text: COM/2023/459 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 459 final. 4 COM(2023) 459 final, p. 1-2. 4

text: COM(2023) 459 final, p. 1. See also EDPS Opinion 2/2017 on the proposed common framework for European statistics relating to persons and households, issued on 1 March 2017; EDPS Opinion on the Proposal for a Regulation on European statistics on population and housing, issued on 16 March 2023, paragraphs 5; EDPS Opinion 40/2023 on the Proposal for a Regulation on European Statistics, issued on 6 September 2023, paragraph 6. 7 See

text: Article 6(3)

text: , second subparagraph, and the ‘detailed topic’ column related to the topic ‘Structure of Earnings’ in the Annex, from which it follows that information is among others requested on ‘Earnings’, and ‘Employee’s characteristics’ on ‘each employee sampled’. 8

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: , OJ L 119, 4.5.2016, p. 1–88. 5

text: Article 5(1)

text: (b) GDPR and

text: Article 4(1)

text: (b) EUDPR. 10 See

text: Article 89(1)

text: GDPR and

text: Article 13

text: EUDPR.

text: Article 13

text: EUDPR states that: “Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.” See on this point also EDPS Opinion 8/2023 on the Proposal for a Regulation on European statistics on population and housing, issued on 16 March 2023, paragraph 6; EDPS Opinion 40/2023 on the Proposal for a Regulation on European Statistics, issued on 6 September 2023, paragraph 7. 11 See also recital 14 of COM(2023) 402 final; EDPS Opinion 40/2023 on the Proposal for a Regulation on European Statistics, issued on 6 September 2023, paragraph 8. 12 COM(2023) 459 final, p. 8. 6

text: Directive

text: of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), OJ L 201, 31.7.2002, p. 37–47. 14 EDPS Opinion 40/2023 on the Proposal for a Regulation on European Statistics, issued on 6 September 2023, section 3. 7

text: Article 89 of the GDPR and Article 13 of the EUDPR. 16 See COM(2023) 459 final, p. 8: “Fostering the use of alternative administrative sources and modern digital techniques, including web scraping and automatically transferring payroll data, which will play a role in mitigating the burden on enterprises in general and small and medium-sized businesses (SMEs) in particular”; see in the same vain also SWD(2023) 265 final, p. 46. 17 EDPS Opinion 40/2023 on the Proposal for a Regulation on European Statistics, issued on 6 September 2023, paragraph 16. See by analogy also EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act), issued on 4 May 2022, paragraph 79. 18 EDPS Opinion 40/2023 on the Proposal for a Regulation on European Statistics, issued on 6 September 2023, paragraph 17 and 19. 19 COM(2023) 459 final, p. 8. 8

text: Regulation (EC) No 223/2009

text: of the European Parliament and of the Council of 11 March 2009 on European statistics and repealing Regulation (EC, Euratom) No 1101/2008 of the European Parliament and of the Council on the transmission of data subject to statistical confidentiality to the Statistical Office of the European Communities,

text: Council Regulation (EC) No 322/97

text: on Community Statistics, and

text: Council Decision 89/382/EEC

text: , Euratom establishing a Committee on the Statistical Programme of the European Communities, OJ L 87, 31.3.2009, p. 164. 21

text: Article 3(7) of Regulation (EC) No 223/2009

text: provides further that to determine whether a statistical unit is identifiable, account shall be taken of all relevant means that might reasonably be used by a third party to identify the statistical unit. 9

text: 25 b. The applicability of

text: Article 17

text: b and 17c of the proposal for a Regulation amending

text: Regulation (EC) No 223/2009

text: to the use or reuse of ‘other sources’ for compiling statistics under

text: Article 3(1)

text: (c) of the Proposal. More in particular, whether the requirement of

text: Article 17

text: c(2)(b) of the Proposal for a Regulation amending

text: Regulation (EC) No 223/2009

text: also applies to requests by Member States to private data holders for data and the relevant metadata under this Proposal ;

text: COM(2023) 402 final. 23 COM(2023) 402 final. 24

text: Article 17

text: b of COM(2023) 402 final concerns the obligation of private data holders to make data available for developing and producing European statistics. 25

text: Article 17

text: c of COM(2023) 402 final concerns requests for data and arrangements for making data available for development and production of European statistics. 26 See EDPS Opinion 40/2023 on the Proposal for a Regulation on European Statistics, issued on 6 September 2023, paragraph 14, in which the EDPS recommends deleting the words “insofar as possible” from

text: Article 17

text: Regulation (EC) No 223/2009

text: . 10

text: EDPS Opinion 40/2023 on the Proposal for a Regulation on European Statistics, issued on 6 September 2023. 28 See further the EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: , 7 November 2019, p. 8. 11

identifier: EDPS yttrande 41/2023

title: EDPS Opinion 41/2023 on the Proposal for a Regulation on European Union labour market statistics on businesses

text: 25 September 2023

text: Opinion 41/2023

text: on the Proposal for a Regulation on European Union labour market statistics on businesses

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on European Union labour market statistics on businesses, repealing

text: Council Regulation (EC) No 530/1999

text: and Regulations

text: (EC) No 450/2003

text: and

text: (EC) No 453/2008

text: of the European Parliament and of the Council .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 28 July 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on European Union labour market statistics on businesses, repealing

text: Council Regulation (EC) No 530/1999

text: and Regulations

text: (EC) No 450/2003

text: and

text: (EC) No 453/2008

text: of the European Parliament and of the Council (‘the Proposal’). The EDPS welcomes the objectives of the Proposal of improving the labour market statistics on businesses (‘LMB’) by covering the whole economy, enhancing its timeliness, filling information gaps and simplifying the framework.

text: The EDPS observes that data transmitted by Member States to the Commission (Eurostat) for the purpose of LMB may constitute personal data of identifiable employees. The EDPS recalls that any processing of personal data should be limited to what is necessary and proportionate in relation to the purpose for which they are processed and considers that the future Regulation should clarify that the data should normally be aggregated to such a degree that individuals cannot be identified.

text: The EDPS recognises that new innovative approaches can bring promises for statistics and research. However, the EDPS has concerns regarding the indication that information relating to specific persons might be obtained from ‘other sources’, which is defined broadly. He considers that the relevant sources for the required data may already be anticipated and he believes it necessary that they are specified.

text: The EDPS also has serious concerns regarding the indication that information relating to specific persons might be obtained from private records. The EDPS considers that collection of personal data from such sources may not be necessary and proportionate to the aims pursued, having regard to the potential risks for the rights and freedoms of data subjects. The EDPS recalls his recommendations in Opinion 40/2023 in this regard that only non-personal (anonymised) data will be requested from private data holders. Insofar as the Proposal seeks to provide a legal basis to request personal data from private data holders, it should provide a clear and comprehensive overview of the privately held data sources from which data may be obtained. Further, the EDPS recommends that sharing of personal data by private data holders shall make use of privacyenhancing technologies and take place using a secure infrastructure.

text: As regards the use of web scraping techniques as an innovative way to process data, the EDPS cautions against the use thereof to collect personal data. There is a risk that individuals lose control of their personal data. The EDPS considers that such processing may not be necessary and proportionate to the aims pursued. He recommends clarifying whether web craping techniques may be used to achieve the envisaged aims under the Proposal, and if this were to be the case, to limit such use to non-personal data.

text: Lastly, concerning the envisaged pilot studies, the EDPS recommends that the future Regulation clarifies that such studies will not allow for data collection beyond the data categories foreseen by the Proposal. He considers further that the roles and responsibilities within the meaning of data protection law of the actors performing such studies should be specified.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 28 July 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on European Union labour market statistics on businesses, repealing

text: Council Regulation (EC) No 530/1999

text: and Regulations

text: (EC) No 450/2003

text: and

text: (EC) No 453/2008

text: of the European Parliament and of the Council (‘the Proposal’) .

text: 2. The Proposal lays down a common legal framework for the development, production and dissemination of labour market statistics on businesses (‘LMB’) in the Union and aims at addressing limitations of LMB under the current legal framework by providing for coverage of the whole economy to improve the accuracy of some statistics. It regulates the collection of annual gender pay gap data to ensure future data transmissions and improve its quality. In addition, it aims at improving the timeliness of some LMB datasets and filling in some existing information gaps. Lastly, it also provides for simplification with greater use of administrative data and innovative sources .

text: 3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 28 July 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 13 of the Proposal.

text: 2. General remarks

text: 4. The EDPS welcomes the objective of the Proposal of improving the LMB statistics by covering the whole economy, enhancing its timeliness, filling information gaps and simplifying the legal framework. The EDPS recognises the usefulness of LMB for the design, implementation and evaluation of EU policies, in particular the coordination of economic and employment policies (

text: Article 2(3)

text: TFEU), monetary policy (

text: Article 3

text: (1c) TFEU), social policy (

text: Article 4

text: (2b) TFEU), and economic, social and territorial cohesion (

text: Article 4

text: (2c) TFEU), as well as equal pay for male and female workers (

text: Article 157(1)

text: TFEU) .

text: 5. The EDPS notes that one of the goals of this regulatory reform is to allow the use of innovative sources for statistical information. New innovative approaches can bring promises for statistics and research, but may also pose risks and raise challenges, thus requiring the co-legislators to ensure that any potential benefits never come at the expense of individuals’ rights. To provide effective protection for the right of privacy and the right to the protection of personal data, the co-legislators should anticipate the potential risks and challenges that these promising approaches may bring and provide for appropriate safeguards . Especially where an instrument aims to be as broad as possible to encompass the use of (future) innovative data and sources, the framework should be specific enough in its safeguards to meaningfully off-set the various risk areas that may arise.

text: 6. The EDPS understands that, pursuant to Article 4(5) of the Proposal, for the purpose of LMB, data shall be transmitted to the Commission (Eurostat) in the form of aggregated data. An exception applies for the topic ‘structure of earnings’, referred to in

text: Article 4(1)

text: , point (a)(i) of the Proposal, for which microdata shall be transmitted for individual employees and local units. Article 2(13) of the Proposal provides that “‘aggregated data’ means data concerning a set of several statistical units”. According to Article 2(12) of the Proposal, “‘microdata’ means data concerning only one statistical unit without a direct identifier”. Article 2(1) of the Proposal provides that “‘statistical unit’ “means the entity on which the data are collected or compiled”. It follows from

text: Article 6(1)

text: (a) to (c) of the Proposal that such statistical units may be enterprises, local units or employees.

text: 7. The EDPS observes that it is not excluded that ‘aggregated data’ and ‘microdata’ transmitted to the Commission (Eurostat) as referred to in Article 4(5) of the Proposal, for the purpose of LMB, may constitute personal data of employees. More particularly, it is not excluded that such information may relate to an identifiable data subject considering that 1) microdata related to structure of earnings information concerns, among others, data related to individual employees (without a direct identifier) ; and 2) according to

text: Article 6(2)

text: , (3) and (5) of the Proposal, the statistical population shall consist of enterprises and/or local units with more than one employee. This would mean that, in some cases, the population could be limited, thus increasing the possibility of (re-)identification of employees, including for aggregated data.

text: 8. The EDPS underlines that any processing of personal data under the Proposal must comply with the requirements of the GDPR . He recalls that any processing of personal data should be limited to what is necessary and proportionate in relation to the purpose for which they are processed. Personal data must be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes . Further processing of personal data for statistical purposes is not considered to be incompatible with the original processing purposes, provided the conditions in

text: Article 89(1)

text: GDPR and

text: Article 13

text: EUDPR are satisfied. In particular, these provisions stipulate that, when personal data are (further) processed for statistical purposes, those data shall in principle be rendered anonymous (or alternatively pseudonymous), provided that the statistical purpose be fulfilled in this manner .

text: 9. Taken into account the above, the EDPS considers that the future Regulation should clarify that the data that Member States transmit to the Commission under the future Regulation should normally be aggregated to such a degree that individuals cannot be identified . For the sake of legal certainty, the EDPS recommends making specific reference to compliance with the safeguards relating to processing of personal data for statistical purposes under

text: Article 89

text: GDPR and

text: Article 13

text: EUDPR, in particular that the data shall in principle be rendered anonymous.

text: 3. Data sources

text: 10. Article 3(1) of the Proposal provides that Member States shall use or reuse one or a combination of the following sources: (a) survey data; (b) administrative records; (c) other sources. Article 2(20) of the Proposal states that “‘other sources’ means data generated by a non-administrative entity including private records, websites and databases, the main aim of which is not the provision of official statistics”. Recital 9 of the Proposal provides that national statistical authorities should consider administrative and innovative sources, the main aim of which is not the provision of statistics, as a substitute for or a complement to statistical surveys, subject to the quality requirements for official statistics. It also states that the latest technological and digital developments can contribute to this objective. To this end, the Explanatory Memorandum to the Proposal gives as examples of modern digital techniques web scraping and the automatically transferring of payroll data from the payroll systems of companies .

text: 3.1. Lawfulness of processing

text: 11. Insofar as data stemming from the sources under Article 3(1) of the Proposal concerns personal data, the EDPS recalls that a necessary condition for the lawfulness of the processing of personal data stemming from these sources is the existence of a legal basis under

text: Article 6

text: GDPR and/or

text: Article 5

text: EUDPR. In case of processing of special categories of data, regard must also be had to the general prohibition included in

text: Article 9

text: GDPR and

text: Article 10

text: EUDPR and the respective exceptions.

text: 12. In addition, the EDPS recalls that data concerning the use of publicly available electronic communications services and public electronic communications networks, as well as the accessing or storing of information in the end-user’s terminal equipment, is subject to specific rules under the ePrivacy Directive . Such data and information may encompass both personal and non-personal data. The EDPS recalls that the ePrivacy Directive imposes specific limits on the processing of the data and information in scope of the Directive. Therefore, the EDPS considers it necessary to clarify that any processing of data stemming from ‘other sources’ under

text: Article 3(1)

text: (c) of the future Regulation shall be without prejudice to the ePrivacy Directive.

text: 3.2. Specification of data sources

text: 13. The EDPS further notes that, as currently defined in the Proposal, ‘other sources’ may consist of a multitude of sources, containing various types of personal data and potentially also including special categories of personal data and other sensitive data that would enable to draw even more intimate inferences on the data subject's’ life and could thus represent a significant risk for their rights and freedoms. By providing two relatively demarcated types of sources, followed by the category ‘other sources’ under

text: Article 3(1)

text: (c),

text: Article 3(1)

text: contains a potentially infinite list of sources of data generated by a non-administrative entity. The EDPS therefore considers that Article 3(1) of the Proposal does not adequately provide a list of sources limited to what is necessary and proportionate to achieve the envisaged purposes.

text: 14. The EDPS considers that the relevant sources for the required 'topics' and 'detailed topics' as specified in the Annex to the Proposal may already be anticipated (indeed the EDPS notes that the Annex to the Proposal sets out the required data to be collected under the domains “earnings; labour costs; labour demand”). Therefore, in order to improve clarity and avoid disproportionate processing of personal data, the EDPS considers it necessary that the future Regulation specifies from which ‘other sources’ data may be collected and transmitted.

text: 3.3. Privately held data

text: 15. Insofar ‘other sources’ under the Proposal refer to privately held data, the EDPS recalls his Opinion 40/2023 . In that Opinion, the EDPS stressed that he understands that privately held data have the potential to help producers of official statistics to provide more accurate statistics that reflect topics of interest to users at a faster pace. He also pointed out that privately held data can be diverse. The EDPS considered that the collection of personal data from privately held data may not be necessary and proportionate to the aims pursued, having regard to the potential risks for the rights and freedoms of data subjects. The EDPS welcomed with regard to privately held data

text: Article 17

text: c(2) of the proposal for a Regulation amending

text: Regulation (EC) No 223/2009

text: on European statistics, which provides that the requests for data by the national statistical institutes (‘NSIs’) and the Commission (Eurostat) shall follow the principle of data minimisation, be proportionate to the statistical need and concern, insofar as possible, non-personal data. He considered that only anonymised data should be requested and used for statistical purposes where privately held data are concerned . Therefore, the EDPS recommended in his Opinion 40/2023 deleting the wording "insofar as possible" from

text: Article 17

text: Regulation (EC) No 223/2009

text: on European statistics to ensure that only nonpersonal (anonymised) data will be requested from private data holders. This recommendation remains valid, also for the current Proposal, as the EDPS understands that Article17c(2) of the proposal for Regulation amending

text: Regulation (EC) No 223/2009

text: on European statistics provides the framework for the processing of privately held data stemming from ‘other sources’ under

text: Article 3(1)

text: (c) of the Proposal.

text: 16. For the sake of completeness, the EDPS recalls that he did not suggest in his Opinion 40/2023 that privately held personal data can never be used for the purpose of creating official statistics. However, the EDPS recalled that the mere reduction of the response burden for private data holders (by not requiring them to anonymise the data) cannot outweigh the potential impact on the fundamental rights and freedoms of the persons concerned. The EDPS believes this consideration to be relevant for this Proposal as well, since the use of modern digital techniques, including use thereof to obtain data from private records, is considered to play a role in mitigating the burden on enterprises . The EDPS further reiterates that due regard must be had to the sensitivity of the data at issue, taking into account the principles of necessity and proportionality . As particularly relevant for this Proposal, the EDPS recalls that Opinion 40/2023 provided that the types of (privately held data) sources from which categories of data may be obtained should be clearly set out in the legislation. Lastly, the EDPS recommended that sharing of personal data by private data holders shall make use of privacy-enhancing technologies and shall take place using a secure infrastructure .

text: 3.4. Web scraping

text: 17. In addition, as already mentioned above, the EDPS observes that the Explanatory Memorandum to the Proposal refers to web scraping as a modern digital technique. The EDPS understands that such technique could possibly be used to collect data from ‘other sources’ mentioned under

text: Article 3

text: (1(c) of the Proposal. The EDPS also understands that, in the context of the Proposal, such technique may be considered for e.g. extracting job advertisements from the internet , and he presumes that it would be used to collect nonpersonal data. The EDPS cautions against the use of web scraping techniques to collect personal data, through which individuals may lose control of their personal information when this is collected without their knowledge, against their expectations and for purposes that are different from those of the original publication. He stresses that the processing of personal data that is publicly available remains subject to EU data protection legislation.

text: 18. The EDPS is of the view that collection of personal data via web scraping may not be necessary for and proportionate to the aims pursued, having regard to the potential risks for the rights and freedoms of data subjects. Furthermore, the use of web scraping techniques to collect data from websites, for their usual nature of an unstructured search on what is public on the internet, might not comply with the data protection principle of accuracy insofar as there is no assessment on the reliability of the sources. The same quality requirements for official statistics (e.g. the principle of statistical accuracy and reliability of source data) might be affected. Therefore, the EDPS considers it necessary that the colegislators clarify whether web scraping techniques may be used to process data from websites as ‘other source’. If this were to be the case, he considers that the use of web scraping techniques should be limited to non-personal data.

text: 3.5. Quality reports

text: 19. Finally, the EDPS notes the mechanism outlined in Article 8(4) of the Proposal, which relates to the submission of quality reports on the sources and methods employed alongside the data, serves as a safeguard to monitor the sources used by Member States. This appears particular relevant for the use of ‘other sources’ under

text: Article 3(1)

text: (c) of the Proposal. Although

text: Article 8(5)

text: specifies that these quality reports will adhere to a format further defined by the Commission through an implementing act, the Proposal does not offer additional guidance on how sources categorised as 'low quality' and the data collected through them should be managed. The EDPS recommends including such guidance.

text: 4. Relationship to

text: Regulation (EC) No 223/2009

text: 20. Recital 11 of the Proposal states that

text: Regulation (EC) No 223/2009

text: constitutes the reference framework for the Proposal, including as regards the protection of confidential data. Article 3(7) of the latter states that “‘confidential data’ means data which allow statistical units to be identified, either directly or indirectly, thereby disclosing individual information” . According to

text: Article 6(6) of Regulation (EC) No 223/2009

text: , a ‘statistical unit’ includes as basic observation unit a natural person referred to by the data. Based on these definitions, the EDPS understands that confidential data under

text: Regulation (EC) No 223/2009

text: includes personal data as defined under the GDPR. Accordingly, in addition to the GDPR,

text: Regulation (EC) No 223/2009

text: also provides the reference framework as regards the protection of personal data in the context of any processing of personal data for statistical purposes under the Proposal.

text: 21. The EDPS recalls that any processing of personal data under the Proposal must comply with the requirements of the GDPR. Therefore, he recommends the co-legislators to make explicit reference to the applicability of the GDPR and EUDPR to the processing of personal data under the future Regulation, similar as in recital 14 of the Commission's recent Proposal for a Regulation of the European Parliament and of the Council amending

text: Regulation (EC) No 223/2009

text: on European statistics .

text: 22. The EDPS recommends the co-legislators to clarify in the enacting terms of the future Regulation the interplay between the future Regulation and

text: Regulation (EC) No 223/2009

text: , including the recently proposed amendments to that Regulation , with regard to the processing of personal data under the Regulation. Currently, recital 10 of the Proposal refers to the application of

text: Article 17

text: a(1) of the Proposal for a Regulation amending

text: Regulation (EC) No 223/2009

text: regarding the use of national administrative records. The EDPS understands that this relates to the use of administrative data sources as provided under

text: Article 3(1)

text: (b) of the Proposal. However, for other provisions, no explanation on the relationship between the legal instruments is provided. Such general explanation is among others relevant to address: a. Whether the Proposal would serve as sectoral statistical legislation of the Union referred to in

text: Article 17

text: b(1) of the proposal for a Regulation amending

text: Regulation (EC) No 223/2009

text: ; c. Whether

text: Article 17

text: f of the Proposal for a Regulation amending

text: Regulation (EC) No 223/2009

text: , including the secure infrastructure to facilitate data sharing to be set up by the Commission (Eurostat) pursuant to paragraph 3 of that provision, applies to data sharing between Member States and the Commission (Eurostat) under the Proposal; and d. How the definitions of ‘statistical unit’ in the different Regulations relate to each other, considering that the definition under Article 6(1) of the Proposal is different from the definition of ‘statistical unit’ under

text: Article 3(6) of Regulation (EC) No 223/2009

text: . The EDPS considers that the use of the same term with a different definition in two related Regulations may create legal uncertainty and therefore recommends clarifying such point. For the sake of completeness, the EDPS also notes that Article 6(1) of the Proposal provides that “[s]tatistics under this Regulation shall be compiled for one or more of the following statistical units: (a) enterprises; (b) local units; (c) employees.” However, under Article 2(1) of the Proposal, ‘statistical unit’ is defined as “(...) the entity on which the data are collected or compiled”, thus excluding employees from the definition. Therefore, the EDPS recommends ensuring that the definition encompasses all the persons concerned.

text: 23. The EDPS recommends that the co-legislators also consult his Opinion 40/2023 on the proposal for a Regulation amending

text: Regulation (EC) No 223/2009

text: (‘Opinion 40/2023’) when clarifying the relationship between

text: Regulation (EC) No 223/2009

text: and the future Regulation, in order to ensure a coherent legal framework for the processing of personal data for statistical purposes, and to provide for adequate safeguards for the rights and freedoms of the data subjects concerned.

text: 5. Pilot Studies

text: 24. The EDPS notes that Article 9 of the Proposal allows for the initiation of feasibility and pilot studies by the Commission, among others to implement new features to respond to user needs, improve integration between surveys and other data sources, and reduce the burden on respondents. According to the Article, “(...) such studies shall take into account technological and digital developments”. In addition, Article 9(2) of the Proposal states that Member States may participate in those studies on a voluntary basis.

text: 25. The EDPS considers that future Regulation should provide how data obtained through the pilot projects will (a) be further used for LMB and (b) potentially be integrated as permanent solutions. In this respect, the EDPS recalls the provisions on Data Protection Impact Assessments (DPIA), which would allow to evaluate the impact of the pilot project on data subjects and ensure data protection by design in any future collection of personal data built upon the foundation of the pilot project.

text: 26. In case data from the pilot projects is further used for the creation of LMB, the EDPS considers that the future Regulation should clarify that such studies would not allow for data collection beyond the 'topics' and 'detailed topics' listed in

text: Article 4(1)

text: and specified within the Annex to the Proposal.

text: 27. Moreover, the EDPS notes that the Proposal does not specify the roles and responsibilities within the meaning of data protection law of the actors performing such studies, namely the Commission (Eurostat) and the Member States, insofar processing of personal data takes place for the purpose of the studies. Ensuring clarity of the role of each actor involved in the processing of personal data is important to promote transparency of processing and the effective exercise of data subject rights. While detailed arrangement to ensure compliance with data protection requirements may be specified by way of an implementing act, the EDPS considers that the roles of the various actors involved as controller, joint controller or processor should be clearly specified in the enacting terms of the future Regulation .

text: 6. Implementing and Delegated Acts

text: 28. Article 4(1) of the Proposal lists the domains and topics to be covered by LMB in relation to earnings, labour costs and labour demands. Moreover, Article 4(7) of the Proposal provides that the Commission shall adopt implementing acts specifying certain elements for each topics.

text: 29. In this regard, when specifying the categories of data, the EDPS recalls first and foremost compliance with the data minimisation principle , which provide that personal data must be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed". As previously indicated, the collection of special categories of personal data or otherwise sensitive data that would enable drawing intimate inferences on the data subject’s life may not be proportionate to the aims pursued.

text: 30. More in general, the EDPS notes that, according to Articles 4(3), 4(7), 7(1), 7(3) and 8(5) of the Proposal, the Commission would be empowered to adopt delegated and implementing acts to supplement the Proposal. In this regard, the EDPS recalls that, when a proposal for legislation has a possible impact on the protection of personal data, the European Commission has to submit it to the EDPS for consultation.

text: 7. Conclusions

text: 31. In light of the above, the EDPS makes the following recommendations: (1) clarify that the data that Member States transmit to the Commission under the future Regulation should normally be aggregated to such a degree that individuals cannot be identified; (2) make specific reference to compliance with the safeguards relating to processing of personal data for statistical purposes under

text: Article 89

text: GDPR and

text: Article 13

text: EUDPR, in particular that the data shall in principle be rendered anonymous; (3) make explicit reference to the applicability of the GDPR and EUDPR to the processing of personal data under the future Regulation; (4) clarify that any processing of data stemming from ‘other sources’ under

text: Article 3(1)

text: (c) of the future Regulation shall be without prejudice to the ePrivacy Directive; (6) ensure that only non-personal (anonymised) data will be requested from private data holders; (7) clarify whether web scraping techniques may be used to process data from websites. If this were to be the case, limit the use of web scraping techniques to non-personal data; (8) provide guidance on how sources categorised as 'low quality' in the quality report under Article 8(4) of the Proposal and the data collected through them should be managed; (9) clarify in the enacting part of the future Regulation the relationship of the future Regulation to

text: Regulation (EC) No 223/2009

text: , including the recently proposed amendments in the proposal for a Regulation amending

text: Regulation (EC) No 223/2009

text: , with regard to the processing of personal data; (10) provide how data obtained through the pilot projects will (a) be further used for LMB and (b) potentially be integrated as permanent solutions; (11) clarify that pilot studies should not allow for data collection beyond the 'topics' and 'detailed topics' listed in

text: Article 4(1)

text: and specified within the Annex to the Proposal; and (12) specify the roles and responsibilities within the meaning of data protection law of the Commission (Eurostat) and the Member States regarding the pilot studies, insofar processing of personal data takes place for the purpose of the studies. Brussels, 25 September 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 13


text: COM(2023) 504 final. 1

text: OJ L 295, 21.11.2018, p. 39. 4

text: COM(2023) 504 final, page 1. 4 OJ L 149, 30.04.2021, p. 10. 5

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1. Section 4.1. of Annex I. 5

text: Commission Implementing Decision

text: (EU) 2021/1772

text: of 28 June 2021 pursuant to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom (notified under document C(2021)4800), C/2021/4800, OJ L 360,11.10.2021, p. 1. 8 In the same vein, see EDPS formal comments on the Recommendation for a Council Decision authorising the opening of negotiations on an agreement between the European Union and United Kingdom of Great Britain and Northern Ireland on cooperation and exchange of information in competition matters, issued on 5 July 2021. 9 See at page 88 of the adequacy decision. See also paragraph 289, at page 90: ‘[...] this Decision will apply for a period of four years

text: as of its entry into force.’

text: A service level agreement ensuring the technical quality and quantity of the services for the functioning of the

text: Article 5

text: PVAT: ‘ communication and information exchange systems shall be concluded according to a procedure established by the Specialised Committee.’ 11

text: Article 5(1)

text: (c) GDPR. 6

identifier: EDPS yttrande 43/2023

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 43/2023 on the position to be taken within the Trade Specialised Committee established by the Trade and Cooperation Agreement between the European Union and the United Kingdom

serie: yttranden

text: 11 October 2023

type: rubrik

text: Opinion 43/2023

text: on the Proposal for a Council Decision on the position to be taken on behalf of the European Union within the Trade Specialised Committee on Administrative Cooperation in VAT and Recovery of Taxes and Duties established by the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’. This Opinion relates to the Proposal for a Council Decision on the position to be taken on behalf of the European Union within the Trade Specialised Committee on Administrative Cooperation in VAT and Recovery of Taxes and Duties established by the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: The aims of the Proposal is to enable the administrative cooperation between the competent tax authorities in the European Union and their homologue in the United Kingdom. Since this cooperation, as further specified in the service level agreement that forms one of the annexes to the Proposal (Annex I), entails the processing of personal data, also by the Commission, the EDPS recommends referring to compliance with the GDPR and the EUDPR in a recital of the Proposal.

text: Moreover, the EDPS recommends to include in the Proposal a specific reference to the adequacy decision as the legal basis allowing for the transfer of personal data by competent authorities in the European Union to competent authorities in the United Kingdom. The EDPS also recommends to supplement the service level agreement (referred to in Annex I to the Proposal) with specific provisions, specifying all relevant data protection aspects.

text: Contents

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 4 September 2023, the European Commission issued a Proposal for a Council Decision on the position to be taken on behalf of the European Union within the Trade Specialised Committee on Administrative Cooperation in VAT and Recovery of Taxes and Duties established by the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part (‘the Proposal’).

text: 2. The Proposal is accompanied by four Annexes, providing: • a draft Decision of the Trade Specialised Committee on Administrative Cooperation in VAT and Recovery of Taxes and Duties established by the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part (‘the Trade Specialised Committee’) on the procedure for the conclusion of a service level agreement (Annex I); • a draft Decision of the Trade Specialised Committee on the amount and modalities of the financial contribution to be made by the United Kingdom of Great Britain and Northern Ireland to the general budget of the Union in respect of the cost generated by its participation in the European Information Systems (Annex II); • a draft Decision of the Trade Specialised Committee laying down implementing rules for provisions relating to recovery assistance of the Protocol on administrative cooperation and combating fraud in the field of value added tax and on mutual assistance for recovery of claims (Annex III); • a draft Decision of the Trade Specialised Committee on standard forms for the communication of information and statistical data, the transmission of information via the Common Communication Network and the practical arrangements for the organisation of contacts between central liaison offices and liaison departments (Annex IV).

text: 3. The objective of the Proposal is to establish the position to be taken on the European Union’s behalf in the Trade Specialised Committee on Administrative Cooperation in VAT and Recovery of Taxes and Duties for the adoption of the decision for the implementation of the Protocol on administrative cooperation and combating fraud in the field of value added tax and on mutual assistance for the recovery of claims relating to taxes and duties (‘the VAT Protocol’, ‘PVAT’), as laid down in

text: Article 39(2)

text: PVAT of the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part (‘the Agreement’) .

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 4 September 2023, pursuant to Article 42(1) of EUDPR. The EDPS remarks that the reference to this consultation in a recital of the Proposal is missing. Therefore, the EDPS recommends inserting such reference in a recital of the Proposal.

text: 2. General remarks

text: 5. The EDPS recognises the importance of ensuring the implementation of the cooperation between the European Union and the United Kingdom in VAT recovery of Taxes and Duties.

text: 6. The EDPS highlights that this implementation, notably having regard to the standard forms for the communication of information and statistical data, the transmission of information via the Common Communication Network and the practical arrangements specified in Annex IV, may entail the processing of personal data falling under the scope of

text: Regulation (EU) 2016/679

text: (‘the GDPR’) . This would be the case e.g. for ‘basic information’ referred to in Annex I to Annex IV (e.g., name, email address, telephone number) which may constitute information related to an identified or identifiable natural person, and thus personal data within the meaning of Article 4(1) of the GDPR. The EDPS also notes that according to the draft Decision of the Trade Specialised Committee on the procedure for the conclusion of a service level agreement the Commission would be required to provide operational services which entail the processing of personal data .

text: 7. Therefore, the EDPS recommend inserting a recital in the Proposal specifying that ‘the processing of personal data in the context of this Council Decision shall comply with

text: Regulation (EU) 2016/679

text: and with

text: Regulation (EU) No 2018/1725

text: 8. Furthermore, the EDPS notes that Chapter V of the GDPR sets out the conditions for transferring personal data from the European Union to a third country (like the United Kingdom). One of the possible lawful means to transfer personal data to a third country is the reliance on an adequacy decision issued by the Commission in relation to such third country pursuant to

text: Article 45

text: GDPR.

text: 9. On 28 June 2021, the Commission adopted a decision recognizing that the United Kingdom ensures an adequate level of protection for personal data transferred within the scope of the GDPR from the European Union to the United Kingdom (‘the UK adequacy decision’) . The EDPS notes that the Proposal would not as such provide for a legal basis for the transfers of personal data within the meaning of the GDPR in the context of exchanges of information between competent tax authorities in the European Union and the competent tax authority in the United Kingdom as per

text: Article 46(2)

text: (a) GDPR. The EDPS considers that such a legal basis would be provided by the UK adequacy decision . Moreover, the EDPS notes that, as specified at paragraph 279 of the UK adequacy decision, ‘during the period of application of this Decision, transfers from a controller or processor in the European Union to controllers or processors in the United Kingdom may take place without the need to obtain any further authorisation from supervisory authorities under the GDPR’ . Therefore, the EDPS recommends including in the Proposal a specific reference to the adequacy decision as the legal basis allowing for the transfer of personal data by competent authorities in the European Union to competent authorities in the United Kingdom.

text: 10. Having specific reference to the proposed service level agreement (Annex I to the Proposal), to be laid down pursuant to

text: Article 5

text: PVAT , the EDPS highlights that this service level agreement should be accompanied by specific provisions specifying all relevant data protection aspects: notably, data protection roles, exercise of data subject’s rights, information to data subjects, data retention period, technical and organizational measure to ensure security, communication of data breaches.

text: 11. The EDPS notes that personal data processing in the context of the Proposal should remain adequate, relevant and limited to what is necessary in relation to the purposes of the processing, in line with the data protection principle of data minimisation . Nonetheless, the EDPS notes, with regard to the categories of personal data to be provided to competent authorities as specified in the Annex IV to the Proposal, that these categories of personal data correspond to information to be provided under the PVAT.

text: 3. Conclusions

text: 12. In light of the above, the EDPS makes the following recommendations: (1) to add a reference to the consultation of the EDPS pursuant to

text: Article 42(1)

text: EUDPR in a recital of the Proposal; (2) to insert a recital in the Proposal specifying that ‘the processing of personal data in the context of this Council Decision shall comply with

text: Regulation (EU) 2016/679

text: and with

text: Regulation (EU) No 2018/1725

text: ’; (3) to include including in the Proposal a specific reference to the adequacy decision as the legal basis allowing for the transfer of personal data by competent authorities in the European Union to competent authorities in the United Kingdom; (4) to accompany by specific provisions the service level agreement (referred to in Annex I to the Proposal), specifying all relevant data protection aspects. Brussels, 11 October 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7

type: vagledning

utgivare: edps