more narrowly than this. The Commission's view that Article 14(1)(b) only applies in respect of those bodies which themselves intend to use personal data for their own direct marketing purposes did, however, imply a narrower interpretation of "processing", in that it excluded, inter alia, processing acts such as "disclosure by transmission, dissemination or otherwise making available" (Article 2(b)). The Commission's interpretation furthermore appeared to exclude from the scope of "controller" in Article 14(1)(b) public authorities and bodies which do not constitute "competitive public-law enterprises" (cf. remarks in point 1.5 above), notwithstanding the explicit reference to "public authority" in Article 2(d) of the Directive, and despite the fact that the text of Article 14(1)(b) does not make any such distinction.

1.7 In its opinion, the Commission indicated that its interpretation referred to above reflects "the legislator's intention". However, the Commission had not provided any concrete information in that regard.

1.8 In light of the foregoing, the Ombudsman considered that the Commission had failed to provide valid and convincing arguments for its interpretation of Article 14(1)(b), on the basis of which it considered that this provision could not apply to the circumstances referred to by the complainant, and which had led it to reply as it did. The Ombudsman found that this could be an instance of maladministration, and therefore made the proposal for a friendly solution below.

The proposal for a friendly solution

The Ombudsman proposed to the Commission that it could consider re-examining its reply to the complainant and reopening its inquiry into the issues raised in the complainant's infringement complaint.

The European Commission's reply
Interpretation of Article 14(1)(b) of the Data Protection Directive

The Commission had decided to undertake a renewed legal analysis of the case and of its own interpretation of Article 14(1)(b) of the Data Protection Directive in light of the arguments put forward by the complainant and by the Ombudsman, in his friendly solution proposal.

The right to object to the use of personal data for the purposes of direct marketing laid down in Article 14(1)(b) of the Directive is an additional subjective right of the data subject without limits or additional conditions. This right is directed against the controller, be it in the public sector or in the private sector, as the provisions of the Data Protection Directive apply to both. The Commission has not limited in any way its scope to non-public bodies or competitive public-law enterprises, which are the subjects of Section 28(4) of the German Federal Data Protection Act.

Therefore, it is necessary for Member States to ensure that Article 14(1)(b) applies first and foremost to those controllers which themselves intend to use personal data for their own direct marketing purposes. This interpretation is supported by the German language version of the text ("gegen eine vom für die Verarbeitung Verantwortlichen beabsichtigte Verarbeitung").

However, as the Commission already noted in its reply of 17 November 2004, the wording of Article 14(1)(b) of the Data Protection Directive is not entirely unambiguous in this respect, particularly when read in conjunction with Article 2(b) (definition of "processing") and (d) (definition of "controller"). The Commission has reviewed the English and French language versions ("which the controller anticipates"; "au traitement des données à caractère personnel la concernant envisagé par le responsable du traitement") and takes the view that these language versions could also be interpreted as focussing not only on the intention of the controller but also on specific knowledge of a processing operation for the purpose of direct marketing. These purposes could be those of the controller or those of a third party.

Results of the structured dialogue with Member States and German laws

The legal landscape in the European Community and in Germany is not uniform:

(a) In the European Community, the outcome of the structured dialogue with Member States on the implementation of the Directive undertaken by the Data Protection Unit in the Directorate-General for Freedom, Security and Justice shows that most Member States have interpreted Article 14(1)(b) of the Data Protection Directive in a broad way, granting a general right to object to all processing operations for the purposes of direct marketing. In consequence, the Commission intends to build on this recently gathered information and will address the issue of a slightly wider interpretation of Article 14(1)(b) of the Data Protection Directive with Member States. The expected result will be an improvement of national legislation, ensured through proper implementation of the general right to object to all processing operations for the purpose of direct marketing and thereby benefiting citizens in the Member States.

(b) Certain German Länder guarantee a right to object for direct marketing purposes in the specific case when directory publishers (private companies) request personal data from the Registry offices. In the meantime, prompted by a modification in the German Federal Framework Registration Act, the Hamburg law introduces a general right of individuals to object in respect to information requests by private parties made over the internet.

Future steps to be taken by the Commission

Acknowledging that a slightly wider interpretation of Article 14(1)(b) of the Data Protection Directive might be required, the Commission intends to address the issue of a wider interpretation with the Member States. In this context, the Commission will also address the specific case of Hamburg's legislation. The complainant will be informed accordingly.

The complainant's observations

The complainant welcomed the Commission's reply to the Ombudsman's friendly solution proposal, which he considered successful. He thanked the Ombudsman for his handling of the case.

THE DECISION

1 Allegation of wrong interpretation - scope of Article 14(1)(b) of the Data Protection Directive

1.1 The complainant, a German citizen, submitted an infringement complaint to the European Commission. The infringement complaint concerned the Registration Act of the State of Hamburg ("the Registration Act"). According to the complainant, this act breached Directive 95/46 of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data(9) ("the Data Protection Directive").

According to the complainant, the Registration Act allowed personal data in the State of Hamburg's possession to be handed over to third persons without the data subject's being informed or having the opportunity to object, even when it was clear that these third persons intended to sell the data for the purpose of direct marketing. In the complainant's view, this was a breach of Article 14(1)(b) of the Data Protection Directive(10).

By letters dated 14 January and 2 February 2004, the Commission informed the complainant that a separate right to object to all public bodies, including a public register, could not be deduced from Article 14(1)(b) of the Data Protection Directive.

Specifically with regard to direct marketing, the Commission informed the complainant that Article 14(1)(b) only concerns the entity that actually intends to use the personal data for direct marketing. The public register, which collects and manages the personal data concerned, did not fall within this category.

In his complaint to the European Ombudsman, the complainant alleged that the Commission's response to his infringement complaint was wrong in law. He claimed that the Commission should reopen its inquiry into his infringement complaint.

1.2 In its opinion, the Commission maintained the view it had already provided the complainant. It stated that the wording of Article 14(1)(b) of the Data Protection Directive is not entirely clear, especially when read in conjunction with Article 2 b) and d) of the Directive. However, the interpretation of the Directive should also take account of the legislator's intention, which was to ensure that Article 14(1)(b) applies only to those bodies which themselves intend to use personal data for their own direct marketing purposes. This intention is clear from Article 14(1)(b) when it talks of the anticipated processing for the purpose of direct marketing. (Public bodies which release such data are not themselves planning to process the data for direct marketing. They forward the data pursuant to their legal obligations conferred upon them - in this case Section 34 of the Registration Act.) Article 14(1)(b) of the Data Protection Directive has been transposed by Germany by means of Section 28(4) of the Federal Data Protection Act, which forbids non-public bodies and competitive public-law enterprises - and thus potential advertisers - from using personal data if the data subject files an objection. However, an inherent right to object to the use of such personal data by public bodies, such as a registration authority, cannot be inferred from either the wording or the intent of Article 14(1)(b) of the Data Protection Directive.

1.3 In his observations on the Commission's opinion, the complainant maintained his allegation and claim. On 7 June 2005, the Ombudsman asked the European Data Protection Supervisor ("EDPS") to give his opinion on this issue, which was sent to the Ombudsman on 29 June 2005.

1.4 On 13 December 2005, the Ombudsman made a friendly solution proposal. In his letter to the Commission, the Ombudsman noted that, according to Article 2(b) of the Data Protection Directive, "processing" of personal data "shall mean any operation or set of operations which is performed upon personal data [...]"(11). Furthermore, Article 2(d) of the Directive provides that " 'controller' shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data". "Processing" and "controller", as referred to in Article 14(1)(b) of the Directive, cannot be interpreted more narrowly than this.

The Commission's view that Article 14(1)(b) only applies in respect of those bodies which themselves intend to use personal data for their owndirect marketing purposes did, however, imply a narrower interpretation of "processing", in that it excluded, inter alia, processing acts such as "disclosure by transmission, dissemination or otherwise making available" (Article 2(b)). The Commission's interpretation furthermore appeared to exclude from the scope of "controller" in Article 14(1)(b) public authorities and bodies which do not constitute "competitive public-law enterprises", notwithstanding the explicit reference to "public authority" in Article 2(d) of the Directive, and despite the fact that the text of Article 14(1)(b) does not make any such distinction.

1.5 In light of the foregoing, the Ombudsman considered that the Commission had failed to provide valid and convincing arguments for its interpretation of Article 14(1)(b), on the basis of which it considered that this provision could not apply to the circumstances referred to by the complainant, and which had led it to reply as it did.

The Ombudsman found that this could be an instance of maladministration, and therefore made a friendly solution proposal according to which the Commission could consider re-examining its reply to the complainant and consider reopening its inquiry into the issues raised in the complainant's infringement complaint.

1.6 In its reply to the Ombudsman's proposal for a friendly solution, the Commission set out a renewed legal analysis that it had undertaken in light of the arguments presented in the Ombudsman's friendly solution proposal. The Commission noted, inter alia, that it had reviewed the English and French language versions of Article 14(1)(b) of the Directive ("which the controller anticipates"; "au traitement des données à caractère personnel la concernant envisagé par le responsable du traitement") and would take the view that these language versions could also be interpreted as focussing not only on the intention of the controller but also on specific knowledge of a processing operation for the purpose of direct marketing. These purposes could be those of the controller or those of a third party.

The Commission thus acknowledged that a wider interpretation of Article 14(1)(b) of the Data Protection Directive might be required. It would therefore address the issue of a wider interpretation of Article 14(1)(b) of the Data Protection Directive with the Member States. In this context, the Commission would also address the specific case of Hamburg's legislation. The Commission undertook to keep the complainant duly informed.

1.7 In his observations, the complainant welcomed the Commission's reply to the friendly solution proposal, which he considered successful, and thanked the Ombudsman for his handling of the case.

Conclusion

Following the Ombudsman's initiative, it appears that a friendly solution to the complaint has been achieved. The Ombudsman therefore closes the case.

The President of the Commission will also be informed of this decision.

A copy of the Ombudsman's decision will also be sent to the European Data Protection Supervisor for information.

Yours sincerely,

 

P. Nikiforos DIAMANDOUROS


(1) Official Journal 1995 L 281 p. 31.

(2) http://europa.eu.int/comm/internal_market/privacy/workingroup/wp2005/wpdocs05_en.htm

(3) The proposal led to Directive 2003/98/EC of the European Parliament and of the Council on the re-use of public sector documents, Official Journal 2003 L 345 p. 90.

(4) The complainant referred to the following part of the EDPS's opinion:

"The options mentioned in Article 14(1) do not seem to be fully equivalent. The first option aims at the controller and seems to require that he himself intends to process data for the purpose of direct marketing. The second option concentrates on disclosure to or use on behalf of third parties for the purposes of direct marketing. However, in reality there is likely to be some overlap, particularly where a controller processes data with a view to making them available to third parties for the purpose of direct marketing."

(5) Decision 94/262 of 9 March 1994 of the European Parliament on the Regulations and General Conditions Governing the Performance of the Ombudsman's Duties, Official Journal 1994 L 113, p. 15.

(6) Official Journal 1995 L 281 p. 31.

(7) The Commission stated in its opinion that "Article 14(1)(b) of the Data Protection Directive has been transposed by Germany by means of Section 28(4) of the Federal Data Protection Act, which forbids non-public bodies and competitive public-law enterprises - and thus potential advertisers - from using personal data if the data subject files an objection", and that "an inherent right to object to public bodies, e.g. a registration authority, cannot be inferred from either the wording or the intent of Article 14(1)(b) of the Data Protection Directive".

(8) Article 2(b) of the Data Protection Directive defines "processing of personal data" as "any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction".

(9) Official Journal 1995 L 281 p. 31.

(10) "The data subject's right to object

Member States shall grant the data subject the right:

(a) at least in the cases referred to in Article 7 (e) and (f), to object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise provided by national legislation. Where there is a justified objection, the processing instigated by the controller may no longer involve those data;

(b) to object, on request and free of charge, to the processing of personal data relating to him which the controller anticipates being processed for the purposes of direct marketing, or to be informed before personal data are disclosed for the first time to third parties or used on their behalf for the purposes of direct marketing, and to be expressly offered the right to object free of charge to such disclosures or uses.

Member States shall take the necessary measures to ensure that data subjects are aware of the existence of the right referred to in the first subparagraph of (b)."

(11) Article 2(b) of the Data Protection Directive defines "processing of personal data" as "any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction".