1. The Commission is aware of press releases and media reports regarding the launch of Xaxis; however it has not received more information on the details of the service.

2. Directive 95/46/EC of the Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data(1) (Data Protection Directive) imposes obligations on data controllers and confers rights upon data subjects. In particular, under Article 6 of the Data Protection Directive, the obligations of data controllers include processing data fairly and lawfully; collecting data for specified, explicit and legitimate purposes (purpose limitation principle); and not processing them further in a way which is not compatible with those purposes. Data controllers are also obliged to provide data subjects with information such as on the identity of the controller and the purposes of the processing and grant data subjects the right of access to their data. In order to process data lawfully, criteria for making processing legitimate must be met (Article 7). One of the grounds for lawful processing is the consent of the data subject to data processing. If the processing relies on this legal ground, consent in order to be valid must be given unambiguously and has to be informed, freely given and specific.

Directive 2002/58/EC (ePrivacy Directive)(2) appears not to be applicable to this subject matter since WPP is not an electronic communications service provider within the meaning of the EU telecoms framework. Therefore, the Xaxis service does not fall within the scope of the ePrivacy Directive.

3. The notion of personal data is defined as data relating to an identified or identifiable individual. In order to assess if an individual is identifiable, all means reasonably likely to be used by the data controller or a third party have to be taken into account. The article 29 Working Party, and advisory body composed of national supervisory authorities for data protection and the European Data Protection Supervisor (EDPS), has published an opinion about the concept of personal data in 2007(3).

The ongoing reform of the EU data protection legislation takes into account existing and emerging challenges created by the technological developments and globalisation and strives to enable the more effective application and enforcement of EU data protection rules.

4. Without prejudice to the responsibilities of the Commission as guardian of the Treaties, the monitoring and enforcement of the national legislation transposing the Data Protection Directive is the responsibility of national authorities, in particular the national data protection supervisory authorities.

5. The Commission is not in a position to provide an interpretation of US law.

6. The Commission is committed to ensuring that competition prevails on all markets of the European Union, including in the sector of online advertising. On 30 November 2010, the Commission opened an in depth investigation of a series of alleged anticompetitive practices by Google, several of which are related to online advertising(4).

7. Within the context of the antitrust proceedings initiated on 30 November 2010 in cases COMP/C-3/39740 and associated cases, the Commission gathered substantial amounts of information from many actors in the sector of online advertising. At present, the Commission is examining that information and has not yet reached the conclusion that a sector inquiry is needed.

(1) OJ L 281, 23.11.1995. (2) OJ L 201, 31.7.2002. (3) http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2007/wp136_en.pdf (4) See http://europa.eu/rapid/pressReleasesAction.do?reference=IP/10/1624