title: Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the institutions and bodies of the Community and on the free movement of such data

eurovoc_concepts:
EU institution
confidentiality
data processing
personal data
protection of privacy

text: C 376 E/24 EN Official Journal of the European Communities 28. 12. 1999 Proposal for a regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the institutions and bodies of the Community and on the free movement of such data (1999/C 376 E/04) (Text with EEA relevance) COM(1999) 337 final (cid:151) 1999/0153(COD) (Submitted by the Commission on 17 September 1999) THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION, should not apply to data rendered anonymous in such a way that the data subject is no longer identifiable. Having regard to the Treaty establishing the European Community and in particular Article 286 thereof, Having regard to the proposal from the Commission, Having regard to the opinion of Committee, the Economic and Social Acting in accordance with the procedure laid down in Article 251 of the Treaty, Whereas: (1) Article 286 of the Treaty requires the application to the Community institutions and bodies of the Community acts on the protection of individuals with regard to the processing of personal data and the free movement of such data. (2) A fully-fledged system of protection of personal data not only requires the establishment of rights for data subjects and obligations for those who process personal data, but also appropriate sanctions for offenders and monitoring by an independent supervisory body. (3) Article 286(2) of the Treaty requires the establishment of an independent supervisory body responsible for moni- toring the application of to Community institutions and bodies. such Community acts (4) Article 286(2) of the Treaty requires the adoption of any other relevant provisions as appropriate. (5) A regulation is necessary to provide the individual with legally enforceable rights, to specify the processing obli- gations of the controllers within the Community insti- tutions and bodies, and to create an independent super- visory body responsible for the external monitoring of Community processing of data. (6) The principles of data protection must apply to any information concerning an identified or identifiable person. To determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person. The principles of protection (7) Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of indi- viduals with regard to the processing of personal data and on the free movement of such data (1) requires Member States to protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data, in order to ensure in the Community. flow of personal data free the (8) Directive 97/66/EC of the European Parliament and of the Council of 15 December 1997 concerning the processing of personal data and the protection of privacy in the and particularises sector (2) telecommunications complements Directive 95/46/EC with respect to the processing of personal data in the telecommunications sector. (9) Various other Community measures, including measures on mutual assistance between national authorities and the Commission, are also designed to particularise and complement Directive 95/46/EC in the sectors to which they relate. (10) Consistent and homogeneous application of the rules for rights and the protection of individuals, freedoms with regard to the processing of personal data must be ensured throughout the Community. fundamental (11) The aim is to ensure both effective compliance with the rules governing the protection of individuals’ fundamental rights and freedoms and the free flow of personal data between Member States and the Community institutions and bodies or between the Community institutions and bodies for purposes connected with the exercise of their respective competences. (12) This can best be achieved by adopting measures which are binding on the Community institutions and bodies. These measures should apply to all processing of personal data by Community institutions and bodies in the exercise of their competences under the Treaties establishing the European Communities and the Treaty on European Union. (1) OJ L 281, 23. 11. 1995, p. 31. (2) OJ L 24, 30. 1. 1998, p. 1. 28. 12. 1999 EN Official Journal of the European Communities C 376 E/25 (13) The measures must be identical to the provisions laid down in connection with the harmonisation of national laws or the implementation of other Community policies, notably in the mutual assistance sphere. It may be necessary, however, to particularise and complement those provisions when it comes to ensuring protection in the case of the processing of personal data by the Community institutions and bodies. (14) This holds true for the rights of the individuals whose data are being processed, the Community institutions and bodies doing the processing, and for the powers to be vested in the independent super- visory body responsible for ensuring that this Regulation is properly applied. the obligations of for carried out (15) Processing of personal data for the performance of the the in the public tasks Community the and processing of personal data necessary for the management and functioning of those institutions and bodies. interest by includes institutions bodies (16) It may be necessary to monitor the computer networks operated under the control of the Community institutions and bodies for the purposes of prevention of unauthorised use. The European Data Protection Supervisor should determine whether and under what conditions that is possible. (17) Under Article 21 of Council Regulation (EC) No 322/97 of 17 February 1997 on Community statistics (1), that Regu- lation is to apply without prejudice to Directive 95/46/EC. the funda- Community institutions or bodies, shall protect mental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data. 2. The independent supervisory body established by this Regulation, hereinafter referred to as European Data Protection Supervisor, shall monitor the application of the provisions of this Regulation to all processing operations carried out by a Community institution or body. Article 2 Definitions For the purposes of this Regulation: (a) (cid:145)personal data(cid:146) shall mean any information relating to an identified or identifiable natural person ((cid:145)data subject(cid:146)); an identifiable person is one who can be identified, directly or in particular by reference to an identification indirectly, number or to one or more factors specific to his/her physical, physiological, mental, cultural or social identity; economic, (b) (cid:145)processing of personal data(cid:146) ((cid:145)processing(cid:146)) shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by trans- mission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction; (18) For reasons of transparency, it is necessary to make public further information on the application of this Regulation, including a list of the Community institutions and bodies which are subject to this Regulation. (c) (cid:145)personal data filing system(cid:146) ((cid:145)filing system(cid:146)) shall mean any structured set of personal data which are accessible according to specific criteria, whether centralised, decen- tralised or dispersed on a functional or geographical basis; (19) The Working Party on the Protection of Individuals with regard to the processing of personal data set up under Article 29 of Directive 95/46/EC has delivered its opinion, HAVE ADOPTED THIS REGULATION: CHAPTER I GENERAL PROVISIONS Article 1 Object of the Regulation In accordance with this Regulation, the institutions and 1. bodies set up by, or on the basis of, the Treaties establishing to as the European Communities, hereinafter referred (1) OJ L 52, 22. 2. 1997, p. 1. (d) (cid:145)controller(cid:146) shall mean the Community institution or body, the Directorate General, the unit or any other organisa- tional entity which alone or jointly with others determines the purposes and means of the processing of personal data; where are determined by a specific Community act, the controller or the specific criteria for its nomination may be designated by such Community act; and means of processing the purposes (e) (cid:145)processor(cid:146) shall mean a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller; (f) (cid:145)third party(cid:146) shall mean any natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or the processor, are auth- orised to process the data; C 376 E/26 EN Official Journal of the European Communities 28. 12. 1999 (g) (cid:145)recipient(cid:146) shall mean a natural or legal person, public authority, agency or any other body to whom data are disclosed, whether a third party or not; however, authorities which may receive data in the framework of a particular inquiry shall not be regarded as recipients; (h) (cid:145)the data subject’s consent(cid:146) shall mean any freely given specific and informed indication of his/her wishes by which the data subject to personal data relating to him/her being processed; signifies his/her agreement down appropriate safeguards for personal data stored for longer periods for historical, statistical or scientific use, in particular with regard to making them anonymous. It shall be for the controller to ensure that paragraph 1 is 2. complied with. Section 2 Criteria for making data processing legitimate Article 3 Scope This Regulation shall apply to the processing of personal 1. data by all Community institutions and bodies. 2. This Regulation shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system. CHAPTER II Article 5 Lawfulness of processing Personal data may be processed only if: (a) processing is necessary for the performance of a task carried out in the public interest on the basis of a law or in the legitimate exercise of official authority vested in the Community institution or body or in a third party to whom the data are disclosed, or GENERAL RULES ON THE LAWFULNESS OF THE PROCESSING OF PERSONAL DATA (b) processing is necessary for compliance with a legal obli- gation to which the controller is subject, or Section 1 Principles relating to data quality Article 4 1. Personal data must be: (a) processed fairly and lawfully; (b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. Further processing of personal data for historical, statistical or scientific purposes shall not be considered as incompatible provided that the controller provides appro- priate safeguards, in particular to ensure that the data shall only be processed for such purposes; (c) adequate, relevant and not excessive in relation to the further for which they are collected and/or purposes processed; (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they were collected or for which they are further processed, are erased or rectified; (c) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract, or (d) the data subject has unambiguously given his/her consent, or (e) processing is necessary in order to protect the vital interests of the data subject. Article 6 Further processing for compatible purposes 1. Personal data shall only be processed for purposes other than those for which they have been collected if the change of purpose is expressly permitted by the internal rules of the Community institution or body. 2. Personal data collected for other purposes may be processed to ensure compliance with financial and budgetary regulations. (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further lay processed. The Community institution or body shall 3. Personal data collected exclusively for ensuring the security or the control of the processing systems or operations shall not be used for any other purpose, with the exception of the purposes referred to in Article 18(1)(a). 28. 12. 1999 EN Official Journal of the European Communities C 376 E/27 Article 7 Transfer of personal data within or between Community institutions or bodies Personal data shall only be transmitted within or to other 1. Community institutions or bodies if the data are necessary for the legitimate performance of tasks covered by the competence of the recipient. The controller and the recipient shall bear the responsi- 2. bility for the legitimacy of the transmission. The controller shall only verify the competence of the recipient and the merits of the request. If doubts arise as to the merits, the controller shall, however, also check the necessity of the transmission. The recipient shall ensure that the necessity of the transmission can be subsequently verified. Article 8 Transmissions Community institutions to persons and bodies, other than located in the and bodies, Member States 1. Personal data shall only be transmitted to persons and bodies located in the Member States if the recipient established the necessity of having the data communicated and if no reasons exist the data subject’s legitimate interests might be prejudiced. to assume that The recipient shall process the personal data only for the 2. purposes for which they were transmitted. Article 9 Transfer of personal data to persons and bodies, other than Community institutions and bodies, which are not subject to Directive 95/46/EC 1. Personal data shall only be transferred to persons and bodies other than Community institutions and bodies, which are not subject to national data protection law by virtue of if an adequate level of Article 4 of Directive 95/46/EC, protection is ensured in the country of the recipient or within the recipient international organisation and the data are transmitted strictly within the range of tasks covered by the controller and the requirements the competence of mentioned in Article 4(1)(b) of this Regulation are fulfilled. The adequacy of the level of protection afforded by the 2. country or international organisation in question shall be assessed in the light of all the circumstances surrounding a data transfer operation or set of data transfer operations; particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the country or international organi- sation of final destination, the rules of law, both general and sectoral, in force in the country or international organisation in question and the professional rules and security measures which are complied with in that country or international organisation. 3. The Community institutions and bodies shall inform the Commission and the European Data Protection Supervisor of cases where they consider the country or international organi- sation in question does not ensure an adequate level of protection within the meaning of paragraph 2. 4. Where the Commission, assisted by the committee set up by Article 31(1) of Directive 95/46/EC, finds that a country or an international organisation ensures or does not ensure an adequate level of protection within the meaning of paragraph 2 of this Article, the Community institutions and bodies shall take the necessary measures to comply with the Commission’s decision. That decision shall be adopted in accordance with the management procedure laid down in Article 4 of Council Decision 1999/468/EC (1) and without prejudice to Article 8 thereof. The period provided for 1999/468/EC shall be three months. in Article 4(3) of Decision By way of derogation from paragraph 1, the Community 5. institution or body may transfer personal data if: (a) the data subject has given his/her consent unambiguously to the proposed transfer; or (b) the transfer is necessary for the performance of a contract the between the data subject and the controller or implementation of pre-contractual measures taken in response to the data subject’s request; or (c) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and a third party; or (d) the transfer is necessary or legally required on important public interest grounds, or for the establishment, exercise or defence of legal claims; or (e) the transfer is necessary in order interests of the data subject; or to protect the vital (f) the transfer is made from a register which according to Community law is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate legitimate interest, to the extent that the conditions laid down in Community law for consultation are fulfilled in the particular case. (1) OJ L 184, 17. 7. 1999, p. 23. C 376 E/28 EN Official Journal of the European Communities 28. 12. 1999 The Community institutions and bodies shall inform the 6. European Data Protection Supervisor of (categories of) cases where they have applied paragraph 5. health-care services, and where those data are processed by a health professional subject to the obligation of professional secrecy or by another person also subject to an equivalent obligation of secrecy. Section 3 The processing of special categories of data Article 10 4. Subject to the provision of suitable safeguards, and for reasons of substantial public interest, exemptions in addition to those laid down in paragraph 2 may be laid down by decision of the European Data Protection Supervisor. 1. The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, data and concerning health or sex life, shall be prohibited. processing the of of data relating Processing to offences, 5. criminal convictions or security measures may be carried out only if instruments authorised by Community law or other adopted on the basis of the EU Treaty laying down suitable specific safeguards or authorised by the European Data Protection Supervisor. legal 2. Paragraph 1 shall not apply where: (a) the data subject has given his/her explicit consent to the processing of those data, except where the internal rules of the the Community institution or body provide that prohibition referred to in paragraph 1 may not be lifted by the data subject’s giving his/her consent; or (b) processing is necessary for the purposes of carrying out the obligations and specific rights of the controller in the field of employment in so far as it is authorised by Community law or rules implementing Community law, or agreed upon by the European Data Protection Supervisor, providing for adequate safeguards; or 6. The European Data Protection Supervisor shall determine the conditions under which a personal number or other identifier of general application in a Community institution or body may be processed. Section 4 Information to be given to the data subject Article 11 Information in cases of collection of data from the data subject 1. The controller must provide a data subject from whom data relating to himself/herself are collected with at least the following information, except where he/she already has it: (c) processing is necessary to protect the vital interests of the data subject or of another person where the data subject is physically or legally incapable of giving his/her consent; or (a) the identity of the controller; (d) processing relates to data which are manifestly made public by the data subject or is necessary for the establishment, exercise or defence of legal claims; or (e) processing is carried out in the course of its legitimate activities with appropriate guarantees by a non-profit seeking body which constitutes an entity integrated in a to national Community institution or body, not subject data protection law by virtue of Article 4 of Directive 95/46/EC, and with a political, philosophical, religious or trade-union aim and on condition that the processing relates solely to the members of this body or to persons who have regular contact with it in connection with its purposes and that the data are not disclosed to a third party without the consent of the data subjects. 3. Paragraph 1 shall not apply where processing of the data is required for the purposes of preventive medicine, medical diagnosis, assessment of the medical aptitude for recruitment, the provision of care or treatment or the management of (b) the purposes of the processing for which the data are intended; (c) the recipients or categories of recipients of the data; (d) whether replies to the questions are obligatory or voluntary, as well as the possible consequences of failure to reply; (e) the existence of the right of access to and the right to rectify the data concerning him/her; (f) any further information such as: (cid:151) the legal basis of the processing for which the data are intended, (cid:151) the time-limits for storing the data, (cid:151) the right to have at any time recourse to the European Data Protection Supervisor, 28. 12. 1999 EN Official Journal of the European Communities C 376 E/29 in so far as such further information is necessary, having regard to the specific circumstances in which the data are collected, to guarantee fair processing in respect of the data subject. information proves impossible or would involve a dispropor- tionate effort or if recording or disclosure is expressly laid down by Community law. In these cases the Community insti- tution or body shall provide for appropriate safeguards. 2. By way of derogation from paragraph 1, the provision of information or part of it may be deferred as long as this is necessary to attain the legitimate objective of a statistical survey in view of its subject or its nature. The information must be provided as soon as the reason for which the information is withheld ceases to exist, unless this is manifestly unreasonable or impracticable. In such cases, the information shall be provided as soon as those circumstances have disap- peared at a later stage. Article 12 Information where the data have not been obtained from the data subject 1. Where the data have not been obtained from the data subject, the controller must at the time of undertaking the recording of personal data or if a disclosure to a third party is envisaged, no later than the time when the data are first disclosed provide the data subject with at least the following information, except where he/she already has it: (a) the identity of the controller; (b) the purposes of the processing; (c) the categories of data concerned; (d) the recipients or categories of recipients; (e) the existence of the right of access to and the right to rectify the data concerning him/her; (f) any further information such as: (cid:151) the legal basis of the processing for which the data are intended, (cid:151) the time-limits for storing the data, Section 5 The data subject’s right of access to data Article 13 Right of access Every data subject shall have the right to obtain at any time without excessive delay and free of charge from the controller: (a) confirmation as to whether or not data related to him/her are being processed; (b) information as to the purposes of the categories of data concerned, the recipients or categories of recipients to whom the data are disclosed; the processing, (c) communication in an intelligible the data undergoing processing and of any available information as to their source; form of (d) knowledge of the logic involved in any automated decision process concerning him/her. Article 14 Rectification The controller shall at the request of the data subject rectify without delay inaccurate or incomplete personal data. Article 15 Blocking 1. Personal data shall be blocked where: (cid:151) the right to have at any time recourse to the European Data Protection Supervisor, (a) their accuracy is contested by the data subject and neither their accuracy nor their inaccuracy can be ascertained; (cid:151) the origin of the data, except where the controller can not disclose this information for reasons of professional secrecy, in so far as such further information is necessary, having regard to the specific circumstances in which the data are processed, to guarantee fair processing in respect of the data subject. 2. Paragraph 1 shall not apply where, processing for statistical purposes or for historical or research, scientific in particular for the purposes of such the provision of (b) the controller no longer needs the accom- plishment of his/her tasks but they have to be maintained for reasons of proof; them for (c) the processing was unlawful and the data subject opposes their erasure and demands instead their blocking. 2. In automated filing systems blocking shall in principle be ensured by technical means. The fact that the personal data are blocked shall be indicated in the system in such a way that it becomes clear that the personal data cannot be used. C 376 E/30 EN Official Journal of the European Communities 28. 12. 1999 Blocked personal data shall, with the exception of their 3. storage, only be processed if they are required for discharging the burden of proof, where the data subject has consented, or for reasons based on the legal interest of a third party. Article 16 Erasure Personal data shall be erased if 1. their processing was unlawful, in particular when the provisions of Sections 1, 2 and 3 of Chapter II are violated. 2. Personal data shall be erased if the controller no longer needs them for the accomplishment of his/her tasks and there is no reason to believe that the data subject’s interests might be prejudiced by the erasure. Article 17 Notification to third parties The controller shall notify third parties to whom the data have been disclosed of any rectification, erasure or blocking unless this proves impossible or involves a disproportionate effort. Section 6 Exemptions and restrictions Article 18 1. The Community institutions and bodies may restrict the application of Article 4(1), Article 11, Article 12(1), Article 13, Article 33 and Article 34(1) when such a restriction constitutes a necessary measure to safeguard: the controller provides adequate legal clearly no risk of breaching the privacy of the data subject and that in particular to ensure that the data are not used for taking measures or decisions regarding a particular individual. safeguards, 3. If a restriction as provided for by paragraph 1 is applied, the data subject shall be informed of the major reasons on which the application of the restriction is based and of his/her right to have recourse to the European Data Protection Supervisor. 4. As soon as the reason for which the restrictions as provided for by paragraph 1 are applied ceases to exist, the provisions referred to in paragraph 1 shall again be fully applied. Section 7 Objections and complaints Article 19 The data subject’s right to object The data subject shall have the right to object at any time on compelling legitimate grounds relating to his/her particular situation to the processing of data relating to him/her, except in the cases covered by Article 5, points (b), (c) and (d). Where there is a justified objection, the processing in question may no longer involve those data. Article 20 The data subject’s right to lodge complaints The data subject shall have the right to lodge complaints at any time to the European Data Protection Supervisor. Article 21 (a) the prevention, investigation, detection and prosecution of Automated individual decisions criminal offences; (b) an important economic or financial interest of a Member including monetary, the European Union, State or of budgetary and taxation matters; (c) the protection of the data subject or of the rights and freedoms of others; (d) a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in cases referred to in (a) and (b). 2. Articles 13 to 16 shall not apply when data are processed solely for purposes of scientific research or are kept in personal form for a period which does not exceed the period necessary for the sole purpose of creating statistics, provided that there is No one shall be subject to a decision which produces legal effects concerning him/her or significantly affects him/her and which is based solely on automated processing of data intended to evaluate certain personal aspects relating to him/her, such as his/her performance at work, reliability or conduct, unless the decision is expressly authorised by a legal provision which also lays down measures to safeguard the data subject’s legitimate interests. Section 8 Confidentiality of processing Article 22 Confidentiality and security of processing Any person acting under the authority of the controller or of the processor, including the processor himself/herself, who has access to personal data shall not process them except on instructions from the controller, unless he is required to so by national law. 28. 12. 1999 EN Official Journal of the European Communities C 376 E/31 Article 23 Article 24 Security of processing Processing of personal data on behalf of controllers 1. Having regard to the state of the art and the cost of their implement the technical implementation, the controller shall and organisational measures necessary to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected. 1. The controller shall, where processing is carried out on his/her behalf, choose a processor providing sufficient guar- antees in respect of the technical security measures and organi- sational measures required by Article 23 and shall ensure compliance with those measures. 2. Where personal data are manually processed, appropriate measures shall be taken in particular to prevent any unauth- orised access or disclosure, alteration, destruction or accidental loss. 2. The carrying out of processing by way of a processor shall be governed by a contract or legal act binding the processor to the controller and stipulating in particular that: 3. Where personal data are processed by automated means, measures shall be taken in particular to: (a) the processor shall act only on instructions from the controller; (a) prevent any unauthorised person from gaining access to computer systems processing personal data; (b) prevent any unauthorised reading, reproduction, alteration or removal of storage media; (c) prevent any unauthorised memory inputs as well as any unauthorised disclosure, alteration or erasure of stored personal data; (d) prevent unauthorised persons from using data processing systems by means of data transmission facilities; (e) ensure that authorised users of a data processing system can access no personal data other than those to which their access right refers; (f) record which personal data have been communicated, at what times and to whom; (b) the obligations set out in Article 23 shall also be incumbent on the processor. For the purposes of keeping proof, 3. the contract or the legal act relating to data protection and the requirements relating to the measures referred to in Article 23 shall be in writing or in another equivalent form. the parts of Section 9 Data protection officer Article 25 Appointment and tasks of the Data Protection Officer Each Community institution and Community body shall 1. appoint at least one person of appropriate rank as personal data protection officer, with the task of: (g) ensure that it will be subsequently possible to check and verify which personal data have been processed, at what times and by whom; (a) ensuring that controllers and data subjects are informed of their rights and obligations; (h) ensure that personal data being processed on behalf of third parties can be processed only in the manner prescribed by the contracting institution or body; (b) cooperating with the European Data Protection Supervisor at the latter’s request or on his/her own initiative; (i) ensure that, during communication of personal data and the data cannot be during transport of storage media, read, copied, or erased without authorisation; (c) ensuring in an independent manner the internal application of provisions of this Regulation and of all other provisions adopted to implement these rules; (j) design the organisational structure within an institution or the special it will meet body in such a way that requirements of data protection. (d) keeping the register of processing operations carried out by the controller, containing the items of information referred to in Article 26(2); C 376 E/32 EN Official Journal of the European Communities 28. 12. 1999 (e) notifying the European Data Protection Supervisor of the processing operations likely to present specific risks within the meaning of Article 28; (cid:151) processing operations intended to assess the personality of including his/her ability, efficiency and the data subject, conduct. the data thereby ensuring that subjects are unlikely to be adversely affected by the processing operations. the rights and freedoms of 2. The Data Protection Officer shall be provided with the staff and resources required for the performance of his/her duties. These processing operations shall be subject to prior checks. 2. The prior checks shall be carried out by the European Data Protection Supervisor following receipt of a notification from the Data Protection Officer who, in case of doubt, shall consult the European Data Protection Supervisor. rules Further concerning implementing 3. the Data Protection Officer shall be adopted by each Community insti- tution or body on the basis of the guidelines laid down in Annex I. The implementing rules shall in particular concern the qualifications, independence and the tasks, duties and powers of the Data Protection Officer. the appointment, dismissal, Article 26 Notification to the Data Protection Officer The controller 1. shall give prior notice to the Data Protection Officer of any processing operation or set of such operations intended to serve a single purpose or several related purposes. The information to be given shall 2. information referred to in Annex II. include at least the Any change affecting that promptly to the Data Protection Officer. information shall be notified Article 27 Register A register of processing operations notified in accordance with Article 26 shall be kept by each Data Protection Officer. The registers shall contain at least the information referred to in Article 26(2). The registers may be inspected by any person. Section 10 Prior checking by the European Data Protection Supervisor Article 28 1. The European Data Protection Supervisor shall determine the processing operations likely to present specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes, such as that of excluding indi- viduals from a right, benefit or contract, or by virtue of the specific use of new technologies. These processing operations shall include the following: (cid:151) certain processing operations involving special categories of data as referred to in Article 10; 3. The European Data Protection Supervisor shall deliver his/her opinion within two months following receipt of the notification. If the opinion has not been delivered by the end of that two-month period, it shall be deemed to be favourable. 4. The European Data Protection Supervisor shall keep a register of all processing operations that have been notified to him/her pursuant shall contain the information referred to in Article 26(2). It shall be open to public inspection. to paragraph 2. The register Automated means of 5. communication between the Community institutions or bodies such as an on-line access to databases or an interlinking shall only be established after examination by the European Data Protection Supervisor. In the course of the examination, the European Data Protection Supervisor shall determine whether an automated communi- cation is compatible with the legitimate interests of the data subjects and necessary in view of the tasks of the Community institutions or bodies involved. CHAPTER III REMEDIES AND SANCTIONS Article 29 Remedies 1. Without prejudice to any judicial remedy, every data subject may complain to the European Data Protection Supervisor if he/she considers that his/her rights have been violated as a result of the processing of his/her personal data by a Community institution or body. 2. The Court of Justice of the European Communities and the Court of First Instance of the European Communities shall have jurisdiction to hear all disputes which relate to the provisions of this Regulation, including claims for damages. Article 30 Sanctions Any failure to comply with the obligations pursuant to this Regulation, whether intentionally or through negligence on his/her part, shall make an official or other servant of the European Communities in accordance with the rules and procedures laid down in the Staff Regulations of Officials of the Communities or in the conditions of employment applicable to them. to disciplinary action, liable 28. 12. 1999 EN Official Journal of the European Communities C 376 E/33 CHAPTER IV PROTECTION OF PERSONAL DATA AND PRIVACY IN INTERNAL TELECOMMUNICATIONS THE CONTEXT OF NETWORKS Article 31 Scope In addition to the other provisions of this Regulation, this Chapter shall apply to the processing of personal data in connection with the use of telecommunications networks and terminal a Community institution or body. equipment operated under control of the For the purpose of this Chapter, (cid:145)user(cid:146) shall mean any natural person using a telecommunications network operated under the control of a Community institution or body. Article 32 Security 1. The Community institutions and bodies shall take appro- priate technical and organisational measures to safeguard the secure use of the telecommunications networks and terminal equipment, if necessary in conjunction with the providers of publicly available telecommunications the providers of public telecommunications networks. Having regard to the state of the art and the cost of their implemen- tation, these measures shall ensure a level of security appro- priate to the risk presented. services and/or Article 34 Traffic and billing data 1. Traffic data relating to users processed and stored to establish calls and other connections over the telecommuni- cations network shall be erased or made anonymous upon termination of the call or other connection without prejudice to the provisions of paragraphs 2, 3 and 4. 2. For the purpose of telecommunications budget and traffic management, including the verification of authorised use of the telecommunications system, traffic data as indicated in a list agreed by the European Data Protection Supervisor may be processed. Processing of traffic and billing data shall be restricted to 3. what is necessary for the purposes of the activities referred to in paragraph 2 and shall only be carried out by persons handling billing, traffic or budget management. Users of the telecommunication networks shall have the 4. right to receive non-itemised bills. Article 35 Directories of users Personal data contained in printed or electronic direc- 1. tories of users shall be limited to what is necessary for the specific purposes of the directory. In case of any particular risk of a breach of the security 2. of the network and terminal equipment, the Community insti- tution or body concerned shall inform the users concerning such risks and any possible remedies or alternative means of communication. 2. The Community institutions and bodies shall take all the necessary measures to prevent personal data contained in those directories, regardless of whether they are accessible to the public or not, from being used for direct marketing purposes. Article 33 Article 36 Confidentiality of the communications 1. Community institutions and bodies shall ensure the confi- dentiality of communications by means of telecommunications networks and terminal equipment. Listening, tapping, storage or other kinds of interception or than users, surveillance of shall be without prohibited. communications, by others the users consent of concerned, the Paragraph 1 shall not affect any recording of communi- 2. cations authorised by the internal rules of the Community institutions or bodies, for the purpose of providing evidence of legal or procedural acts relevant to the official tasks of the Community institutions or bodies concerned, subject to the agreement of the European Data Protection Supervisor. Presentation and restriction of calling and connected line identification 1. Where presentation of calling-line identification is offered, the calling user shall have the possibility via a simple means, free of charge, to eliminate the presentation of the calling-line identification. identification is 2. Where presentation of offered, the called user shall have the possibility via a simple means, free of charge, to prevent the presentation of the calling line identification of incoming calls. calling-line 3. Where presentation of connected line identification is offered, the called user shall have the possibility via a simple means, free of charge, to eliminate the presentation of the connected line identification to the calling user. C 376 E/34 EN Official Journal of the European Communities 28. 12. 1999 4. Where presentation of calling and/or connected line identification is offered, the Community institutions and bodies shall inform the users thereof and of the possibilities set out in paragraphs 1, 2 and 3. Article 37 Exceptions Community institutions and bodies shall ensure that there are transparent procedures governing the way in which they may override the elimination of the presentation of calling line identification: (a) on a temporary basis, upon application of a user requesting the tracing of malicious or nuisance calls; (b) on a per-line basis for organisational entities dealing with emergency calls, for the purpose of answering such calls. CHAPTER V SUPERVISORY AUTHORITY: EUROPEAN DATA PROTECTION SUPERVISOR Article 38 Supervisory authority: European Data Protection Supervisor A supervisory authority is hereby established referred to 1. as the European Data Protection Supervisor. 2. It shall be responsible for monitoring the application of the provisions of this Regulation and any other Community act relating to the protection of natural persons with regard to the processing of personal data by a Community institution or a Community body. Article 39 Appointment On a proposal from the Commission, 1. the European Parliament, the Council and the Commission shall appoint by common accord the European Data Protection Supervisor for a term of four years. 2. The European Data Protection Supervisor shall be chosen from among persons who belong or have belonged in their respective countries to the independent authorities supervising the processing of personal data or who are especially qualified for this office. The European Data Protection Supervisor shall be eligible 3. for reappointment. The European Data Protection Supervisor shall remain in 4. office until he/she has been replaced. 5. Apart from normal replacement or death, the duties of the European Data Protection Supervisor shall end when he/she resigns, or is compulsory retired in conformity with paragraph 6. The European Data Protection Supervisor may be 6. the dismissed by the Court of if European Parliament, he/she no longer the performance of his/her duties or if he/she is guilty of serious misconduct. the request of the Commission, required for Justice at the Council or the conditions fulfils Subject to the provisions of this Chapter, the provisions 7. of the the Protocol on the Privileges and Immunities of European Communities applicable to the Judges of the Court of Justice shall also apply to the European Data Protection Supervisor. Article 40 Conditions of employment The European Parliament, 1. the Commission shall by common accord determine the conditions of employment of the European Data Protection Supervisor and in particular his/her salary, allowances and any other benefits in lieu of remuneration. the Council and The European Parliament shall ensure that the European 2. Data Protection Supervisor is provided with the staff and equipment necessary for the performance of his/her tasks. The staff and equipment to be provided shall be itemised the European to the budget of 3. in a separate Chapter Parliament. 4. Staff members shall be appointed by the European Data Protection Supervisor. Their superior shall be the European Data Protection Supervisor and they shall be subject exclusively to his/her direction. The officials and the other staff members shall be subject 5. to the rules and regulations applicable to officials and other servants of the European Communities. In matters concerning its the European Data 6. Protection Supervisor shall have the same status as the insti- tutions within the meaning of Article 1 of the Staff Regulations of Officials of the European Communities. staff, Article 41 Independence 1. in The European Data Protection Supervisor shall act complete independence in the performance of his/her duties. 2. in the The European Data Protection Supervisor shall, performance of his/her duties, neither seek nor take instruction from anybody. 3. The European Data Protection Supervisor shall refrain from any action incompatible with his/her duties and shall not, during his/her term of office, engage in any other occu- pation, whether gainful or not. 4. The European Data Protection Supervisor shall, after his/her term of office, behave with integrity and discretion as regards the acceptance of appointments and benefits. 28. 12. 1999 EN Official Journal of the European Communities C 376 E/35 Article 42 Professional secrecy shall be The European Data Protection Supervisor 2. informed by the Commission of all draft proposals for Community legislation entailing a processing of personal data. The European Data Protection Supervisor and his/her staff shall, both during and after their term of office, be subject to a duty of professional secrecy with regard to any confidential matters which have come to their knowledge in the course of the performance of their official duties. The European Data Protection Supervisor may be 3. consulted by each Community institution or body on all operations related to the processing of personal data. Article 43 Duties The European Data Protection Supervisor shall: (a) receive and investigate complaints; (b) supervise all processing operations involving personal data by any Community institution or body with the exception of the Court of Justice and the Court of First Instance acting in their judicial role; (c) advise all Community institutions and bodies on all matters concerning the use of personal data, in particular before they draw up internal rules relating to the protection of individual and freedoms with regard to the rights processing of personal data; (d) follow the development of information and communication they have an impact on the insofar as technologies protection of personal data; (e) cooperate with the national supervisory authorities to the extent necessary for the performance of his/her duties, in particular by information or requesting an authority of a Member State to exercise its powers; exchanging all useful (f) participate in the activities of the Working party on the Protection of Individuals with regard to the Processing of Personal Data set up by Article 29 of Directive 95/46/EC; (g) keep a register of processing notified to him/her; Article 45 Recourse 1. Any person employed with Community institutions or bodies may on a matter affecting his/her tasks have recourse to the European Data Protection Supervisor, without acting through official channels. No one shall suffer prejudice on account of a recourse or 2. a complaint to the European Data Protection Supervisor alleging a violation of the provisions governing the processing of personal data. Article 46 Powers The European Data Protection Supervisor 1. particular: shall, in (a) conduct inquiries either on his/her own initiative or on the basis of complaints or recourses; (b) be supplied without delay with all information concerning his/her enquiries; (c) be granted at any time access to all official premises. All controllers shall support Supervisor in the performance of his/her duties. the European Data Protection The European Data Protection Supervisor shall have the 2. power to: (a) order the rectification, blocking erasure or destruction of all data processed in violation of the provisions governing the processing of personal data; (h) carry out a prior check of processing notified to him/her. (b) impose a temporary or definitive ban on processing; Article 44 Consultation 1. The Community institutions and bodies shall inform the European Data Protection Supervisor when drawing up draft measures related to the processing of personal data involving a Community institution or body alone or jointly with others. (c) warn or admonish the controller; (d) report the matter to the Community institution or body concerned and if necessary to the European Parliament, the Council and the Commission; (e) intervene in actions brought before the Court of Justice and the Court of First Instance; C 376 E/36 EN Official Journal of the European Communities 28. 12. 1999 (f) give advice to the data subjects and, if requested, assist them as expert in proceedings before the Court of First Instance. Article 47 Activities report 3. Where the European Data Protection Supervisor estab- lishes a violation of the provisions governing the processing of personal data, or any other irregularities in the processing, he/she shall refer the matter to the Community institution or body concerned and where appropriate make proposals for remedying those irregularities and for improving the protection of the data subjects. 4. The Community institution or body concerned shall inform the European Data Protection Supervisor of its views within a period to be specified by him/her. The reply shall also include a description of the measures taken in response to the remarks of the European Data Protection Supervisor. 5. In the event of a complaint or recourse, the European Data Protection Supervisor shall inform the persons concerned of the outcome of his/her enquiries. the 6. Where the data subject has been denied access, European Data Protection Supervisor shall only inform him/her of whether the data have been processed correctly and, if not, whether the necessary corrections have been made. If the European Data Protection Supervisor considers that the the restriction to the right of confirmation application of provided for in Article 13(a), its effect by providing this the European Data Protection Supervisor shall not inform the data subject of the outcome of his/her enquiry. is deprived of information, 1. The European Data Protection Supervisor shall submit an annual report on his/her activities to the European Parliament and at the same time make it public. The report shall be forwarded to the other institutions 2. and bodies of the European Union and shall be discussed by the European Parliament together with their replies. CHAPTER VI FINAL PROVISIONS Article 48 Transitional period Community institutions and bodies shall ensure that processing already under way on the date this Regulation enters into force is brought into conformity with this Regulation within one year of that date. Article 49 Entry into force This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Communities. 7. Actions against decisions of the European Data Protection Supervisor shall be brought before the Court of Justice or the Court of First Instance. This Regulation shall be binding in its entirety and directly applicable in all Member States. ANNEX I 1. The data protection officer shall be selected on the basis of his/her authority, his/her expert knowledge of data protection and his/her personal reliability. 2. The appointment of the data protection officer shall not entail a conflict of interests with regard to other official duties, in particular in relation to the application of the provisions of this Regulation. 3. The data protection officer shall be appointed for a term of at least two years. He/she shall be eligible for reap- pointment. The data protection officer may only be dismissed with the consent of the European Data Protection Supervisor, if he/she no longer fulfils the conditions required for the performance of his/her duties. 4. With respect to the performance of his/her duties, the data protection officer may not receive any instructions. 5. After his/her appointment the data protection officer shall be registered with the European Data Protection Supervisor by the institution, body (or person) which appointed him/her. 28. 12. 1999 EN Official Journal of the European Communities C 376 E/37 6. The data protection officer may make recommendations for the practical improvement of data protection and advise the Community institution or body which appointed him/her and the controller concerned on matters concerning the application of data protection provisions. Furthermore he/she shall, on his/her own initiative or at the request of the Community institution or body which appointed him/her, the controller, the Staff Committee concerned or data subject, investigate matters and occurrences directly relating to his/her tasks and come to his/her notice. 7. The data protection officer may be consulted by the Community institution or body which appointed him/her, by the controller concerned, by the Staff Committee concerned and by any individual, without going through the official channels, on any matter concerning the interpretation or application of the Regulation. 8. No one shall suffer prejudice on account of a matter brought to the attention of the data protection officer and suggesting a violation of the provisions of this Regulation. 9. Every controller concerned shall be required to assist the data protection officer in performing his/her duties and to give information in reply to questions. In performing his/her duties, the data protection officer shall have access at all times to the data forming the subject-matter of processing operations and to all offices, data processing instal- lations and data carriers, and may collect the necessary information. 10. To the extent required, the data protection officer shall be relieved from other activities. The data protection officer and his/her staff, to whom Article 287 of the Treaty shall apply, shall be required not to divulge information or documents which they obtain in the course of their duties. 1. The name and address of the controller. ANNEX II 2. The names of the persons and/or the indication of the organisational parts of an institution or body charged with the processing of personal data for a particular purpose. 3. The purpose or purposes of the processing. 4. A description of the category or categories of data subjects and of the data or categories of data relating to them. 5. The legal basis of the processing for which the data are intended. 6. The recipients or categories of recipient to whom the data might be disclosed. 7. The time limits for blocking and erasure of the different categories of data. 8. Proposed transfers of data to third countries. 9. A general description allowing a preliminary assessment to be made of the appropriateness of the measures taken pursuant to Article 23 to ensure security of processing


title: Förslag till Europaparlamentets och rådets direktiv om ändring av rådets direktiv 91/308/EEG av den 10 juni 1991 om åtgärder för att förhindra att det finansiella systemet används för tvättning av pengar - (framlagt av kommissionen)

eurovoc_concepts:
EC Directive
credit institution
financial institution
free movement of capital
money laundering

formats: html pdf print

text: C 177 E/14 SV Europeiska gemenskapernas officiella tidning 27. 6. 2000 F(cid:246)rslag till Europaparlamentets och r(cid:229)dets direktiv om (cid:228)ndring av r(cid:229)dets direktiv 91/308/EEG av den 10 juni 1991 om (cid:229)tg(cid:228)rder f(cid:246)r att f(cid:246)rhindra att det finansiella systemet anv(cid:228)nds f(cid:246)r tv(cid:228)ttning av pengar (2000/C 177 E/03) KOM(1999) 352 slutlig (cid:151) 1999/0152(COD) (Framlagt av kommissionen den 19 juli 1999) EUROPAPARLAMENTET OCH R¯DET HAR ANTAGIT DETTA DIREKTIV ett gott skydd mot de skadliga effekterna av pengar som intj(cid:228)nats genom brott. med beaktande av F(cid:246)rdraget om uppr(cid:228)ttandet av Europeiska gemenskapen, s(cid:228)rskilt artikel 47. 2 f(cid:246)rsta och tredje meningen och artikel 95 i detta, med beaktande av kommissionens f(cid:246)rslag, med beaktande av Ekonomiska och sociala kommittØns ytt- rande, i enlighet med f(cid:246)rfarandet i artikel 251 i EG-f(cid:246)rdraget, och av f(cid:246)ljande sk(cid:228)l: 1. R(cid:229)dets direktiv 91/308/EEG om (cid:229)tg(cid:228)rder f(cid:246)r att f(cid:246)rhindra att det finansiella systemet anv(cid:228)nds f(cid:246)r tv(cid:228)ttning av pengar (nedan kallat (cid:148)direktivet(cid:148)) antogs den 10 juni 1991 (1). (GATS) 6. Enligt allm(cid:228)nna tj(cid:228)nstehandelsavtalet f(cid:229)r l(cid:228)nder som undertecknat avtalet vidta n(cid:246)dv(cid:228)ndiga (cid:229)tg(cid:228)rder f(cid:246)r att skydda offentliga normer samt vidta (cid:229)tg(cid:228)rder av till- synssk(cid:228)l, bland annat f(cid:246)r att s(cid:228)kerst(cid:228)lla det finansiella sys- temets stabilitet och integritet. Dessa (cid:229)tg(cid:228)rder f(cid:229)r inte in- neb(cid:228)ra begr(cid:228)nsningar ut(cid:246)ver vad som (cid:228)r motiverat f(cid:246)r att uppn(cid:229) m(cid:229)len. 7. I direktivet fastst(cid:228)lls inte tydligt vilken medlemsstats myn- digheter som skall erh(cid:229)lla rapporter om misst(cid:228)nkta trans- aktioner fr(cid:229)n s(cid:229)dana kreditinstituts och finansiella instituts filialer som har sina huvudkontor i en annan medlemsstat, ej heller vilken medlemsstats myndigheter som (cid:228)r ansva- riga f(cid:246)r att s(cid:228)kerst(cid:228)lla att s(cid:229)dana filialer f(cid:246)ljer best(cid:228)mmel- serna i artikel 11 i direktivet. 2. Kommissionen har i tv(cid:229) rapporter som i enlighet med artikel 17 i direktivet har (cid:246)verl(cid:228)mnats till Europaparlamen- tet och r(cid:229)det rapporterat om hur genomf(cid:246)randet av detta direktiv fortskrider och om vilka framsteg som gjorts i kampen mot penningtv(cid:228)tt (2). 8. Denna fr(cid:229)ga har diskuterats i den kontaktkommittØ med ansvar f(cid:246)r penningtv(cid:228)ttsfr(cid:229)gor som inr(cid:228)ttades genom arti- kel 13 i direktivet. Myndigheterna i de medlemsstater d(cid:228)r filialerna var bel(cid:228)gna b(cid:246)r erh(cid:229)lla s(cid:229)dana rapporter och fullg(cid:246)ra de uppgifter som n(cid:228)mns ovan. 3. Som reaktion p(cid:229) kommissionens tv(cid:229) rapporter beg(cid:228)rde Europaparlamentet i sina rapporter och resolutioner en uppdatering och utvidgning av direktivet fr(cid:229)n 1991 (3). 4. I den handlingsplan som utarbetats av h(cid:246)gniv(cid:229)gruppen f(cid:246)r fr(cid:229)gor om organiserad brottslighet och som antogs vid Europeiska r(cid:229)dets m(cid:246)te i Amsterdam den 16(cid:150)17 juni 1997, och i synnerhet i rekommendation 26, uppmanades det till ytterligare anstr(cid:228)ngningar f(cid:246)r att bek(cid:228)mpa penningtv(cid:228)tt (4). 5. Det (cid:228)r l(cid:228)mpligt att direktivet, som (cid:228)r ett av de fr(cid:228)msta internationella instrumenten i kampen mot penningtv(cid:228)tt, uppdateras i enlighet med kommissionens slutsatser och Europaparlamentets och medlemsstaternas (cid:246)nskningar. Di- rektivet skall inte endast (cid:229)terspegla b(cid:228)sta internationella praxis p(cid:229) detta omr(cid:229)de utan det skall (cid:228)ven forts(cid:228)ttningsvis ge den finansiella sektorn och andra k(cid:228)nsliga verksamheter (1) EGT L 166, 28. 6. 1991, s. 77. (2) KOM(95) 54 slutlig och KOM(1998) 401 slutlig. (3) Dok. A4-0187/96 och EGT C 198, 8. 7. 1996, s. 245; Dok. A4-0093/99 och EGT C. (4) EGT C 251, 15. 8. 1997, s. 1. 9. Denna ansvarstilldelning b(cid:246)r anges tydligt i direktivet ge- nom en (cid:228)ndring av den definition av (cid:148)kreditinstitut(cid:148) och (cid:148)finansiellt institut(cid:148) som finns i artikel 1 i direktivet. 10. Europaparlamentet har uttryckt oro (cid:246)ver att den verksam- het som v(cid:228)xlingskontor ((cid:148)bureaux de change(cid:148)) och (cid:246)ver- ((cid:148)money remittance offices(cid:148)) bedriver (cid:228)r f(cid:246)ringskontor k(cid:228)nslig f(cid:246)r penningtv(cid:228)tt. Dessa verksamheter omfattas re- dan av direktivet. F(cid:246)r att skingra eventuella tvivel i denna fr(cid:229)ga skall det i direktivet tydligt bekr(cid:228)ftas att dessa verk- samheter omfattas. 11. F(cid:246)r att s(cid:228)kerst(cid:228)lla en s(cid:229) fullst(cid:228)ndig t(cid:228)ckning av den finan- siella sektorn som m(cid:246)jligt skall det ocks(cid:229) klarg(cid:246)ras att den verksamhet som investeringsf(cid:246)retag enligt definitionen i r(cid:229)dets direktiv 93/22/EEG (direktivet om investeringstj(cid:228)ns- ter) bedriver omfattas av direktivet (5). (5) EGT L 141, 11. 6. 1993, s. 27. 27. 6. 2000 SV Europeiska gemenskapernas officiella tidning C 177 E/15 i 12. Enligt direktivet (cid:228)r medlemsstaterna endast skyldiga att bek(cid:228)mpa penningtv(cid:228)tt samband med narkotikabrott. Det har under de senaste (cid:229)ren skett en utveckling mot en mycket vidare definition av begreppet penningtv(cid:228)tt som grundar sig p(cid:229) ett st(cid:246)rre antal f(cid:246)rbrott eller underlig- gande brott, vilket till exempel (cid:229)terspeglas i den (cid:228)ndring som gjordes 1996 av de 40 rekommendationerna fr(cid:229)n Financial Action Task Force (FATF), det ledande internatio- nella organet i kampen mot penningtv(cid:228)tt. 13. En bredare definition av f(cid:246)rbrott underl(cid:228)ttar rappor- teringen av misst(cid:228)nkta transaktioner och det internatio- nella samarbetet p(cid:229) detta omr(cid:229)de. D(cid:228)rf(cid:246)r skall direktivet uppdateras i detta avseende. 14. I den gemensamma (cid:229)tg(cid:228)rden av den 3 december 1998 antagen av r(cid:229)det p(cid:229) grundval av artikel K 3 i F(cid:246)rdraget om Europeiska unionen om penningtv(cid:228)tt, identifiering, sp(cid:229)rande, sp(cid:228)rrande, beslag och f(cid:246)rverkande av hj(cid:228)lpmedel och vinning av brott (1) kom medlemsstaterna (cid:246)verens om att r(cid:228)kna alla allvarliga brott, enligt definitionen i den gemensamma (cid:229)tg(cid:228)rden, som f(cid:246)rbrott i syfte att kriminali- sera penningtv(cid:228)tt. 15. Genom direktivet inf(cid:246)rs skyldigheter s(cid:228)rskilt betr(cid:228)ffande rapportering av misst(cid:228)nkta transaktioner. Det skulle vara l(cid:228)mpligare och ligga mer i linje med tanken bakom (cid:229)t- g(cid:228)rdsplanen f(cid:246)r bek(cid:228)mpning av organiserad brottslighet att utstr(cid:228)cka det f(cid:246)rbud mot penningtv(cid:228)tt som f(cid:246)reskrivs i direktivet till att omfatta inte endast narkotikabrott utan alla de verksamheter f(cid:246)r organiserad brottslighet samt bedr(cid:228)geri, korruption och all annan olag- lig verksamhet som riktar sig mot Europeiska gemenska- pens ekonomiska intressen enligt artikel 280 i f(cid:246)rdraget. som (cid:228)r f(cid:246)rem(cid:229)l 16. Betr(cid:228)ffande denna typ av bedr(cid:228)geri, korruption och annan olaglig verksamhet skall de myndigheter i medlemsstaterna som har ansvar f(cid:246)r att bek(cid:228)mpa penningtv(cid:228)tt och kommis- sionen samarbeta med varandra och utbyta relevant infor- mation. 17. Den 21 december 1998 antog r(cid:229)det en gemensam (cid:229)tg(cid:228)rd p(cid:229) grundval av artikel K 3 i F(cid:246)rdraget om Europeiska unionen genom vilken det blir ett brott att delta i en brottslig organisation i Europeiska unionens medlemssta- ter (2). Denna gemensamma (cid:229)tg(cid:228)rd (cid:229)terspeglar medlemssta- ternas st(cid:229)ndpunkt att det beh(cid:246)vs en gemensam strategi p(cid:229) detta omr(cid:229)de. 18. Som f(cid:246)reskrivs i direktivet fr(cid:229)n 1991 uppr(cid:228)ttar den finan- siella sektorn i varje medlemsstat, s(cid:228)rskilt kreditinstituten, (1) EGT L 333, 9. 12. 1998, s. 1. (2) EGT L 351, 29. 12. 1998, s. 1. rapporter om misst(cid:228)nkta transaktioner. Det finns tecken p(cid:229) att f(cid:246)rst(cid:228)rkningen av kontrollerna i den finansiella sektorn har tvingat de som (cid:228)gnar sig (cid:229)t penningtv(cid:228)tt att finna alternativa metoder f(cid:246)r att d(cid:246)lja de genom brott intj(cid:228)nade medlens ursprung. 19. Det finns en tydlig tendens att de som (cid:228)gnar sig (cid:229)t pen- ningtv(cid:228)tt i (cid:246)kad utstr(cid:228)ckning anv(cid:228)nder f(cid:246)retag utanf(cid:246)r den finansiella sektorn. Detta bekr(cid:228)ftas av FATF:s studier av olika metoder och typologier f(cid:246)r penningtv(cid:228)tt. 20. I artikel 12 i direktivet anges redan att best(cid:228)mmelserna i direktivet skall utvidgas till att (cid:228)ven omfatta andra s(cid:229)rbara yrkesgrupper och f(cid:246)retagskategorier utanf(cid:246)r den finansiella sektorn. 21. Fr(cid:229)gan om s(cid:229)rbar verksamhet utanf(cid:246)r den finansiella sek- torn har diskuterats vid flera tillf(cid:228)llen i kontaktkommittØn med ansvar f(cid:246)r penningtv(cid:228)ttsfr(cid:229)gor. 22. Best(cid:228)mmelserna i direktivet om att kunderna m(cid:229)ste iden- tifiera sig, uppgiftsunderlag h(cid:229)llas och misst(cid:228)nkta trans- aktioner rapporteras b(cid:246)r utvidgas till att omfatta ett be- gr(cid:228)nsat antal verksamheter och yrkesgrupper som har visat sig vara s(cid:229)rbara f(cid:246)r penningtv(cid:228)tt. 23. Notarier och oberoende jurister b(cid:246)r omfattas av best(cid:228)m- melserna i direktivet n(cid:228)r de utf(cid:246)r ett begr(cid:228)nsat antal spe- cifika finansiella transaktioner eller f(cid:246)retagstransaktioner, d(cid:228)r risken (cid:228)r som st(cid:246)rst f(cid:246)r att dessa juristers tj(cid:228)nster missbrukas i syfte att tv(cid:228)tta de pengar som utg(cid:246)r vinning fr(cid:229)n narkotikasmuggling eller organiserad brottslighet. 24. Om en oberoende advokat eller advokatbyr(cid:229) f(cid:246)retr(cid:228)der en klient i en formell r(cid:228)ttssak skulle det emellertid inte vara l(cid:228)mpligt att i direktivet (cid:229)l(cid:228)gga advokaten en skyldighet att rapportera misstankar om penningtv(cid:228)tt. 25. I direktivet h(cid:228)nvisas till (cid:148)de myndigheter, som har att be- k(cid:228)mpa tv(cid:228)ttning av pengar(cid:148) och till vilka misstankar om penningtv(cid:228)tt skall rapporteras. Med beaktande av den tyst- nadsplikt som advokater (cid:228)r skyldiga sina kunder b(cid:246)r med- lemsstaterna n(cid:228)r det g(cid:228)ller oberoende jurister ha r(cid:228)tt att utse advokatsamfundet eller n(cid:229)gon annan yrkesorganisa- tion f(cid:246)r advokater till ansvarig myndighet. De best(cid:228)mmel- ser i vilka behandlingen av s(cid:229)dana rapporter och deras eventuella vidarebefordran till polis eller juridiska myndig- heter regleras och i vilka l(cid:228)mpliga former av samarbete mellan advokatsamfund eller yrkesorganisationer och myn- digheter med ansvar f(cid:246)r bek(cid:228)mpning av penningtv(cid:228)tt i allm(cid:228)nhet regleras skall fastst(cid:228)llas av medlemsstaterna. C 177 E/16 SV Europeiska gemenskapernas officiella tidning 27. 6. 2000 26. Finansiella tj(cid:228)nster best(cid:228)lls och tillhandah(cid:229)lls i allt h(cid:246)gre grad med hj(cid:228)lp av medel (s(cid:229)som post, telefon och dator) som begr(cid:228)nsar den direkta kontakten mellan s(cid:228)ljare och k(cid:246)pare eller som g(cid:246)r denna direkta kontakt (cid:246)verfl(cid:246)dig. ˜ven i s(cid:229)dana fall m(cid:229)ste best(cid:228)mmelserna om kundidenti- fikation som anges i direktivet f(cid:246)ljas. KontaktkommittØn f(cid:246)r fr(cid:229)gor om penningtv(cid:228)tt har granskat s(cid:229)dana anonyma transaktioner och har utarbetat principer och f(cid:246)rfaranden f(cid:246)r kundidentifikation. Dessa principer och f(cid:246)rfaranden skall inkorporeras i direktivet som bilaga. H˜RIGENOM F(cid:214)RESKRIVS F(cid:214)LJANDE. Artikel 1 Direktiv 91/308/EEG (cid:228)ndras p(cid:229) f(cid:246)ljande s(cid:228)tt: 1. Artikel 1 skall ers(cid:228)ttas med f(cid:246)ljande: (cid:148)Artikel 1 I detta direktiv anv(cid:228)nds f(cid:246)ljande beteckningar med de be- tydelser som h(cid:228)r anges: A. Kreditinstitut: ett kreditinstitut, s(cid:229) som det definieras i artikel 1 f(cid:246)rsta strecksatsen i direktiv 77/780/EEG (1), omfattande (cid:228)ven inom gemenskapen bel(cid:228)gna filialer, i den betydelse som anges i samma artikels tredje streck- sats, till kreditinstitut med huvudkontor inom eller utanf(cid:246)r gemenskapen. B. Finansiellt institut: 1. Ett f(cid:246)retag som inte (cid:228)r ett kreditinstitut men vars huvudsakliga verksamhet best(cid:229)r i att utf(cid:246)ra en eller flera av de verksamheter i punkterna 2(cid:150)12 och 14 i bilagan till direktiv 89/646/EEG. Dessa omfattar de verksamheter som v(cid:228)xlingskontor ((cid:146)bureaux de change(cid:146)) och (cid:246)verf(cid:246)ringskontor utf(cid:246)r. som anges C. Tv(cid:228)ttning av pengar: f(cid:246)ljande f(cid:246)rfaranden n(cid:228)r de sker upps(cid:229)tligt: (cid:151) Omvandling eller (cid:246)verf(cid:246)ring av egendom i vetskap om att egendomen h(cid:228)rr(cid:246)r fr(cid:229)n brott eller fr(cid:229)n med- verkan till brott och i syfte att hemligh(cid:229)lla eller d(cid:246)lja egendomens olagliga ursprung, eller f(cid:246)r att hj(cid:228)lpa n(cid:229)gon som (cid:228)r delaktig i s(cid:229)dan verksamhet att undandra sig de r(cid:228)ttsliga f(cid:246)ljderna av sitt hand- lande. (cid:151) Hemligh(cid:229)llande eller d(cid:246)ljande av en viss egendoms r(cid:228)tta beskaffenhet eller ursprung, av dess bel(cid:228)gen- het, av f(cid:246)rfogandet (cid:246)ver den, av dess f(cid:246)rflyttning, av de r(cid:228)ttigheter som (cid:228)r knutna till den, eller av (cid:228)gander(cid:228)tten till den, i vetskap om att egendomen h(cid:228)rr(cid:246)r fr(cid:229)n brott eller fr(cid:229)n medverkan till brott. (cid:151) F(cid:246)rv(cid:228)rv, innehav eller brukande av egendom om den som mottar egendomen vid tidpunkten f(cid:246)r mottagandet var medveten om att egendomen h(cid:228)r- r(cid:246)rde fr(cid:229)n brott eller fr(cid:229)n medverkan till brott. (cid:151) Medverkan till, (cid:246)verenskommelse att utf(cid:246)ra, f(cid:246)rs(cid:246)k och medhj(cid:228)lp till, fr(cid:228)mjande och underl(cid:228)ttande av, samt r(cid:229)dgivning f(cid:246)r utf(cid:246)rande av n(cid:229)gon av de g(cid:228)r- ningar som s(cid:228)gs i f(cid:246)reg(cid:229)ende strecksatser. Vetskap, upps(cid:229)t och (cid:228)ndam(cid:229)l som utg(cid:246)r rekvisit f(cid:246)r de ovann(cid:228)mnda g(cid:228)rningarna, f(cid:229)r h(cid:228)rledas ur objektiva, faktiska omst(cid:228)ndigheter. Tv(cid:228)ttning av pengar skall betraktas som s(cid:229)dan (cid:228)ven i fall d(cid:229) de g(cid:228)rningar, som frambringat den egendom som skall tv(cid:228)ttas, beg(cid:229)tts inom n(cid:229)gon annan medlems- stats eller ett tredje lands territorium. 2. Ett f(cid:246)rs(cid:228)kringsf(cid:246)retag auktoriserat i enlighet med direktiv 79/267/EEG (2), om f(cid:246)retaget bedriver verk- samheter som t(cid:228)cks av det direktivet. D. Egendom: tillg(cid:229)ngar av varje slag, vare sig fysiska eller icke fysiska, av fast eller l(cid:246)s natur, materiella eller im- materiella, samt juridiska dokument eller instrument som styrker r(cid:228)tten till eller intresset i s(cid:229)dana tillg(cid:229)ngar. Ett investeringsf(cid:246)retag enligt definition i artikel 1 3. i direktiv 93/22/EEG. E. Brott: Denna definition av finansiella institut omfattar (cid:228)ven inom gemenskapen bel(cid:228)gna filialer till finansiella insti- tut med huvudkontor inom eller utanf(cid:246)r gemenskapen. (cid:151) brottsliga g(cid:228)rningar som anges i artikel 3. 1 a i Wienkonventionen (3), (1) EGT L 322, 17. 12. 1977, s. 30. (2) EGT L 204, 21. 7. 1998, s. 29. (3) F(cid:246)renta nationernas konvention mot olaglig handel med narkotika och psykotropa preparat, antagen den 19 december 1988 i Wien. 27. 6. 2000 SV Europeiska gemenskapernas officiella tidning C 177 E/17 (cid:151) deltagande i verksamhet som (cid:228)r kopplad till orga- 3. Artikel 3 skall ers(cid:228)ttas med f(cid:246)ljande: niserad brottslighet, (cid:151) bedr(cid:228)geri, korruption eller varje annan olaglig verk- samhet som skadar eller som sannolikt kan skada Europeiska gemenskapernas finansiella intressen samt (cid:151) (cid:246)vriga brottsliga g(cid:228)rningar, betr(cid:228)ffande vilka respek- tive medlemsstat f(cid:246)reskrivit att detta direktiv skall g(cid:228)lla. F. Beh(cid:246)riga myndigheter: de nationella myndigheter som i lag eller annan f(cid:246)rfattning givits beh(cid:246)righet att ut(cid:246)va tillsyn (cid:246)ver de institut eller personer som omfattas av detta direktiv. (cid:148) 2. F(cid:246)ljande artikel skall inf(cid:246)ras som artikel 2a: (cid:148)Artikel 2a Medlemsstaterna skall s(cid:228)kerst(cid:228)lla att de skyldigheter som anges i detta direktiv (cid:229)l(cid:228)ggs f(cid:246)ljande institut: 1. kreditinstitut enligt definitionen i punkt A i artikel 1, finansiella institut enligt definitionen i punkt B i ar- 2. tikel 1, och f(cid:246)ljande juridiska eller fysiska personer i deras roll som yrkesut(cid:246)vare: 3. 4. externa revisorer, fastighetsm(cid:228)klare, notarier och andra oberoende jurister n(cid:228)r de hj(cid:228)lper 5. eller f(cid:246)retr(cid:228)der en klient vid a) k(cid:246)p och f(cid:246)rs(cid:228)ljning av fastigheter eller f(cid:246)retag, b) hantering av klientens pengar, v(cid:228)rdepapper eller andra tillg(cid:229)ngar, c) (cid:246)ppnande eller f(cid:246)rvaltande av bank-, spar- eller v(cid:228)r- depapperskonton, d) bildande, drivande eller ledande av f(cid:246)retag, f(cid:246)rvaltnings- bolag eller liknande strukturer, e) genomf(cid:246)rande av varje annan finansiell transaktion, (cid:148)Artikel 3 1. Medlemsstaterna skall se till att kreditinstitut och fi- nansiella institut kr(cid:228)ver av sina kunder att de styrker sin identitet n(cid:228)r ett aff(cid:228)rsf(cid:246)rh(cid:229)llande inleds, s(cid:228)rskilt d(cid:229) ett spar- konto eller annat konto (cid:246)ppnas och d(cid:229) bankfackstj(cid:228)nster erbjuds. Identifikationskravet skall till(cid:228)mpas (cid:228)ven vid trans- 2. aktioner med andra kunder (cid:228)n s(cid:229)dana som avses i punkt 1, d(cid:229) transaktionen g(cid:228)ller ett belopp motsvarande 15 000 euro eller mer, vare sig transaktionen genomf(cid:246)rs p(cid:229) en g(cid:229)ng eller i flera led som verkar ha samband. Om summan inte (cid:228)r k(cid:228)nd d(cid:229) transaktionen utf(cid:246)rs, skall det ber(cid:246)rda institutet eller personen beg(cid:228)ra identifikation s(cid:229) snart det f(cid:229)tt k(cid:228)nnedom om summan och konstaterat att gr(cid:228)nsv(cid:228)rdet uppn(cid:229)tts. Om ett institut uppr(cid:228)ttar aff(cid:228)rsrelationer eller inleder en transaktion med en kund som inte har varit fysiskt n(cid:228)rva- rande ur identifikationssynpunkt ((cid:146)anonyma transaktioner(cid:146)) skall de principer och f(cid:246)rfaranden som anges i bilagan till- l(cid:228)mpas. Trots vad som s(cid:228)gs i punkterna 1 och 2 skall, i fr(cid:229)ga 3. om f(cid:246)rs(cid:228)kring som s(cid:229)dana f(cid:246)rs(cid:228)kringsf(cid:246)retag som avses i direktiv 79/267/EEG har meddelat inom ramen f(cid:246)r verk- samhet som omfattas av det direktivet, identifikationskravet inte till(cid:228)mpas vid s(cid:229)dana periodiska premiebetalningar, el- ler premiebetalningar som skall ske visst (cid:229)r, som inte (cid:246)ver- stiger 1 000 euro, inte heller vid eng(cid:229)ngspremiebetalningar som uppg(cid:229)r till h(cid:246)gst 2 500 euro. Om de periodiska pre- miebetalningarna, eller premiebetalningarna som skall ske visst (cid:229)r, h(cid:246)js s(cid:229) att de (cid:246)verstiger gr(cid:228)nsv(cid:228)rdet 1 000 euro, skall identifikation kr(cid:228)vas. Trots vad som s(cid:228)gs i punkt 2 skall 3a. identifikation kr(cid:228)vas av alla kasinokunder som k(cid:246)per eller v(cid:228)xlar spel- marker till ett v(cid:228)rde av 1 000 euro eller mer. 4. Medlemsstaterna f(cid:229)r f(cid:246)reskriva att identifikationskra- vet inte skall vara obligatoriskt i fr(cid:229)ga om pensionsf(cid:246)rs(cid:228)k- ring som grundar sig p(cid:229) ett anst(cid:228)llningskontrakt eller den f(cid:246)rs(cid:228)krades yrkesverksamhet, detta f(cid:246)rutsatt att f(cid:246)rs(cid:228)krings- brevet inte inneh(cid:229)ller n(cid:229)gon (cid:229)terk(cid:246)psklausul och inte f(cid:229)r anv(cid:228)ndas som s(cid:228)kerhet f(cid:246)r l(cid:229)n. handlare som k(cid:246)per och s(cid:228)ljer varor av h(cid:246)gt v(cid:228)rde, 6. s(cid:229)som (cid:228)delstenar eller (cid:228)delmetaller, 7. 8. penningtransport(cid:246)rer och driftsansvariga f(cid:246)r, (cid:228)gare till och chefer f(cid:246)r kasinon. (cid:148) 5. I de fall d(cid:229) det r(cid:229)der os(cid:228)kerhet om huruvida s(cid:229)dana kunder, som avses i f(cid:246)reg(cid:229)ende punkter, handlar f(cid:246)r egen del, samt i de fall d(cid:229) det st(cid:229)r klart att de inte handlar f(cid:246)r egen del, skall de institut och personer som omfattas av detta direktiv vidta l(cid:228)mpliga (cid:229)tg(cid:228)rder f(cid:246)r att skaffa sig upp- lysningar om den verkliga identiteten hos de personer, f(cid:246)r vilkas r(cid:228)kning kunderna i fr(cid:229)ga handlar. C 177 E/18 SV Europeiska gemenskapernas officiella tidning 27. 6. 2000 De institut och personer som omfattas av detta di- 6. rektiv skall genomf(cid:246)ra s(cid:229)dan identifikation (cid:228)ven om trans- aktionsbeloppet (cid:228)r l(cid:228)gre (cid:228)n f(cid:246)reskrivet gr(cid:228)nsv(cid:228)rde, n(cid:228)rhelst det f(cid:246)religger misstanke om tv(cid:228)ttning av pengar. information som de f(cid:229)r fr(cid:229)n en klient f(cid:246)r att kunna f(cid:246)re- tr(cid:228)da denne i en r(cid:228)ttssak. Detta undantag fr(cid:229)n skyldighe- terna i punkt 1 skall inte omfatta n(cid:229)got fall d(cid:228)r det finns sk(cid:228)l att misst(cid:228)nka att r(cid:229)dgivning efterfr(cid:229)gas i syfte att un- derl(cid:228)tta penningtv(cid:228)tt. De institut och personer som omfattas av detta direk- 7. tiv skall inte vara skyldiga att genomf(cid:246)ra identifikation enligt denna artikel, om kunden (cid:228)r ett kreditinstitut eller ett finansiellt institut som omfattas av detta direktiv. 8. Medlemsstaterna f(cid:229)r f(cid:246)reskriva att identifikationskra- vet, s(cid:229)vitt g(cid:228)ller transaktioner som avses i punkterna 3 och 4, skall anses tillgodosett n(cid:228)r det har klarlagts att betal- ningen skall ske fr(cid:229)n ett konto som i enlighet med f(cid:246)re- skrifterna i punkt 1 (cid:246)ppnats i kundens namn hos ett kre- ditinstitut som omfattas av detta direktiv. (cid:148) 4. I artiklarna 4 och 5 skall orden (cid:148)kreditinstitut och finansi- ella institut(cid:148) ers(cid:228)ttas med (cid:148)de institut och personer som omfattas av detta direktiv(cid:148). 5. Artikel 6 skall ers(cid:228)ttas med f(cid:246)ljande: (cid:148)Artikel 6 1. Medlemsstaterna skall se till att de institut och per- soner som omfattas av detta direktiv samt dessas styrelse- ledam(cid:246)ter och anst(cid:228)llda samarbetar fullt ut med de myn- digheter, som har att bek(cid:228)mpa tv(cid:228)ttning av pengar 4. Uppgifter som l(cid:228)mnas till myndigheterna i enlighet med best(cid:228)mmelserna i punkt 1 f(cid:229)r anv(cid:228)ndas endast i sam- band med bek(cid:228)mpandet av tv(cid:228)ttning av pengar. Medlems- staterna f(cid:229)r dock f(cid:246)reskriva att uppgifterna f(cid:229)r anv(cid:228)ndas (cid:228)ven f(cid:246)r andra (cid:228)ndam(cid:229)l. (cid:148) 6. Artikel 7 skall ers(cid:228)ttas med f(cid:246)ljande: (cid:148)Artikel 7 Medlemsstaterna skall se till att de institut och personer som omfattas av detta direktiv, till dess de underr(cid:228)ttat de myndigheter som avses i artikel 6, avst(cid:229)r fr(cid:229)n att utf(cid:246)ra s(cid:229)dana transaktioner som de vet har eller misst(cid:228)nker ha samband med tv(cid:228)ttning av pengar. Dessa myndigheter f(cid:229)r, under de f(cid:246)ruts(cid:228)ttningar som g(cid:228)ller enligt deras respektive nationella lagar, ge f(cid:246)rel(cid:228)ggande om att transaktionen inte skall utf(cid:246)ras. I de fall d(cid:229) en s(cid:229)dan transaktion misst(cid:228)nks f(cid:246)ranleda tv(cid:228)ttning av pengar och det inte (cid:228)r m(cid:246)jligt att p(cid:229) angivet s(cid:228)tt underl(cid:229)ta att utf(cid:246)ra transaktionen eller under- l(cid:229)tenheten (cid:228)r (cid:228)gnad att motverka f(cid:246)rs(cid:246)k att efterforska dem som gynnas av ett misst(cid:228)nkt f(cid:246)rfarande f(cid:246)r tv(cid:228)ttning av pengar, skall det ber(cid:246)rda institutet i efterhand omedelbart underr(cid:228)tta myndigheterna. (cid:148) a) genom att sj(cid:228)lvmant l(cid:228)mna dessa myndigheter upplys- ningar om alla f(cid:246)rh(cid:229)llanden som kan tyda p(cid:229) tv(cid:228)ttning av pengar, 7. I artikel 8 skall orden (cid:148)kreditinstitut och finansiella institut(cid:148) ers(cid:228)ttas med (cid:148)de institut och personer som omfattas av detta direktiv(cid:148). b) genom att p(cid:229) beg(cid:228)ran av dessa myndigheter f(cid:246)rse dem i enlighet med fast- med alla uppgifter som beh(cid:246)vs, st(cid:228)llda f(cid:246)rfaranden enligt till(cid:228)mplig lagstiftning. 8. Artikel 9 skall ers(cid:228)ttas med f(cid:246)ljande: (cid:148)Artikel 9 2. Uppgifter som avses i punkt 1 skall l(cid:228)mnas vidare till de myndigheter som har att bek(cid:228)mpa tv(cid:228)ttning av pengar i den medlemsstat, inom vars territorium det uppgiftsl(cid:228)m- nande institutet (cid:228)r bel(cid:228)get eller den uppgiftsl(cid:228)mnande per- sonen h(cid:246)r hemma. Uppgifterna skall normalt l(cid:228)mnas vi- dare av den person eller de personer som instituten eller personerna utsett i enlighet med vad som s(cid:228)gs i artikel 11. 1. Betr(cid:228)ffande de oberoende jurister som det h(cid:228)nvisas 3. till i artikel 2a. 5 kan medlemsstaterna utse advokatsamfund eller l(cid:228)mplig sj(cid:228)lvreglerande yrkesorganisation som den myndighet som det h(cid:228)nvisas till i punkt 1 i denna artikel. I detta fall skall medlemsstaterna fastst(cid:228)lla l(cid:228)mplig form f(cid:246)r samarbete mellan denna myndighet och de (cid:246)vriga myndig- heter som (cid:228)r ansvariga f(cid:246)r bek(cid:228)mpning av penningtv(cid:228)tt. institut eller en person som omfattas av detta Om ett direktiv eller en anst(cid:228)lld eller en styrelseledamot i god tro har r(cid:246)jt upplysningar, som avses i artiklarna 6 och 7, f(cid:246)r de myndigheter som har att bek(cid:228)mpa tv(cid:228)ttning av pengar, skall detta inte inneb(cid:228)ra (cid:246)vertr(cid:228)delse av n(cid:229)gon sekretessregel som f(cid:246)ljer av ett avtal eller av n(cid:229)gon f(cid:246)re- skrift i lag eller annan f(cid:246)rfattning, och inte f(cid:246)ranleda an- svar i n(cid:229)gon form f(cid:246)r institutet eller personen eller deras styrelseledam(cid:246)ter eller anst(cid:228)llda. (cid:148) 9. I artikel 10 skall orden (cid:148)ett kreditinstitut eller ett finansiellt institut(cid:148) ers(cid:228)ttas med (cid:148)de institut och personer som omfat- tas av detta direktiv(cid:148). Medlemsstaterna beh(cid:246)ver inte till(cid:228)mpa de best(cid:228)mmelser som anges i punkt 1 p(cid:229) dessa jurister n(cid:228)r det g(cid:228)ller s(cid:229)dan 10. I artikel 11 skall orden (cid:148)kreditinstitut och finansiella insti- tut(cid:148) ers(cid:228)ttas med (cid:148)de institut och personer som omfattas av detta direktiv(cid:148). 27. 6. 2000 SV Europeiska gemenskapernas officiella tidning C 177 E/19 11. Artikel 12 skall ers(cid:228)ttas med f(cid:246)ljande: Artikel 2 (cid:148)Artikel 12 1. Medlemsstaterna skall se till att best(cid:228)mmelserna i detta direktiv utvidgas, helt eller delvis, till att omfatta andra yrkesgrupper och f(cid:246)retagskategorier (cid:228)n de institut och personer som avses i artikel 2a, d(cid:229) det (cid:228)r s(cid:228)rskilt sannolikt att den verksamhet som bedrivs utnyttjas f(cid:246)r tv(cid:228)ttning av pengar. 2. I fall som g(cid:228)ller bedr(cid:228)geri, korruption eller varje an- nan olaglig verksamhet som skadar eller som sannolikt kan skada Europeiska gemenskapernas finansiella intressen skall de myndigheter med ansvar f(cid:246)r att bek(cid:228)mpa penningtv(cid:228)tt som avses i artikel 6 och kommissionen, om den har beh(cid:246)righet, samarbeta med varandra i syfte att f(cid:246)rebygga I detta syfte skall de utbyta och uppt(cid:228)cka penningtv(cid:228)tt. relevant information om misst(cid:228)nkta transaktioner. Infor- mation som utbytts p(cid:229) detta s(cid:228)tt skall omfattas av sekre- tessregler. Tre (cid:229)r efter det att detta direktiv antagits skall kommissionen, inom ramen f(cid:246)r den rapport som anges i artikel 17 i direktiv 91/308/EEG, genomf(cid:246)ra en s(cid:228)rskild unders(cid:246)kning av aspekter som har samband med den s(cid:228)rskilda behandlingen av obero- ende jurister, identifikationen av kunder i anonyma transaktio- ner och m(cid:246)jliga effekter p(cid:229) den elektroniska handeln. Artikel 3 1. Medlemsstaterna skall s(cid:228)tta i kraft de lagar och andra f(cid:246)rfattningar som (cid:228)r n(cid:246)dv(cid:228)ndiga f(cid:246)r att f(cid:246)lja detta direktiv senast den 31 december 2001. 2. N(cid:228)r en medlemsstat antar s(cid:229)dana best(cid:228)mmelser, skall dessa inneh(cid:229)lla en h(cid:228)nvisning till detta direktiv eller (cid:229)tf(cid:246)ljas av en s(cid:229)dan h(cid:228)nvisning n(cid:228)r de offentligg(cid:246)rs. N(cid:228)rmare f(cid:246)reskrif- ter om hur h(cid:228)nvisningen skall g(cid:246)ras skall varje medlemsstat sj(cid:228)lv utf(cid:228)rda. 3. Medlemsstaterna skall till kommissionen (cid:246)verl(cid:228)mna tex- terna till centrala best(cid:228)mmelser i nationell lagstiftning som de antar inom det omr(cid:229)de som omfattas av detta direktiv. N(cid:228)r det g(cid:228)ller oberoende jurister kan medlemssta- 3. terna undanta advokatsamfund eller sj(cid:228)lvreglerande yrkes- organisationer fr(cid:229)n skyldigheterna enligt stycke 2. (cid:148) Artikel 4 Detta direktiv riktar sig till medlemsstaterna. BILAGA KREDITINSTITUTS OCH FINANSIELLA INSTITUTS IDENTIFIKATION AV KUNDER (FYSISKA PERSONER) I ANONYMA FINANSIELLA TRANSAKTIONER Inom ramen f(cid:246)r direktivet skall f(cid:246)ljande principer till(cid:228)mpas p(cid:229) identifikationsf(cid:246)rfarandena f(cid:246)r anonyma finansiella transaktioner: i) F(cid:246)rfarandena skall s(cid:228)kerst(cid:228)lla en tillr(cid:228)cklig kundidentifikation. ii) F(cid:246)rfarandena kan till(cid:228)mpas f(cid:246)rutsatt att det inte finns n(cid:229)gra rimliga sk(cid:228)l att anta att direkt kontakt undviks f(cid:246)r att d(cid:246)lja kundens riktiga identitet och f(cid:246)rutsatt att det inte finns n(cid:229)gon misstanke om penningtv(cid:228)tt. iii) F(cid:246)rfarandena skall inte till(cid:228)mpas p(cid:229) transaktioner som inbegriper anv(cid:228)ndning av kontanter. iv) I de f(cid:246)rfaranden f(cid:246)r internkontroll som anges i artikel 11. 1 i direktivet skall s(cid:228)rskilt anonyma transaktioner beaktas. v) Om motparten till det institut som genomf(cid:246)r transaktionen (nedan kallat (cid:148)avtalsslutande institut(cid:148)) (cid:228)r en kund, kan identifikation ske genom f(cid:246)ljande f(cid:246)rfaranden: a) En direkt identifikation kan genomf(cid:246)ras vid det avtalsslutande institutets filial eller representationskontor som ligger n(cid:228)rmast kunden. b) Om identifikationen genomf(cid:246)rs utan direkt kontakt med kunden: (cid:151) Genom att beg(cid:228)ra en kopia av kundens officiella identifikationsdokument eller det officiella numret i iden- tifikationsdokumentet. S(cid:228)rskild uppm(cid:228)rksamhet skall (cid:228)gnas kontrollen av kundens adress n(cid:228)r detta anges p(cid:229) identifikationsdokumentet (till exempel dokument betr(cid:228)ffande transaktionen som skall skickas rekommende- rat med mottagningsbevis till kundens adress). C 177 E/20 SV Europeiska gemenskapernas officiella tidning 27. 6. 2000 (cid:151) Genom att genomf(cid:246)ra den f(cid:246)rsta betalningen i transaktionen via ett konto som (cid:246)ppnats i kundens namn hos ett kreditinstitut i Europeiska unionen eller i Europeiska ekonomiska samarbetsomr(cid:229)det. Staterna f(cid:229)r godta betalningar som genomf(cid:246)rs via v(cid:228)lrenommerade kreditinstitut i tredje land som till(cid:228)mpar likv(cid:228)rdiga regler f(cid:246)r bek(cid:228)mpning av penningtv(cid:228)tt. (cid:151) Genom att det avtalsslutande institutet noga kontrollerar att identiteten p(cid:229) innehavaren av det konto genom vilket betalningen sker och kundens identitet enligt identifikationsdokumentet (eller av vad som framg(cid:229)r av identifikationsnumret) (cid:228)r en och samma. Om det skulle r(cid:229)da tvivel i detta avseende skall det avtalsslutande institutet kontakta det kreditinstitut d(cid:228)r kontot (cid:246)ppnats i syfte att kontrollera kontohavarens identitet. Om tvivlen fortfarande kvarst(cid:229)r skall ett intyg beg(cid:228)ras fr(cid:229)n kreditinstitutet i vilket kontohavarens identitet styrks och det intygas att identifikationen genomf(cid:246)rdes p(cid:229) ett korrekt s(cid:228)tt och att alla uppgifter har registrerats i enlighet med direktivet. c) Vid vissa f(cid:246)rs(cid:228)kringstransaktioner kan undantag g(cid:246)ras fr(cid:229)n identifikationskraven om betalningen (cid:148)skall ske fr(cid:229)n ett konto som (cid:246)ppnats i kundens namn hos ett kreditinstitut som omfattas av detta direktiv(cid:148) (Artikel 3. 8). vi) Om motparten till det avtalsslutande institutet (cid:228)r ett annat institut som agerar p(cid:229) en kunds v(cid:228)gnar, g(cid:228)ller f(cid:246)ljande: a) Om motparten h(cid:246)r hemma i Europeiska unionen eller Europeiska ekonomiska samarbetsomr(cid:229)det beh(cid:246)ver det avtalsslutande institutet inte genomf(cid:246)ra identifikation av kunden. (Art. 3. 7 i direktivet). b) Om motparten h(cid:246)r hemma utanf(cid:246)r Europeiska unionen och Europeiska ekonomiska samarbetsomr(cid:229)det, skall institutet kontrollera motpartens identitet (om den inte (cid:228)r k(cid:228)nd) genom att konsultera ett tillf(cid:246)rlitligt register (cid:246)ver finansiella institut. Om det skulle r(cid:229)da tvivel i detta h(cid:228)nseende, skall institutet beg(cid:228)ra att f(cid:229) motpartens identitet bekr(cid:228)ftad av tillsynsmyndigheterna i det tredje land d(cid:228)r motparten h(cid:246)r hemma. Institutet skall ocks(cid:229) vidta (cid:148)l(cid:228)mpliga (cid:229)tg(cid:228)rder f(cid:246)r att skaffa sig upplysningar(cid:148) om motpartens kund (de personer, f(cid:246)r vilkas r(cid:228)kning kunderna i fr(cid:229)ga handlar) (Art. 3. 5 i direktivet). Dessa (cid:148)l(cid:228)mpliga (cid:229)tg(cid:228)rder(cid:148) kan str(cid:228)cka sig fr(cid:229)n att endast beg(cid:228)ra kundens namn och adress, i de fall landet till(cid:228)mpar likv(cid:228)rdiga identifikationskrav, till att beg(cid:228)ra ett intyg fr(cid:229)n motparten av vilket det framg(cid:229)r att kundens identitet har kontrollerats och registrerats p(cid:229) ett korrekt s(cid:228)tt, i de fall identifika- tionskraven i landet i fr(cid:229)ga inte (cid:228)r likv(cid:228)rdiga. vii) Ovann(cid:228)mnda f(cid:246)rfaranden utesluter inte anv(cid:228)ndning av andra f(cid:246)rfaranden, som enligt de beh(cid:246)riga myndigheterna kan ge samma s(cid:228)kerhet i identifikationen vid anonyma finansiella transaktioner