PURPOSE: to improve administrative cooperation by means of the Internal Market Information System (IMI).

LEGISLATIVE ACT: Regulation (EU) No 1024/2012 of the European Parliament and of the Council on administrative cooperation through the Internal Market Information System and repealing Commission Decision 2008/49/EC (‘the IMI Regulation').

CONTENT: following an agreement at first reading with the European Parliament, the Council adopted a regulation that lays down the rules governing the use of the Internal Market Information System for the implementation of administrative cooperation , including the processing of personal data, between the Member States' competent authorities and between the Member States' competent authorities and the Commission.

The Internal Market Information System (IMI) is a software application accessible via the internet, developed by the Commission in cooperation with the Member States, in order to assist Member States with the practical implementation of information exchange requirements laid down in Union acts by providing a centralised communication mechanism to facilitate cross-border exchange of information and mutual assistance.

The new Regulation establishes a legal framework for the IMI and a set of common rules to ensure that it functions efficiently and to enable its use to be extended to other areas of EU law.

Scope: the Regulation stipulates that IMI shall be used for administrative cooperation between competent authorities of the Member States and between competent authorities of the Member States and the Commission necessary for the implementation of Union acts in the field of the internal market, within the meaning of Article 26(2) of the Treaty on the Functioning of the European Union (TFEU).

The list of these acts is as follows:

Directive 2006/123/EC of the European Parliament and of the Council on services in the internal market; Directive 2005/36/EC of the European Parliament and of the Council on the recognition of professional qualifications; Directive 2011/24/EU of the European Parliament and of the Council on the application of patients' rights in cross-border healthcare; Regulation (EU) No 1214/2011 of the European Parliament and of the Council on the professional cross-border transport of euro cash by road between euro-area Member States; Commission Recommendation on principles for using ‘SOLVIT' - the Internal Market Problem Solving Network.

The Commission may carry out pilot projects in order to assess whether IMI would be an effective tool to implement provisions for administrative cooperation of Union acts not listed in the Annex.

Processing of personal data: IMI actors shall exchange and process personal data only for the purposes defined in the relevant provisions of the Union acts listed in the Annex. Data submitted to IMI by data subjects shall only be used for the purposes for which the data were submitted.

National IMI coordinators: these shall act as the main contact point for IMI actors of the Member States for issues relating to IMI, including providing information on aspects relating to the protection of personal data in accordance with this Regulation.

Where international agreements are concluded between the Union and third countries that also cover the application of provisions of Union acts listed in the Annex to this Regulation, it is possible to include the counterparts of IMI actors in such third countries in the administrative cooperation procedures supported by IMI, provided that it has been established that the third country concerned offers an adequate level of protection of personal data in accordance with Directive 95/46/EC.

ENTRY INTO FORCE: 04/12/2012.

The European Parliament adopted by 623 votes to 25, with 35 abstentions, a legislative resolution on the proposal for a regulation of the European Parliament and of the Council on administrative cooperation through the Internal Market Information System (‘the IMI Regulation’).

Parliament adopted its position on first reading following the ordinary legislative procedure. The agreement was the result of a compromise negotiated between Parliament and Council. The main amendments to the proposal are as follows:

Scope: it is stipulated that IMI shall be used for administrative cooperation between competent authorities of the Member States and between competent authorities of the Member States and the Commission necessary for the implementation of Union acts in the field of the internal market, within the meaning of Article 26(2) of the Treaty on the Functioning of the European Union (TFEU). Those Union acts are listed in the Annex.

Nothing in this Regulation shall have the effect of rendering mandatory the provisions of Union acts which have no binding force.

Expansion of IMI: the Commission may carry out pilot projects in order to assess whether IMI would be an effective tool to implement provisions for administrative cooperation of Union acts not listed in the Annex.

The Commission shall adopt an implementing act to determine which provisions of Union acts shall be subject to a pilot project and to set out the modalities of each project, in particular the basic technical functionality and procedural arrangements required to implement the relevant administrative cooperation provisions.

The Commission shall submit an evaluation of the outcome of the pilot project, including data protection issues and effective translation functionalities, to the European Parliament and the Council. Where appropriate, that evaluation may be accompanied by a legislative proposal to amend the Annex to expand the use of IMI to the relevant provisions of Union acts.

Practical arrangements to enable information exchange via IMI: these arrangements should be adopted by the Commission in the form of a separate implementing act for each Union act listed in the Annex or for each type of administrative cooperation procedure and should cover the essential technical functionality and procedural arrangements required to implement the relevant administrative cooperation procedures via IMI. The Commission should ensure the maintenance and development of the software and IT infrastructure for IMI.

Processing of personal data: IMI actors shall exchange and process personal data only for the purposes defined in the relevant provisions of the Union acts listed in the Annex. Data submitted to IMI by data subjects shall only be used for the purposes for which the data were submitted.

Personal data processed in IMI shall be blocked in IMI as soon as they are no longer necessary for the purpose for which they were collected, depending on the specificities of each type of administrative cooperation and, as a general rule, no later than six months after the formal closure of the administrative cooperation procedure.

The Commission :

shall only have access to such personal data that are strictly necessary to carry out its tasks within the responsibilities set out in this Regulation, such as the registration of national IMI coordinators; shall also have access to personal data when retrieving, upon a request by another IMI actor, such data that have been blocked in IMI and to which the data subject has requested access; shall not have access to personal data exchanged as part of administrative cooperation within IMI, unless a Union act provides for a role for the Commission in such cooperation.

National IMI coordinators shall act as the main contact point for IMI actors of the Member States for issues relating to IMI, including providing information on aspects relating to the protection of personal data in accordance with this Regulation.

Information exchange with third countries: where international agreements are concluded between the Union and third countries that also cover the application of provisions of Union acts listed in the Annex to this Regulation, it should be possible to include the counterparts of IMI actors in such third countries in the administrative cooperation procedures supported by IMI, provided that it has been established that the third country concerned offers an adequate level of protection of personal data in accordance with Directive 95/46/EC.

SOLVIT : the use of IMI for the technical support of the SOLVIT network shall be without prejudice to the informal character of the SOLVIT procedure which is based on a voluntary commitment of the Member States.

To continue the functioning of the SOLVIT network on the basis of existing work arrangements, one or more tasks of the national IMI coordinator may be assigned to SOLVIT centres within the remit of their work, so that they can function independently from the national IMI coordinator.

The Committee on the Internal Market and Consumer Protection adopted the report by Adam BIELAN (ECR, PL) on the proposal for a regulation of the European Parliament and of the Council on administrative cooperation through the Internal Market Information System (‘the IMI Regulation’).

The committee recommends that the European Parliament’s position in first reading following the ordinary legislative procedure should amend the Commission proposal as follows:

Treatment of personal data : the report states that all personal data and information circulated among the different competent authorities must be collected, processed and used for strictly legitimate purposes which are in line with data protection rules. Furthermore, all relevant safeguards against abuse of the system shall be firmly put in place.

Members inserted the following amendments:

· personal data processed in IMI shall be blocked in the system after a period of no longer than eighteen months after the formal closure of an administrative cooperation procedure;

· the storage of personal data included in the repository shall comply with the provisions of data protection set out in Union legislation on protection of personal data;

· data submitted by data subjects to IMI shall only be used for the purposes for which the data were submitted. Data subjects' consent shall also be required for extension of the use of those data to new areas or workflows.

· IMI actors shall ensure that data subjects are informed about processing of their personal data in IMI within 30 days of such processing. The correction and deletion shall be carried out as soon as possible, and at the latest 30 days after the request of data subject is received.

Development of IMI and its extension to other areas of Union law : Members oppose the Commission’s provisions on amending the scope of the Regulation through delegated acts. They suggest that the Commission may propose an amendment to the Annex to this Regulation if it decides that IMI is to be used for new legal acts of the Union .

· Before submitting a proposal, the Commission may carry out pilot projects of a limited duration or impact assessment, including data protection, in order to assess whether IMI would be an effective tool for the implementation of provisions on administrative cooperation of internal market acts not yet listed in the Annex.

· The Commission shall submit the results of the pilot project or of the impact assessment to the European Parliament and to the Council, and where appropriate, accompany them with a legislative proposal to amend the Annex for the expansion of IMI.

Competent authorities : an amendment states that Member States shall take all necessary measures to ensure effective application of this Regulation by the competent authorities. The latter shall fulfil their obligations under the Regulation in the same way as they would if acting at the request of another competent authority within their own Member State.

Commission’s role : the report stipulates that the Commission shall monitor the application of this Regulation and report back to the European Parliament, the Council and the European Data Protection Supervisor.

It also wants the Commission to play a consultative role in the process of designating the IMI coordinators and competent authorities.

Access rights of IMI actors and users: the committee considers that external actors should only have access to a public interface , which is technically separate from the IMI application and does not provide access to personal data exchange between competent authorities.

Lastly, Members want the Commission's internal control mechanisms to include data privacy assessments, including a security risk analysis, on the basis of which a data protection policy (including a security plan) will be adopted, as well as periodic reviews and auditing.

Opinion of the European Data Protection Supervisor on the Commission proposal for a Regulation of the European Parliament and of the Council on administrative cooperation through the Internal Market Information System (‘IMI’).

The EDPS welcomes the fact that the Commission formally consulted him and that a reference to this Opinion is included in the preamble of the proposal.

The overall views of the EDPS on IMI are positive . The EDPS supports the aims of the Commission in establishing an electronic system for the exchange of information and regulating its data protection aspects. The EDPS also welcomes the fact that the Commission proposes a horizontal legal instrument for IMI in the form of a Council and Parliament Regulation. He is pleased that the proposal comprehensively highlights the most relevant data protection issues for IMI.

Nevertheless, the EDPS cautions that establishment of a single centralised electronic system for multiple areas of administrative cooperation also creates risks . These include, most importantly, that more data might be shared, and more broadly than strictly necessary for the purposes of efficient cooperation, and that data, including potentially outdated and inaccurate data, might remain in the electronic system longer than necessary.

The security of the information system accessible in 27 Member States is also a sensitive issue, as the whole system will be only as secure as the weakest link in the chain permits it to be.

The EDPS makes the following recommendations:

Legal framework : with regard to the legal framework for IMI to be established in the proposed Regulation, the EDPS calls attention to two key challenges: (i) the need to ensure consistency, while respecting diversity, and (ii) the need to balance flexibility and legal certainty:

that functionalities that are already foreseeable should be clarified and more specifically addressed; that adequate procedural safeguards should be applied to ensure that data protection will also be carefully considered during the future development of IMI. This should include an impact assessment and consultation of the EDPS and national data protection authorities before each expansion of IMI's scope to a new policy area and/or to new functionalities; access rights by external actors and access right to alerts should be further specified.

Retention periods :

the Regulation should provide guarantees that cases will be closed in a timely manner in IMI and that dormant cases (cases without any recent activity) will be deleted from the database, it should be reconsidered whether there is an adequate justification for the extension of the current 6-month period to 18 months following case closure, the Commission has not provided sufficient justification for the necessity and proportionality of retention of ‘blocked data’ up to a period of five years, and therefore, this proposal should be reconsidered, a more clear distinction should be made between alerts and repositories of information : the Regulation should provide, as a default rule that (i) — unless otherwise specified in vertical legislation, subject to adequate additional safeguards — a six-month retention period should apply to alerts and that (ii) this period should be counted as of the time of sending the alert.

Risk assessment : the Regulation should require a risk assessment and a review of the security plan before each expansion of IMI to a new policy area or before adding a new functionality with an impact on personal data.

Information and access rights : the provisions on information to data subjects and access rights should be strengthened and should encourage a more consistent approach.

Supervision : the EDPS would strengthen the provisions on coordinated supervision at certain points and would for that purpose support similar provisions as those in place for example in the context of the Visa Information System, Schengen II and envisaged for Eurodac. With regard to the frequency of meetings and audits, the EDPS supports the proposal in its flexible approach aimed to ensure that the Regulation provides the necessary minimal rules to ensure effective cooperation without creating unnecessary administrative burdens.

Third countries: the Regulation should ensure that competent authorities or other external actors in a third country that does not afford adequate protection should not be able to have direct access to IMI unless there are appropriate contractual clauses in place. These clauses should be negotiated at the EU level.

Internal control : the Regulation should establish a clear framework for adequate internal control mechanisms that ensures data protection compliance and provides evidence thereof, including privacy assessments (also including a security risk analysis), a data protection policy (including a security plan) adopted based on the results of these, as well as periodic reviews and auditing.

Lastly, the Regulation should also introduce specific privacy by design safeguards .

PURPOSE: to lay down rules on the use of the Internal Market Information System (IMI) for administrative cooperation, including the processing and exchange of personal data of EU citizens between the competent authorities of the Member States and the Commission.

PROPOSED ACT: Regulation of the European Parliament and of the Council.

BACKGROUND: to support cooperation between the national public administrations responsible for the application of Union law, the European Commission has developed the Internal Market Information System (IMI) which is a generic, customisable administrative cooperation platform.

Freely available for use by the Member States since 2008, this system

provides more than 6 000 registered authorities in the 27 Member States and three EEA countries with a fast and secure communication channel for cross-border information exchange with their counterparts, effectively overcoming barriers due to different languages and administrative structures. IMI is currently used for the exchange of information pursuant to Directive 2005/36/EC on the recognition of professional qualifications and Directive 2006/123/EC on services in the internal market.

Cross-border administrative cooperation frequently involves processing and exchanging personal data of EU citizens. From a legal point of view, IMI operates on the basis of a Commission decision, a ‘comitology’ decision, and a Commission recommendation. The lack of a single legal instrument adopted by the European Parliament and the Council underlying its operations came to be seen as an obstacle to further expansion of IMI.

According to the Commission Communication “ Towards a Single Market Act ”, extending IMI to other sectors ‘with a view to creating a genuine face-to-face electronic network for European administrations’ is one of the keys to promoting better governance of the single market. The Commission’s communication on expanding and developing the IMI’ (the IMI Strategy Communication ) adopted on 21 February 2011 set out plans for future expansion of IMI to other areas of EU law. The Commission Communication “ A Single Market Act ” stressed the importance of IMI for strengthening cooperation among the actors involved, including at local level, thus contributing to better governance of the single market.

IMPACT ASSESSMENT: this proposal consolidates the current rules governing IMI within a single horizontal legally binding instrument. Consequently, no alternative policy options need to be considered at this stage. For this reason, no impact analysis was undertaken. Any subsequent decisions concerning the expansion of the use of IMI beyond the areas of Union law for which it is currently used will require proportionate impact assessments.

LEGAL BASIS: Article 114 of the Treaty on the Functioning of the European Union (TFEU).

CONTENT: this proposal aims at improving the conditions for the functioning of the internal market by providing an effective and user-friendly tool facilitating the practical implementation of provisions of Union law mandating administrative cooperation and information exchange.

The proposal for a Regulation:

sets down rules for the use of the IMI system for administrative cooperation. These rules include the obligation to appoint one national IMI coordinator per Member State, the obligation on competent authorities to provide an adequate response in a timely manner and the provision that information exchanged via IMI may be used for providing evidence in the same way as similar information obtained within the same Member State; lays down the basic principles for data protection in the IMI , including the rights of data subjects, in a single legal instrument, thus increasing transparency and enhancing legal certainty.

The list of areas of Union acts currently supported by IMI is set out in Annex I, while areas of possible future expansion are listed in Annex II. The procedural and budgetary aspects aimed at facilitating future expansion of IMI are in line with the IMI Strategy Communication.

BUDGETARY IMPACT: as the use of IMI is mandatory for Member States under the Services Directive and the recently adopted Directive on the application of patients’ rights in cross-border healthcare, it is necessary to ensure that IMI can continue to operate on a permanent basis. For this reason, it is proposed that the expenditure related to IMI be regrouped by bringing all costs under the same budget line managed by DG Internal Market and Services (budget line 12.02.01 Implementation and development of the Internal Market).

This proposal does not have a budgetary impact over and above what is already foreseen in the years to come in the official programming of the Commission and it is without prejudice to the decisions on the post-2013 multi-annual financial framework.

In 2010, the financing of IMI was covered by the following sources: i) ISA programme (EUR 500 000 – budget line 26.03.01.01) and ii) internal market budget lines (EUR 925 000).

For 2011-2012, the planned financing from ISA will amount to ca. EUR 1.15 million per year.

The impact on operational expenditure is estimated at EUR 1.44 million in commitment appropriations for the year 2013 .

DELEGATED ACTS: the proposal contains provisions conferring on the Commission the right to adopt delegated acts in accordance with Article 290 of the Treaty on the Functioning of the EU.

PURPOSE: to lay down rules on the use of the Internal Market Information System (IMI) for administrative cooperation, including the processing and exchange of personal data of EU citizens between the competent authorities of the Member States and the Commission.

PROPOSED ACT: Regulation of the European Parliament and of the Council.

BACKGROUND: to support cooperation between the national public administrations responsible for the application of Union law, the European Commission has developed the Internal Market Information System (IMI) which is a generic, customisable administrative cooperation platform.

Freely available for use by the Member States since 2008, this system

provides more than 6 000 registered authorities in the 27 Member States and three EEA countries with a fast and secure communication channel for cross-border information exchange with their counterparts, effectively overcoming barriers due to different languages and administrative structures. IMI is currently used for the exchange of information pursuant to Directive 2005/36/EC on the recognition of professional qualifications and Directive 2006/123/EC on services in the internal market.

Cross-border administrative cooperation frequently involves processing and exchanging personal data of EU citizens. From a legal point of view, IMI operates on the basis of a Commission decision, a ‘comitology’ decision, and a Commission recommendation. The lack of a single legal instrument adopted by the European Parliament and the Council underlying its operations came to be seen as an obstacle to further expansion of IMI.

According to the Commission Communication “ Towards a Single Market Act ”, extending IMI to other sectors ‘with a view to creating a genuine face-to-face electronic network for European administrations’ is one of the keys to promoting better governance of the single market. The Commission’s communication on expanding and developing the IMI’ (the IMI Strategy Communication ) adopted on 21 February 2011 set out plans for future expansion of IMI to other areas of EU law. The Commission Communication “ A Single Market Act ” stressed the importance of IMI for strengthening cooperation among the actors involved, including at local level, thus contributing to better governance of the single market.

IMPACT ASSESSMENT: this proposal consolidates the current rules governing IMI within a single horizontal legally binding instrument. Consequently, no alternative policy options need to be considered at this stage. For this reason, no impact analysis was undertaken. Any subsequent decisions concerning the expansion of the use of IMI beyond the areas of Union law for which it is currently used will require proportionate impact assessments.

LEGAL BASIS: Article 114 of the Treaty on the Functioning of the European Union (TFEU).

CONTENT: this proposal aims at improving the conditions for the functioning of the internal market by providing an effective and user-friendly tool facilitating the practical implementation of provisions of Union law mandating administrative cooperation and information exchange.

The proposal for a Regulation:

sets down rules for the use of the IMI system for administrative cooperation. These rules include the obligation to appoint one national IMI coordinator per Member State, the obligation on competent authorities to provide an adequate response in a timely manner and the provision that information exchanged via IMI may be used for providing evidence in the same way as similar information obtained within the same Member State; lays down the basic principles for data protection in the IMI , including the rights of data subjects, in a single legal instrument, thus increasing transparency and enhancing legal certainty.

The list of areas of Union acts currently supported by IMI is set out in Annex I, while areas of possible future expansion are listed in Annex II. The procedural and budgetary aspects aimed at facilitating future expansion of IMI are in line with the IMI Strategy Communication.

BUDGETARY IMPACT: as the use of IMI is mandatory for Member States under the Services Directive and the recently adopted Directive on the application of patients’ rights in cross-border healthcare, it is necessary to ensure that IMI can continue to operate on a permanent basis. For this reason, it is proposed that the expenditure related to IMI be regrouped by bringing all costs under the same budget line managed by DG Internal Market and Services (budget line 12.02.01 Implementation and development of the Internal Market).

This proposal does not have a budgetary impact over and above what is already foreseen in the years to come in the official programming of the Commission and it is without prejudice to the decisions on the post-2013 multi-annual financial framework.

In 2010, the financing of IMI was covered by the following sources: i) ISA programme (EUR 500 000 – budget line 26.03.01.01) and ii) internal market budget lines (EUR 925 000).

For 2011-2012, the planned financing from ISA will amount to ca. EUR 1.15 million per year.

The impact on operational expenditure is estimated at EUR 1.44 million in commitment appropriations for the year 2013 .

DELEGATED ACTS: the proposal contains provisions conferring on the Commission the right to adopt delegated acts in accordance with Article 290 of the Treaty on the Functioning of the EU.