Translation of "Commutateur privé intégrant téléphonie et données " (French → English) :

When assessing whether a personal data breach is likely to adversely affect the personal data or privacy of a subscriber or individual, account should be taken, in particular, of the nature and content of the personal data concerned, in particular where the data concerns financial information, such as credit card data and bank account details; special categories of data referred to in Article 8(1) of Directive 95/46/EC; and certain data specifically related to the provision of telephony or internet services, i.e. e-mail data, location data, internet log files, web browsing histories and itemised call lists.

55. Recalls that while the final responsibility for security measures relating to different payment methods cannot lie with customers, they should be informed about security precautions, and financial institutions should be responsible for fraud costs, unless caused by the customer ‘by acting fraudulently or by failing to fulfil one or more of his obligations under Article 56 of the Payment Service Directive with intent or gross negligence’; considers, therefore, that public information campaigns should be encouraged with a view to increasing public awareness and knowledge of digital security issues in particular; calls on the Commission, when developing a strategy and instruments for the integration of payment markets by card, internet a ...[+++]nd mobile phone, to take into account the standards and recommendations of EDPS regarding transparency, identification of the controller/ processor, proportionality and rights of the data subject; considers it important that all payment frauds in SEPA are reported to a centralised site for monitoring, statistics and evaluation, in order to respond quickly to new security threats, and that the main developments should be made public; asks the Commission to extend the concept of privacy by design beyond authentication mechanisms and security safeguards so as to ensure data minimisation, to implement privacy by default settings, to limit the access to individual's information to what is strictly needed to provide the service,- and to implement tools enabling users to better protect their personal data;

24. Insists on the need to promote the use of Privacy Enhancing Technologies and to implement the principle of Privacy by Design to ensure that privacy issues are included in future technological developments; Calls on the Commission to encourage technology providers to integrate core privacy principles, including data minimisation, transparency and user control, into the development and deployment of technologies in order to guarantee a high level of protection of personal data throughout the Single Market;

29. Expresses concern at the fact that international cooperation in the fight against terrorism has often served to diminish the level of protection of human rights and fundamental freedoms, notably the fundamental right to privacy, data protection and non-discrimination, and takes the view that the EU should act with greater resolve at international level to promote a genuine strategy based on full compliance with international standards and obligations in the area of human rights and the protection of personal data and privacy in accordance with Articles 7 and 8 of the Charter; consequently urges the Council to adopt the draft framewo ...[+++]rk decision on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, in line with Parliament's recommendations for higher standards; takes the view that a strategy such as this must take account of the need for effective judicial control of the intelligence services so as to avoid the use of information obtained by torture, ill-treatment or other methods not meeting international human rights standards as evidence in judicial procedures, including at the investigative stage;

It may therefore be necessary to adopt measures requiring manufacturers of certain types of equipment used for electronic communications services to construct their product in such a way as to incorporate safeguards to ensure that the personal data and privacy of the user and subscriber are protected.

In addition, the EDPS would like to remind that the development of IT tools for the establishment of the ODR platform should integrate privacy and data protection from the very early design stage (privacy by design), including the implementation of tools enabling users to better protect personal data (such as authentication and encryption).