Commission Decision

of 10 July 2009

amending Decision 2000/57/EC on the early warning and response system for the prevention and control of communicable diseases under Decision No 2119/98/EC of the European Parliament and of the Council

(notified under document number C(2009) 5515)

(Text with EEA relevance)

(2009/547/EC)

THE COMMISSION OF THE EUROPEAN COMMUNITIES,

Having regard to the Treaty establishing the European Community,

Having regard to Decision No 2119/98/EC of the European Parliament and of the Council of 24 September 1998 setting up a network for the epidemiological surveillance and control of communicable diseases in the Community [1], and in particular Article 6(5) thereof,

After consulting the European Data Protection Supervisor,

Whereas:

(1) Commission Decision 2000/57/EC of 22 December 1999 on the early warning and response system for the prevention and control of communicable diseases under Decision No 2119/98/EC of the European Parliament and of the Council [2] defines events related to communicable diseases to be communicated by competent public health authorities of Member States to the early warning and response system (EWRS) component of the Community network, and sets up general procedures for information exchange on those events, for consultation and for coordination of measures among Member States in liaison with the Commission.

(2) Decision 2000/57/EC also commits competent public health authorities of each Member State to collect and exchange all necessary information on the events on communicable diseases, e.g. by using the national surveillance system, the epidemiological component of the Community network or any other Community collection system.

(3) The prevention and control of communicable diseases is defined in Decision No 2119/98/EC as a range of measures, including epidemiological investigation, taken by competent public health authorities in the Member States to prevent and stop the spread of communicable diseases. These measures cover contact tracing activities and along with any relevant information in the possession of national competent public health authority on an event related to communicable diseases are promptly forwarded to all other Member States and the Commission. Furthermore a Member State, which intends to undertake measures, in principle informs in advance the Community network on the nature and scope of those measures, as well as consults and coordinates those actions with other Member States in liaison with the Commission.

(4) Decision 2000/57/EC should clearly reflect the provisions of Decision No 2119/98/EC in relation with measures taken or intended to be adopted to prevent and stop the spread of communicable diseases.

(5) Furthermore the entry into force of the International Health Regulations (2005) commits the international community to provide a public health response to the international spread of diseases in ways that are commensurate with and restricted to public health risks, and which avoid unnecessary interference with international traffic and trade.

(6) In occurrence of an event related to communicable disease with a potential EU dimension necessitating contact tracing measures, Members States collaborate with each other in liaison with the Commission through the EWRS in order to identify infected persons and individuals potentially in danger. Such collaboration may involve an exchange of sensitive personal data of confirmed or suspected human cases between Member States concerned by the contact tracing procedure.

(7) The processing of personal data related to health is in principle prohibited by provisions of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data [3] and of Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data [4]. In addition Article 11 of Decision No 2119/98/EC states , inter alia, that its provisions shall apply without prejudice to Directive 95/46/EC.

(8) For the public health reasons, the processing of such data is covered by the exemption granted by Article 8(3) of Directive 95/46/EC and Article 10(3) of Regulation (EC) No 45/2001, in so far as it is required for the purposes of preventive medicine, medical diagnosis and the provision of care or treatment or the management of health-care services, and where those data are processed by a health professional subject under national law or rules established by national competent bodies to the obligation of professional secrecy or by another person also subject to an equivalent obligation of secrecy. Furthermore, Article 23(1) of International Health Regulations (2005), which entered into force on 15 June 2007, provides that the States Parties to the World Health Organisation (WHO) may require for public health reasons, including contact tracing purposes, on arrival or departure, certain data regarding travellers.

(9) In addition the processing of personal data for the purposes of contact tracing should be considered as lawful in so far as it is necessary in order to protect the vital interests of the data subject, in accordance with Article 7(d) of Directive 95/46/EC and with Article 5(e) of Regulation (EC) No 45/2001, and also for the performance of a task carried out in the public interest, in accordance with, respectively, Articles 7(e) and 5(a) of these Community acts.

(10) The Commission, the European Centre for Disease Prevention and Control and the Member States should put in place appropriate safeguards in relation with the processing of personal data for the purpose of contact tracing, in particular concerning the use of derogation from provisions of Directive 95/46/EC and of Regulation (EC) No 45/2001, ensuring that they process personal data in the EWRS in compliance with, respectively, Regulation (EC) No 45/2001 and Directive 95/46/EC.

(11) In particular when communicating personal data within the EWRS with a view to prevent and stop the spread of communicable diseases, the competent public health authorities of Member States and the Commission should ensure that personal data is adequate, relevant and not excessive in relation to that purpose as well as not processed for other purposes, and that it is accurate, updated when necessary and kept for no longer than necessary for that purpose; they should also ensure that persons subject to contact tracing are duly informed of the nature of the processing, of the data processed, of the rights to access and rectify data concerning them, unless this proves impossible or involves a disproportionate effort, and that appropriate levels of confidentiality and security are put in place within the EWRS to protect the processing of such data.

(12) In its 2007 report [5] on the operation of the EWRS, the Commission stressed the need for the introduction within EWRS of a selective messaging functionality to guarantee an exclusive communication channel only between Member States concerned by specific events related , inter alia, to contact tracing activities. The use of this selective functionality provides appropriate safeguards whenever personal data is communicated through the EWRS and should ensure that, for the implementation of this Decision, only adequate, relevant and not excessive personal data is circulated within the EWRS, in accordance with Article 4(1)(c) of Regulation (EC) No 45/2001 and Article 6(1)(c) of Directive 95/46/EC. For these reasons the use of the selective messaging functionality should be restricted to notifications involving the communication of relevant personal data, in order to be compatible with the obligations of the Member States under Articles 4, 5 and 6 of Decision No 2119/98/EC.

(13) The measures provided for in this Decision are in accordance with the opinion of the Committee set up under Article 7 of Decision No 2119/98/EC,

HAS ADOPTED THIS DECISION:

Article 1

Decision 2000/57/EC is amended as follows:

1. in Article 1(2), the wording "information on these events" is replaced by "information on these events and measures intended or adopted in response to those events or indications for such events";

2. the following Article 2a is inserted:

"Article 2a

1. This Article shall apply to measures implemented in order to trace persons who have been exposed to a source of infectious agents, and who are potentially in danger of developing or have developed a communicable disease of Community relevance according to the criteria laid down in Annex I (hereinafter referred as "contact tracing").

2. When communicating relevant personal data for contact tracing purposes through the early warning and response system, provided that those data are needed and available, competent public health authorities of a Member State shall use the selective messaging functionality which guarantees appropriate data protection safeguards. That communication channel shall be limited to the Member States concerned by the contact tracing.

3. When circulating that information through the selective messaging functionality, the competent public health authorities of that Member State shall refer to the event or measure communicated previously to the Community network.

4. For the purpose of paragraph 2, an indicative list of the personal data is provided in Annex III.

5. When communicating and circulating personal data through the selective messaging functionality, the competent health authorities of the Member States and the Commission shall comply with the provisions of Directive 95/46/EC of the European Parliament and of the Council [******] and of Regulation (EC) No 45/2001 of the European Parliament and of the Council [].

3. in Article 3, paragraph 1 is replaced by the following:

"1. Every year, the competent authorities in Member States shall submit to the Commission not later than 31 March an analytical report of the events, measures intended or adopted in relation to those events and on the procedures applied within the early warning and response system. In addition, the competent authorities in Member States may on a timely basis report on specific events of particular significance.";

4. the text in Annex to this Decision is added as Annex III.

Article 2

This Decision is addressed to the Member States.

Done at Brussels, 10 July 2009.

For the Commission

Androulla Vassiliou

Member of the Commission

[1] OJ L 268, 3.10.1998, p. 1.

[2] OJ L 21, 26.1.2000, p. 32.

[3] OJ L 281, 23.11.1995, p. 31.

[4] OJ L 8, 12.1.2001, p. 1.

[5] Report form the Commission to the Council and to the European Parliament on the operation of the Early Warning and Response Systems (EWRS) of the Community Network for the epidemiological surveillance and control of communicable diseases during years 2004 and 2005 (Decision 2000/57/EC) of 20 March 2007 (COM(2007) 121 final).

[******] OJ L 281, 23.11.1995, p. 31.

[] OJ L 8, 12.1.2001, p. 1.";

--------------------------------------------------

ANNEX

The following Annex III is added to Decision 2000/57/EC:

"ANNEX III

Indicative list of personal data for the purpose of contact tracing

1. PERSONAL INFORMATION

- Name and given names,

- Nationality, date of birth, sex,

- ID type, number and issuing authority,

- Current home address (street name and nr, city, country, postal code),

- Telephone numbers (mobile, residential, business),

- E-mail (private, business).

2. TRAVEL SPECIFICATIONS

- Conveyance data (e.g. flight number, date of flight, ship name, plate number),

- Seat number(s),

- Cabin number(s).

3. CONTACT INFORMATION

- Names of visited persons/places of stay,

- Dates and addresses of the places of stay (street name and nr, city, country, postal code),

- Telephone numbers (mobile, residential, business),

- E-mail (private, business).

4. INFORMATION ON ACCOMPANYING PERSONS

- Name and given names,

- Nationality,

- Personal information as laid down in point 1, indents 3-6.

5. EMERGENCY CONTACT DETAILS

- Name of person to be contacted,

- Address (street name and nr, city, country, postal code),

- Telephone numbers (mobile, residential, business),

- E-mail (private, business)".

--------------------------------------------------