Introductory text

THE COMMISSION OF THE EUROPEAN COMMUNITIES,

Having regard to the Treaty establishing the European Community,

Having regard to Decision No 2119/98/EC of the European Parliament and of the Council of 24 September 1998 setting up a network for the epidemiological surveillance and control of communicable diseases in the Community^f1, and in particular Article 6(5) thereof,

After consulting the European Data Protection Supervisor,

Whereas:

Commission Decision 2000/57/EC of 22 December 1999 on the early warning and response system for the prevention and control of communicable diseases under Decision No 2119/98/EC of the European Parliament and of the Council^f2 defines events related to communicable diseases to be communicated by competent public health authorities of Member States to the early warning and response system (EWRS) component of the Community network, and sets up general procedures for information exchange on those events, for consultation and for coordination of measures among Member States in liaison with the Commission.

Decision 2000/57/EC also commits competent public health authorities of each Member State to collect and exchange all necessary information on the events on communicable diseases, e.g. by using the national surveillance system, the epidemiological component of the Community network or any other Community collection system.

The prevention and control of communicable diseases is defined in Decision No 2119/98/EC as a range of measures, including epidemiological investigation, taken by competent public health authorities in the Member States to prevent and stop the spread of communicable diseases. These measures cover contact tracing activities and along with any relevant information in the possession of national competent public health authority on an event related to communicable diseases are promptly forwarded to all other Member States and the Commission. Furthermore a Member State, which intends to undertake measures, in principle informs in advance the Community network on the nature and scope of those measures, as well as consults and coordinates those actions with other Member States in liaison with the Commission.

Decision 2000/57/EC should clearly reflect the provisions of Decision No 2119/98/EC in relation with measures taken or intended to be adopted to prevent and stop the spread of communicable diseases.

Furthermore the entry into force of the International Health Regulations (2005) commits the international community to provide a public health response to the international spread of diseases in ways that are commensurate with and restricted to public health risks, and which avoid unnecessary interference with international traffic and trade.

In occurrence of an event related to communicable disease with a potential EU dimension necessitating contact tracing measures, Members States collaborate with each other in liaison with the Commission through the EWRS in order to identify infected persons and individuals potentially in danger. Such collaboration may involve an exchange of sensitive personal data of confirmed or suspected human cases between Member States concerned by the contact tracing procedure.

The processing of personal data related to health is in principle prohibited by provisions of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data^f3 and of Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data^f4. In addition Article 11 of Decision No 2119/98/EC states , inter alia, that its provisions shall apply without prejudice to Directive 95/46/EC.

For the public health reasons, the processing of such data is covered by the exemption granted by Article 8(3) of Directive 95/46/EC and Article 10(3) of Regulation (EC) No 45/2001, in so far as it is required for the purposes of preventive medicine, medical diagnosis and the provision of care or treatment or the management of health-care services, and where those data are processed by a health professional subject under national law or rules established by national competent bodies to the obligation of professional secrecy or by another person also subject to an equivalent obligation of secrecy. Furthermore, Article 23(1) of International Health Regulations (2005), which entered into force on 15 June 2007, provides that the States Parties to the World Health Organisation (WHO) may require for public health reasons, including contact tracing purposes, on arrival or departure, certain data regarding travellers.

In addition the processing of personal data for the purposes of contact tracing should be considered as lawful in so far as it is necessary in order to protect the vital interests of the data subject, in accordance with Article 7(d) of Directive 95/46/EC and with Article 5(e) of Regulation (EC) No 45/2001, and also for the performance of a task carried out in the public interest, in accordance with, respectively, Articles 7(e) and 5(a) of these Community acts.

The Commission, the European Centre for Disease Prevention and Control and the Member States should put in place appropriate safeguards in relation with the processing of personal data for the purpose of contact tracing, in particular concerning the use of derogation from provisions of Directive 95/46/EC and of Regulation (EC) No 45/2001, ensuring that they process personal data in the EWRS in compliance with, respectively, Regulation (EC) No 45/2001 and Directive 95/46/EC.

In particular when communicating personal data within the EWRS with a view to prevent and stop the spread of communicable diseases, the competent public health authorities of Member States and the Commission should ensure that personal data is adequate, relevant and not excessive in relation to that purpose as well as not processed for other purposes, and that it is accurate, updated when necessary and kept for no longer than necessary for that purpose; they should also ensure that persons subject to contact tracing are duly informed of the nature of the processing, of the data processed, of the rights to access and rectify data concerning them, unless this proves impossible or involves a disproportionate effort, and that appropriate levels of confidentiality and security are put in place within the EWRS to protect the processing of such data.

In its 2007 report^f5 on the operation of the EWRS, the Commission stressed the need for the introduction within EWRS of a selective messaging functionality to guarantee an exclusive communication channel only between Member States concerned by specific events related , inter alia, to contact tracing activities. The use of this selective functionality provides appropriate safeguards whenever personal data is communicated through the EWRS and should ensure that, for the implementation of this Decision, only adequate, relevant and not excessive personal data is circulated within the EWRS, in accordance with Article 4(1)(c) of Regulation (EC) No 45/2001 and Article 6(1)(c) of Directive 95/46/EC. For these reasons the use of the selective messaging functionality should be restricted to notifications involving the communication of relevant personal data, in order to be compatible with the obligations of the Member States under Articles 4, 5 and 6 of Decision No 2119/98/EC.

The measures provided for in this Decision are in accordance with the opinion of the Committee set up under Article 7 of Decision No 2119/98/EC,

HAS ADOPTED THIS DECISION: