It has been published in the OJ the opinion of the European Data Protection Supervisor (EDPS) on the Commission Decision of 12 December 2007 concerning the implementation of the Internal Market Information System (IMI) as regards the protection of personal data (2008/49/EC)

The main conclusions proposed by the European Data Protection Supervisor (EDPS) are:

• The EDPS supports the aims of the Commission in establishing an electronic system for the exchange of information and regulating its data protection aspects.
• The IMI Decision needs a solid legal basis. The EDPS recommends that the Commission reconsiders its choice of legal basis and seeks solutions to remedy the imperfections of the legal basis chosen, with the possible consequence of replacing the IMI Decision by a legal instrument that fulfils the requirement of legal certainty.
• As an ultimately most sound solution, the EDPS suggests analysing the possibility of adopting a separate legal instrument for the IMI-system, at the level of the Council and the European Parliament, similar to the Schengen Information System, Visa Information System and other large-scale IT databases or alternatively, it could be analysed whether Article 34 of the Services Directive and similar provisions yet to be adopted with respect to other internal market legislation could provide for the necessary legal basis.
• Additionally, the Opinion provides for a number of suggestions on the provisions regulating the data protection aspects of IMI, to be included in a new legal instrument replacing the IMI Decision as proposed above or, in the absence of such a new instrument to be included in the IMI Decision itself, after amending this decision.
• Many of the suggestions can already now be applied in practice by the IMI-actors, without amending the Decision. The EDPS expects the Commission to take the recommendations provided in this Opinion on board to the extent possible, at least on the operational level, as far as they relate to activities of the Commission as IMI-actor.
• These recommendations relate to transparency and proportionality, joint control and allocation of responsibilities, notice to data subjects, rights of access, objection, and rectification, data retention, security measures and joint supervision.