Translation of "Règle sensible aux données " (French → English) :

30. Stresses that the use of cloud services by public authorities, including by law enforcement authorities and EU institutions, requires special consideration and coordination between the Member States; recalls that data integrity and security must be guaranteed and unauthorised access, including by foreign governments and their intelligence services without a legal basis under Union or Member State law, prevented; stresses that this also applies to the specific processing activities of certain essential non-governmental services, in particular the processing of specific categories of personal data, such as by banks, insurance companies, pension funds, schools and hospitals; stresses, furthermore, that all of the aforementioned is of pa ...[+++]rticular importance if data is being transferred (outside the European Union between different jurisdictions); takes the view, therefore, that public authorities, as well as non-governmental services and the private sector, should, as far as possible, rely on EU cloud providers when processing sensitive data and information until satisfactory global rules on data protection have been introduced, ensuring the security of sensitive data and of data bases held by public entities;

30. Stresses that the use of cloud services by public authorities, including by law enforcement authorities and EU institutions, requires special consideration and coordination between the Member States; recalls that data integrity and security must be guaranteed and unauthorised access, including by foreign governments and their intelligence services without a legal basis under Union or Member State law, prevented; stresses that this also applies to the specific processing activities of certain essential non-governmental services, in particular the processing of specific categories of personal data, such as by banks, insurance companies, pension funds, schools and hospitals; stresses, furthermore, that all of the aforementioned is of pa ...[+++]rticular importance if data is being transferred (outside the European Union between different jurisdictions); takes the view, therefore, that public authorities, as well as non-governmental services and the private sector, should, as far as possible, rely on EU cloud providers when processing sensitive data and information until satisfactory global rules on data protection have been introduced, ensuring the security of sensitive data and of data bases held by public entities;

1. To the extent that PNR of a passenger as collected includes sensitive data (i.e. personal data and information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or data concerning the health or sex life of the individual), DHS shall employ automated systems to filter and mask out sensitive data from PNR.

6. Reminds the Commission that the effects of extending the categories of sensitive data must be thoroughly examined; maintains that the stricter criteria for dealing with sensitive data should not require numerous new legal authorisations to maintain necessary and desired data processing applications and that the list of sensitive data should be extended only in so far as to include all those data which are sensitive in (almost) all conceivable data processing situations, such as genetic data;

Since the former is not yet in force and the latter rules are not European Union law it seems appropriate to insert an article on data protection in this Decision regarding basic protection rules (purpose limitation, physical security of data) and additional safeguards when exchanging specific – sensitive - categories of data (such as data relating to offences or criminal convictions).

We know that there are EU-wide rules on the protection of civilian data, and the planned European legislation on the handling of private data in connection with the prosecution of crime and the war on terror – at least as far as I am aware – is, as things stand, going to contain only rules on how state authorities should handle sensitive data, and so I think we should, as a matter of urgency, aim to use European legislation, once it has been adopted, to intervene and take action at an early opportunity.