- 130/131 -
The legal regulation of information management can be considered a key issue in administrative (authority) procedures and this fact relies mainly on three factors. As a first step the general concept of technical development has to be highlighted including its effect on the operations of the authorities. It goes without further clarification that the IT boom does not leave (and cannot leave) public administration untouched and the application of new technologies is both suitable to accelerate procedures as well as to create a new participation scheme of those who are concerned. Nevertheless, with due respect to the dangers of the data volume managed by IT systems and the characters of such data, some guarantee regulations are worth mentioning in connection with information management.
The identification of relevant legal regulations among Model Rules is also justified, because information management is in close connection with people's participation in the procedures and in a general sense also with the right to information. Some aspects to fundamental rights in information management can also be stressed and this fact requires a detailed regulation that also offers guarantees. Article 8 of the Charter of Fundamental Rights of the European Union illustrates this properly, when it says "everyone has the right to the protection of personal data concerning him or her", and "such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified."[1]
It is also to be noted that the legislator must create a balance between two interests of different natures, when the data protection regulation is prepared. These are information self-determination and the freedom of information. This is why the national legal systems of the member states also separate the protection of personal data and the legal regulation of the publicity of public data.[2] The working group preparing the Model Rules has basically dealt with three topics, therefore the relevant legal material is also to be divided into three: the technical and organisation side of information management, appealing against public administration decisions in connection with data management and the harmonisation of data protection and the freedom of information are the three topics in this sense.[3]
- 131/132 -
To introduce information management regulations, the Model Rules start with the general rule that "the data providing authority shall inform the person concerned about storing and processing his/her data according to the relevant data protection regulation". The cited regulation, thus, clearly makes it the authority's responsibility to give information, while the phrase "according to the relevant data protection regulation" means that the information must be given following the data protection regulation relevant for data management. Therefore it can be seen that the Model Rules do not determine a material data protection minimum, but set a liability for the data management authority according to valid material law regulations. In order to set the direction of authority practice and to ensure proper information providing the norm text includes that information providing must cover at least:
• the categories of data being processed about the person concerned
• the authority in charge that provides the data
• the addressees of the data and
• the purpose of data processing including the legal basis of data processing according to relevant national law.
It is also a basic interest that the person concerned should not only be informed of the data management of his/her personal data, but this person should also receive real information on the process of data processing. Recognising this, the norm text sets that "the person concerned is entitled to submit an application any time to get a certificate from the authority that provides the data or - with the conditions determined under article VI-30. and VI-33. - from the supervisory authority, if the data on him/her are being processed or not".
Let us have three remarks in connection with the cited regulation. First it must be stressed that in this respect it is the obligation of the application that prevails, the certificate on the process of data processing is issued on the request of the person concerned, therefore the principle "ex officio" does not work here. Secondly it can be stated that the master rules regulate the guarantee of a concrete authority service in this case and the essence of this is to issue a certificate on the process of data processing on a request. Thirdly it is worth discussing from what authority the person concerned may request the issue of the certificate. Based on regulations in reference, the certificate can be obtained from the authority providing the data or - in case of specifically determined conditions- from the supervisory authority. According to articles VI-30. and VI-33. of the norm text this can happen, if the information management is carried out by the support of an information system. Thus, in this case the supervisory authority informs the person concerned about data put into the information system.
The regulation on the obligatory content items of information, which is included in paragraph (3) of article VI-15 of the norm text is important for guarantee. It says that "the data providing authority in charge informs the person concerned about its access right to
- 132/133 -
his/her personal data, including his/her right request the rectification of non-correct data and the cancellation of unlawfully processed data within the shortest time possible and also his/her right to be informed of the procedures aiming the exercise of such rights." Reflecting these it can be stated that the concerned person's right to information (i.e. the authority's obligation to give information) includes the following sub-rights (i.e. the authority is obliged to cover these, when it gives information):
• information on the right of access to personal data
• the initiation of rectification of cancellation of non-correct or unlawfully processed data
• information on the procedures aiming to exercise the above rights.
The procedural guarantee of the real practice of these rights is expressed by the regulation included in paragraph (5) of article VI-15, which says that "the supervisory authority makes sure that the persons concerned can use their access right according to the relevant data protection law effectively".
It is also to be noted that the issuance of a certificate on the application of the person concerned is allowed by the norm text only with limitations, thus only a limited right is created here. Paragraph (5) of article VI-15 of the norm text declares that "information (...) can only be retained with the following purposes:
• prevention and investigation of crimes and the start of a criminal procedure
• national security, public security of the defence of the member states
• protection of an important economic or financial interest of a member state or the EU, including financial, budget and taxation issues
• protection of other people's rights and freedom."
In connection with this limitation the information liability towards the person concerned is of guarantee importance and the Model Rules declare that the authority must inform the person concerned about the reason of retaining information and that he/she has the right to appeal to the data protection ombudsman in charge.[4]
In connection with the data management of authorities the regulation touches two subject circles of a legal relationship with an authority and they are entitled to different rights. Based on the above, on one hand the right of information for the persons concerned and their right of command that is to be discussed eventually, is of vital importance. On the
- 133/134 -
other hand it must be clarified to what extent the authorities have an access right and it is the legislator's duty to decide what data and to what extent the relevant authorities may have access to.
Knowing this, the regulation of the norm text is of theoretical importance, in which it declares that "access to information provided upon an information obligation or information stored in a database is limited to authorities that have an inevitable necessity in having the information to fulil their duties and the access to such information cannot be larger than the necessity to carry out their tasks in harmony with the purpose of sharing the information." The cited regulation actually refers to two basic principles that can be found homogenously in the data management regulations of the member states: these are proportionality and purpose necessity. The principle of proportionality appears in the norm text, when it says that "data management can reach only an extent, where the necessity to carry out the tasks is in harmony with the purpose of sharing the information." The purpose necessity of data management basically means that access to information provided is limited to authorities that have an inevitable necessity in having the information to fulil their duties.
It is connected to the above mentioned that the regulation in paragraph (2) of article CI-16. of the norm text is of guarantee importance, when it says that "clear and thorough rules must be created in the base legal act as well as for execution orders of any information obligation or databases for the authorities that have access to underlying information and have the right of use to them and the conditions must be set, by which access and use can be permitted". There are two remarks concerning the cited regulation. First it can be seen that the regulations for data management that are placed among Model Rules suppose the existence of a "basic legal act" that can make the regulation of data management and its execution orders more concrete and with a "clear" and "thorough" character.
In relation with that it should be noted that the rules in the examined structure unit are of a general character, because their application can only take place, if the base data management regulation that the norm text also refers to is already finished.[5] This norm must clearly and thoroughly determine the content, purpose necessity and form of data management, the obligations of authorities in charge and the law to be applied.
A regulation of the norm text emphasises the importance of structural and procedural guarantees of data management activities for persons concerned. It says that clear and thorough access management rules must be set in the relevant base law act and in the relevant execution orders for all information systems, through which public administration
- 134/135 -
organs may exchange data based on their information obligation or systems that may create a database.
The draft discusses the topic of amendment and cancellation of data and information from two aspects. First from the aspect of decision making competence, when it declares what authorities are entitled to modify or delete information of a certain database in given cases. Second, respecting the principle of officiality the authorities are given obligations in the norm text for amendment and cancellation.
It is recognisable that the norm text gives data base amendment and cancellation competence to three (types of) authorities. According to this, these acts can be carried out by:
• the relevant authority that has provided the information or put them into a database based on its information obligation
• the supervisory authority, and
• the competence to modify or cancel information in a database can also be empowered to one of the bodies listed in article VI-6., as far as this is explicitly allowed by the base law act.
In order to promote the full understanding of the previous regulations please mind paragraph (1) of norm article VI-6, when it says that "each affected member state shall create or appoint an authority or authorities with the task of carrying out the information management activity. Each member state shall inform the Committee or -if established - the directing authority of the list of authorities in charge as well as the modification of the list within the shortest time possible of appointment Should a member state appoint several authorities in charge, it must then clearly define the task distribution on the list."
Reviewing the regulations of the draft it can be stated that there are four case circles in connection with updating, correcting or cancelling information stored in databases. These case circles both include authority acts that are carried out ex officio or on request. Ex officio updates, corrections or cancellations take place by the authority in the following cases:
• First, the authority in charge that provides information is obliged to check information and data and to correct or cancel them immediately, if the authority in charge decides that the information forwarded to other authorities or the data put in databases are not correct or their processing violated the relevant national or EU law.
- 135/136 -
• Secondly, the base law act may oblige the authority providing the information to update the information regularly, in well-defined periods.
• Thirdly, should a participating authority that is not the data providing authority have evidence that the data are incorrect or their processing violated the relevant national or EU regulation, then this authority shall inform the data providing authority immediately. The data providing authority shall then check the data and correct or cancel them, if necessary.
The procedures started upon request should be treated beyond these cases. The request procedure means that "any person concerned may request that the data providing authority should immediately correct non-correct data of the underlying person and unlawfully recorded data or overdue data should be blocked". Finally, the guarantee regulation of paragraph (5) or article VI-19 of the norm text is also to be noted, when it says that the data providing authority is obliged to mark data referring to underlying debate on the request of the person concerned, if the person concerned or another participating authority doubts the correctness of the data, but the true correctness of the data cannot be verified. If the mark has been placed, it can only be removed with the consent of the person concerned or the other participating authority, but with no violation of this limitation the mark can also be removed with the proper decision of the relevant court or independent data protection authority.[6]
As a summary of the above it can be highlighted that the Model Rules that can be perceived as "basic documents" of the EU public administration procedure law are highly abstract, when they approach (?) the public administration (authority) procedural rules. When the above mentioned legal institutions were surveyed, the endeavours of the EU legislators are surely to be appreciated or even praised, because information management is an inevitable and very sensitive issue of the operation of public administration. It is easy to understand that the management and storage of well-defined data requested on purpose is highly essential from the perspective of the state's (public administration's) operation and the establishment of the guarantee rules is also fundamental.
Since besides the national regulation, the valid (i.e. data protection) law material's regulation is based on several international and supranational norms, it is obvious to discuss this topic among the Model Rules and after a content investigation one can state that the regulations in reference are of guarantee importance, which can be suitable to achieve the legislators' goals.
- 136/137 -
Boros Anita (2014): Úton egy európai közigazgatási (eljárási) jog felé. MTA Law Working Papers, 2014/58. Available at: http://jog.tk.mta.hu/uploads/files/mtalwp/2014_58_Boros.pdf (Downloaded: 12.10.2015.)
Fábián Adrián (2011): Közigazgatás-elmélet. Budapest-Pécs, Dialóg Campus Kiadó.
Toward Restatements and Best Practice Guidelines on EU Administrative Procedural Law. European
Parliament Directorate General for Internal Policies, 2010. 12-13. Available at: www.europarl.europa.eu/RegData/etudes/note/join/2010/425652/IPOL-JURI_NT%282010%29425652_EN.pdf (Downloaded: 12.10. 2015.)
Varga Zs. András (2014): Gyorsértékelés az európai közigazgatási eljárási modell-szabályokról. Magyar Jog, No. 10.
Dr. András Bencsik, PhD (bencsik.andras@ajk.pte.hu) Senior Lecturer of the Public Administration Law Department of the Faculty of Law at the University of Pécs. His area of interest covers all areas of the organization and institutions of the public administration and public administration procedures. His area of research includes public administration procedures, public administration jurisdiction, ensuring legality of public administration and economic areas of public administration, especially competition law and consumer protection. In these fields he participated in many different research and expert projects as researcher. Furthermore he is author of numerous publications in Hungarian and English. He published his monography entitled: From the Legality of Public Administration to Technological Innovation in 2015. He defended his PhD thesis entitled: Public Law Framework Content and Prevails of Consumer Protection Law in Hungary in 2013. He published his researches entitled Public Law Framework of Consumer Protection at Dialóg Campus Publishing in 2016. Between 2015 and 2016, he was a member of the codification committee for the act on general public administration procedure. He is reviewer of the journal Public Governance, Administration and Finances Law Review and member of the public body of the Hungarian Academy of Sciences. ■
NOTES
[1] Charter of Fundamental Rights, article 8., par. (1)-(2).
[2] Cf. Fábián Adrián (2011): Közigazgatás-elmélet. Budapest-Pécs, Dialóg Campus Kiadó. 162-164.
[3] Cf. Toward Restatements and Best Practice Guidelines on EU Administrative Procedural Law. European Parliament Directorate General for Internal Policies, 2010. 12-13. Available at: www.europarl.europa.eu/RegData/etudes/note/join/2010/425652/IPOL-JURI_NT%282010%29425652_EN.pdf (Downloaded: 12.10.2015.)
[4] It should be noted that paragraphs (3)-(5) of the relevant article 20 of the 45/2001/EC regulation are appropriate to be applied to submit an appeal or to turn to the European Data Protection Ombudsman. In connection with this see more in Boros Anita (2014): Úton egy európai közigazgatási (eljárási) jog felé. MTA Law Working Papers, 2014/58. 41. Available at: http://jog.tk.mta.hu/uploads/files/mtalwp/2014_58_Boros.pdf (Downloaded: 12.10.2015.)
[5] For more about this see Varga Zs. András (2014): Gyorsértékelés az európai közigazgatási eljárási modellszabályokról. Magyar Jog, No. 10. 547.
[6] To be noted that this regulation does not affect the relevant scope of the supervisory authority.
Lábjegyzetek:
[1] The author is PhD, Senior Lecturer, University of Pécs, bencsik.andras@ajk.pte.hu.
Visszaugrás
