text: COM(2023) 126 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3

text: Directive (EU) 2015/413

text: of the European Parliament and of the Council of 11 March 2015 facilitating cross-border exchange of information on road-safety-related traffic offences, OJ L 68, 13.3.2015, p. 9–25. 4 COM(2023) 127 final. COM(2023) 128 final. 6 COM(2020) 789 final. 7 Initiative No 26 in Annex II to COM(2021) 645 final. 4

text: EDPS Opinion of the European Data Protection Supervisor on the Proposal for a Directive of the European Parliament and of the Council facilitating cross-border enforcement in the field of road safety, issued on 5 December 2008, (2008/C 310/02). 9 COM(2023) 126 final, p. 11. 10 COM(2023) 126 final, Recitals 2 to 4. 11 COM(2023) 126 final, page 5. 5

text: Recital 26 reads as follows: “As data relating to the identification of an offender constitutes personal data within the meaning of

text: Regulation (EU) 2016/679

text: and

text: Directive (EU) 2016/680

text: , and the Union legal framework on handling personal data has been amended significantly since the adoption of

text: Directive (EU) 2015/413

text: , the provisions on the processing of personal data should be aligned with the new legal framework”. 13

text: Article 6(1)

text: (e) and, where applicable,

text: Article 10 of Regulation (EU) 2016/679

text: and Article 8 of Directive 2016/680. 14

text: Article 4

text: a (7)(d) of the CBE Directive as amended by COM(2023) 126 final. 15 Judgment of the Court of Justice of 6 October 2020, La Quadrature du Net (

text: and

text: ), ECLI:EU:C:2020:791, paragraph 132. 16 EDPS comments on a proposal for a Directive of the European Parliament and of the Council facilitating cross-border exchange of information on road safety related traffic offences, issued on 3 October 2014. 6

text: New Article 8(2) of the CBE Directive 18 Judgment of the Court of Justice of the European Union of 5 June 2018, Wirtschaftsakademie Schleswig-Holstein,

text: , paragraph 29. See also the EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: , issued on 7 November 2019, p. 11. 8

text: Recital 31 of the Proposal 9

identifier: EDPS yttrande 11/2023

title: Road Safety Package

text: 24 April 2023

text: Opinion 11/2023 on the Proposal for a Directive of the European Parliament and the Council amending

text: Directive (EU) 2015/413

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to Proposal for a Directive of the European Parliament and the Council amending

text: Directive (EU) 2015/413

text: facilitating cross-border exchange of information on road-safety-related traffic offences Pursuant to

text: Article 91 (1)

text: point (c) TFEU .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: Directive (EU) 2015/413

text: (‘the CBE Directive’) facilitating cross-border exchange of information on road-safety-related traffic offences (‘the Proposal’).

text: The general objectives of the Proposal are to further enhance road safety by extending the scope of the CBE Directive to other road-safety-related traffic offences and refining mutual assistance procedures between Member States in the cross-border investigation of road-safety-related traffic offences, with the view of facilitating the cross-border enforcement of sanctions. The Proposal also aims to improve the protection of fundamental rights of non-resident drivers.

text: The EDPS welcomes the extension of the scope of the CBE Directive, which should contribute to the reduction of the number of road fatalities. The EDPS also welcomes the intention of the Proposal to ensure alignment of the CBE Directive with the Union legislation on data protection. In this context, the EDPS recommends including additional elements, in order to determine the storage duration of personal data which may be exchanged between Member States for the investigation of road-safety-related offences, and to limit the exchanged data to what is necessary for the cross-border investigations and enforcement of sanctions. In particular, the national databases other than the national vehicle registers which may be accessed in the context of the CBE Directive should be clearly defined, as well as the entities authorised to have access to them. Similarly, the conditions of use of the CBE Portal to exchange vehicle registration data and data of persons presumed to be liable for road-safety-related offences should be clarified. The EDPS notes positively the designation of the Commission as the controller of the CBE Portal. However, the EDPS is of the opinion that further clarification is needed to determine the roles and responsibilities of Member States when exchanging personal data, as well as their relationship with the Commission when connecting to the Portal. Finally, the EDPS invites the co-legislator to review the modalities of information of the data subject, as regards the data protection rules.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 1 March 2023, the European Commission issued the Proposal for a Directive of the European Parliament and of the Council amending

text: Directive (EU) 2015/413

text: 2. The Proposal is part of a larger legislative package, referred to as the ‘Road Safety Package’ which also includes: a. a Proposal for a Directive on driving licences, amending

text: Directive (EU) 2022/2561

text: of the European Parliament and of the Council,

text: Regulation (EU) 2018/1724

text: of the European Parliament and of the Council and repealing Directive

text: of the European Parliament and of the Council and

text: Commission Regulation (EU) No 383/2012

text: (the ‘Driving Licence Directive’); b. a Proposal for a Directive on the Union-wide effect of certain driving disqualifications .

text: 3. With the objective of reducing the death toll for all modes of transport in the EU to close to zero by 2050, the Commission issued in 2020 the ‘Sustainable and Smart Mobility Strategy’ and announced the revision of the CBE Directive. Subsequently, this initiative was inserted in Annex II to the Commission Work Programme 2022 (REFIT initiatives), under the heading ‘A New Push for European Democracy’ .

text: 4. The objectives of the Proposal are to further enhance road safety by extending the scope of the CBE Directive to other road-safety-related traffic offences and streamlining mutual assistance procedures between Member States in the cross-border investigation of road- safety-related traffic offences, thus facilitating the cross-border enforcement of sanctions. It also aims to improve the protection of fundamental rights of non-resident drivers.

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission on 1 of March 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 37 of the Proposal.

text: 2. General remarks

text: 6. As already mentioned by the EDPS in his opinion on the original proposal for a Directive facilitating cross-border enforcement in the field of road safety, “it is not questionable that reducing the number of road fatalities is a legitimate purpose that could qualify as a public interest task” .

text: 7. In addition, the Proposal foresees the establishment of cross-border investigation procedures, including a dedicated IT portal, for communication between governmental authorities, businesses and citizens. Such IT portal would inter-connect national registers/back-end IT services in the cross-border exchange of information through designated contact points. The Proposal introduces also a possibility of applying the duty of the vehicle owner or holder to cooperate with authorities in the identification of the liable person .

text: 8. The EDPS considers that the elements presented in the Impact Assessment, as well as in the Explanatory Memorandum and in the Preamble of the Proposal give a clear indication of the objectives of the Proposal, in support of the necessity of the foreseen exchange of personal data.

text: 9. The EDPS welcomes the intention of the Commission to ensure alignment of the CBE Directive with the new rules on personal data protection . Such an alignment is of utmost importance in the context of digitalisation of current cross-border investigation procedures.

text: 10. The present opinion will examine in particular the relationship between the Proposal and the EU data protection legal framework, the applicable rules on data retention, the use of the European car and driving licence information system (EUCARIS) as well as other databases and the online portal (‘the CBE Portal’) to exchange data, the role and responsibilities of the different actors involved in the processing of data, and the rights of the data subject.

text: 3. Relationship to Union legislation on data protection

text: 11. The EDPS welcomes Recital 26 of the Proposal, which refers to the “Union legal framework on handling personal data” and the need to align the provisions of the Proposal on the processing of personal data with the new legal framework .

text: 12. The EDPS also welcomes Recital 28 of the Proposal according to which “Any processing of personal data under

text: Directive (EU) 2015/413

text: should comply with

text: Regulation (EU) 2016/679

text: Directive (EU) 2016/680

text: and

text: Regulation (EU) 2018/1725

text: within their respective scope of application”.

text: 13. Moreover, Recital 29 of the Proposal specifies the legal basis for the processing activities necessary for the Member States to provide mutual assistance to each other in order to identify the persons liable for the road-safety-related traffic offences. The principle of data minimisation is also clearly mentioned in Recital 31 dedicated to the CBE Portal, which recalls that “the exchanged personal data should be limited to what is necessary for the crossinvestigations and enforcement of sanctions”.

text: 14. In this regard, the EDPS notes positively, in situations of mutual assistance between Member States in identifying the liable person, the possibility for the Member State of registration or of residence to refuse to provide the additional information requested. Such is the case, in particular, when the requested information would reveal the identity of a person protected or when “there are substantial grounds to believe that providing the requested information would be incompatible with the Member State of registration’s or with the Member State of residence’s obligations in accordance with Article 6 of the Treaty on European Union and the Charter of Fundamental Rights of the European Union” . As clarified by the Court of Justice of the European Union (‘the CJEU’) , the need for such safeguards is all the greater where personal data is subjected to automated processing and where the protection of the particular category of personal data that is sensitive data is at stake.

text: 15. The EDPS notes that Article 7 of the current CBE Directive is dedicated to data protection and refers explicitly not only to the applicability of the former EU Directive on data protection, but also to key principles relating to processing of personal data: accuracy, storage limitation, purpose limitation and data subject’s rights to information, to access, to rectification, erasure and blocking, to compensation and to judicial redress. In his formal comments issued on 3 October 2014, the EDPS welcomed such references. However, all the relevant provisions of the current Article 7 of the CBE Directive have been moved to the recitals of the Proposal. The EDPS understands that such a change is purely formal, since in any case the EU data protection legal framework should apply to any processing of personal data of data subjects in the Union, in accordance with Article 8 of the Charter of fundamental rights of the European Union.

text: 4. Data retention

text: 16. According to the storage limitation principle, the GDPR, the EUDPR and the LED provide for personal data to be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed”.

text: Article 5

text: LED explicitly requires Member States to provide for appropriate time limits to be established for the erasure of personal data or for a periodic review of the need for the storage of personal data.

text: 17. Against this background, the EDPS welcomes Recitals 7 and 8 of the Proposal, which refer respectively to the necessity to impose “further obligations” on Member States “regarding the need to keep certain data in the relevant databases available and up-to-date to increase the effectiveness of the information exchange”, and to establish “a data retention period (...) as regards the identity of the previous owners”.

text: 18. However, pursuant to the new Article 4(3) of the CBE Directive, Member States would retain data relating to previous holders, owners and, when available, end users of the vehicles in the national vehicle registers “for at least 6 months” after any modification of the ownership or use of the vehicle in question. The EDPS considers that the envisaged storage duration should be specified unambiguously. The reference to a minimum period of storage is not sufficient to ensure consistency and legal certainty. Therefore, the EDPS recommends to also indicate the maximum period of time for which the data may be retained.

text: 19. Similarly, the EDPS recommends to introduce in the new Article 8 of the CBE Directive dedicated to the establishment of the CBE Portal, a provision determining a storage duration for the personal data processed in the context of this portal.

text: 5. Exchanges of data by using other databases

text: 20. The new

text: Article 4

text: (c) of the CBE Directive would lay down the possibility for Member States to exchange or access data by using other databases “such as driving licence registers or population registers for the sole purpose of the identification of the liable person”. This Article specifies that such exchange or access can be done only and in so far as it is “explicitly based on Union legislation”.

text: 21. The EDPS welcomes the reference to the need for a legal basis to allow such use of other databases both in Recital 15 and in

text: Article 4

text: (c). In addition, Recital 15 refers explicitly to the necessity to respect “the fundamental rights of non-resident drivers”. However, the current wording of

text: Article 4

text: (c) leaves open the possibility of using any database, without excluding those which might have a purpose incompatible with the one for which data are stored in national vehicle registers. The EDPS recommends to set out precisely which databases could be consulted, and to specify that only national contact points can have access to such databases for the sole purpose of the identification of the liable person. In addition, a specific procedure should be foreseen, whereby Member States would communicate to the Commission the list of relevant databases, and such lists would be published in the Official Journal of the European Union.

text: 22. The EDPS also welcomes Recital 9, which recommends the sole use of EUCARIS to carry out requests to disclose vehicle registration data and the exchange of the data elements in cross-border cases: “Member States should prevent the exchange of information by other means, which would be less cost-efficient and may not ensure the protection of the transmitted 7 data”. However, the Proposal provides for an online portal, dedicated in particular to the exchange of information “and other interactions” between national contact points and other relevant authorities of Member States with each other. The new

text: Article 8 (1)

text: (a) of the Directive specifies that this may “include exchanging vehicle registration data and the data on persons presumed to be liable or liable for road-safety-related offences”.

text: 23. The EDPS considers that the interplay between exchanges of data via EUCARIS and those through the CBE Portal should be clarified, in order to specify when the portal should be used instead of, or in addition to the decentralised system based on the use of EUCARIS. In particular, in light of the data minimisation principle referred to in Recital 31, the EDPS invites the co-legislator to specify what is meant by the “other interactions” allowed through the CBE Portal. Moreover, as regards the access to the Portal, the EDPS invites the co-legislator to justify the authorisation given to “other relevant authorities that are competent in the identification of the liable persons” , since these authorities might not be involved in the investigation of the road-safety-related traffic offences.

text: 6. Determination of roles and responsibilities

text: 24. The EDPS takes note that the Commission has been defined as controller of the CBE Portal, both in Recital 31 of the Proposal and the new Article 8(3) of the CBE Directive, in accordance with Regulation 2018/1725.

text: 25. The EDPS also notes that the above-mentioned Recital and Article make no reference to the responsibilities of Member States, although it stems from the wording of these provisions that the CBE Portal should facilitate communication between Member States, which implies the processing of personal data.

text: 26. The EDPS recalls that the concepts of controller, joint controller and processor play a crucial role in the application of data protection law, since they determine who is responsible for compliance with different data protection rules, and how data subjects can exercise their rights in practice. Furthermore, in line with

text: Articles 28

text: EUDPR and 26 GDPR, where two or more controllers together determine the purposes and means of the processing, they are considered to be joint controllers. In addition, the concept of controllership does not necessarily refer to one single entity, but can also involve multiple parties playing a role in a processing operation. As a result, and as confirmed by the CJEU , each of the actors involved would have obligations under data protection law. In case of joint controllers, the distribution of tasks between them has to be specified by means of an arrangement between them.

text: 27. Against this background, the EDPS invites the co-legislators to further clarify who bears responsibility and needs to take action if something goes wrong, legally, technically, or otherwise, when using the Portal or one or another of the interconnected “relevant portals, networks, websites or platforms” . Not only the role of the Commission, but also that of the Member States should be explicitly defined in the Proposal.

text: 7. Rights of the data subject

text: 28. The right to information of the data subject on data protection rules is explicitly foreseen in the new

text: Article 5(2)

text: (h) of the Directive. However, this provision lays down the possibility for Member States to provide only the reference to the place where this information “may be easily retrieved”, pursuant to

text: Article 13

text: LED and 13 and 14 GDPR. The EDPS considers more appropriate that clear and comprehensive information about the rights of the data subject is directly given to him/her, in a self-contained document, to be joined to the information letter.

text: 29. The EDPS also notes in the new

text: Article 5(3)

text: that in case of checks on the spot of the liable person, the information letter may not contain the information on the applicable data protection rules. The EDPS invites the co-legislator to clarify the grounds for such a derogation which, prima facie, does not seem justified.

text: 8. Conclusions

text: 30. In light of the above, the EDPS makes the following recommendations: (1) to determine the maximum storage durations for personal data processed in national vehicle registers as well as in the CBE Portal, (2) to specify the other databases to which Member States can have access for the sole purpose of the identification of the liable person, as well as the authorities authorised to access them, (3) to clarify the relations between the decentralised system based on the use of EUCARIS and the CBE Portal, (4) to designate Member States as joint controllers, together with the Commission, of the CBE Portal, (5) to provide to the data subject a comprehensive information on the data protection rules. Brussels, 24 April 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI


text: COM (2023) 637 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM (2023) 637 final. 4 Article 1 of the Proposal. COM (2023) 637 final, p. 3. 4

text: See also EDPS Opinion 02/2022 on the Proposal for a Regulation on the transparency and targeting of political advertising, issued on 20 January 2022, paragraph 7 (where the EDPS welcomed and fully supported “the aim of the Proposal to promote free and fair elections in the EU level, strengthen the resilience of democratic processes and combat disinformation, information manipulation and interference in elections”). 7 COM (2023) 637 final, p. 17 and 18. 8 For further details see the EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data, issued on 19 December 2019. 9 See Judgments of the Court of Justice of 16 December 2008, Satakunnan Markkinapörssi and Satamedia,

text: Case C-73/07

text: , paragraph 56 and of 9 November 2010, Volker und Markus Schecke and Eifert, Joined Cases

text: and

text: , paragraphs 77 and 86. 10

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1–88. 11 COM (2023) 637 final, p. 17. 12 Judgment of the Court of Justice of the European Union of 22 November 2022, WM, Sovim SA v Luxembourg Business Registers, Joined Cases

text: and

text: , ECLI:EU:C:2022:912, paragraphs 42 to 44. 5

text: and

text: , ECLI:EU:C:2022:912, paragraph 63. 14

text: Article 12(1)

text: (a) of the Proposal refers to the information in Annex I, point 1, point (f)(ii). 15

text: Article 12(1)

text: (a) of the Proposal does not refer to information in Annex I, point 1, point (b). 16 In accordance with

text: Article 21

text: GDPR and

text: Article 23

text: EUDPR any individual shall have the right to object, on grounds relating to his or her particular situation to processing of personal data concerning him or her which is based on

text: Article 6(1)

text: (e) GDPR or

text: Article 5(1)

text: (a) EUDPR. 6

identifier: EDPS yttrande 11/2024

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 11/2024 on the Proposal for a Directive establishing harmonised requirements in the internal market on transparency of interest representation carried out on behalf of third countries

serie: yttranden

text: 6 February 2024

type: rubrik

text: Opinion 11/2024

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Directive of the European Parliament and of the Council establishing harmonised requirements in the internal market on transparency of interest representation carried out on behalf of third countries and amending

text: Directive (EU) 2019/1937

text: . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: Directive (EU) 2019/1937

text: The EDPS recognises the legitimacy of the general objective of the Proposal, which aims at providing harmonised transparency requirements as regards activities conducted on behalf of third countries, when they seek to influence the development, formulation or implementation of policy or legislation, or public decision-making processes, in the Union.

text: In order to achieve that goal, the Proposal includes provisions which impose limitations to the right to respect for private life and the right to the protection of personal data, in particular by providing for public access to information on entities carrying out interest representation activities on behalf of third countries.

text: The EDPS welcomes the safeguards laid down in the Proposal in order to ensure that interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter is proportionate and limited to what is strictly necessary. In particular, the EDPS notes that the set of personal data to be made available to the public is limited, and that entities may derogate from the obligation to make information publicly available where there are overriding legitimate interests.

text: The EDPS also positively notes the explicit designation in the Proposal of the different authorities acting as controllers within the meaning of

text: Regulation (EU) 2016/679

text: or

text: Regulation (EU) 2018/1725

text: , with respect to their own data processing activities.

text: While the EDPS is generally satisfied with the safeguards provided by the Proposal, he nevertheless recommends reassessing whether the publication of the address of a legal representative is necessary to achieve the envisaged objective, especially as the Proposal does not provide for publication of the address of the entity mentioned in Article 3(1) of the Proposal. If so, the choice to make available the address of the representative (on not that of the entity referred to in

text: Article 3(1)

text: ) should be duly justified.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 12 December 2023, the European Commission adopted a Proposal for a Directive of the European Parliament and of the Council establishing harmonised requirements in the internal market on transparency of interest representation carried out on behalf of third countries and amending

text: Directive (EU) 2019/1937

text: (‘the Proposal’) .

text: 2. The objective of the Proposal is to lay down rules with respect to economic activities of interest representation on behalf of a third country, with a view of achieving a common level of transparency across the Union and improving the functioning of the internal market . The Proposal, a core element of which is the establishment of national registers for entities carrying out such activities, would introduce common transparency and accountability standards in the internal market .

text: 3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 13 December 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in recital 69 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 4. The EDPS recognises the legitimate objective of ensuring transparency of interest representation activities carried out on behalf of third countries, in order to safeguard the integrity and resilience of public decision-making processes in the Union. This objective, which is related to the one of the Proposal for a Regulation on the transparency and targeting of political advertising , is clearly explained in the Proposal, in particular in the explanatory memorandum and in recitals 11 to 13.

text: 5. By requiring that entities carrying out economic activities of interest representation on behalf of a third country provide certain information to the national authorities and provide for the exchange of such information among competent authorities as well as public access to a part of that information, the Proposal may interfere with individuals’ rights guaranteed by the EU Charter of Fundamental Rights, including the right to data protection. Therefore, the requirements of necessity and proportionality of the envisaged processing need to be assessed in accordance with Article 52(1) of the Charter . The Proposal must ensure that the limitations to the rights to private life and to the protection of personal data in relation to the information provided by these entities apply only in so far as is strictly necessary .

text: 6. Against this background, the EDPS welcomes the reference made in recital 65 regarding the applicability of

text: Regulation (EU) 2016/679

text: (‘the GDPR’) , and of the EUDPR, when personal data are processed in the context of the Proposal.

text: 7. The EDPS positively notes that recital 37 specifies that the information to be included for the purpose of the Proposal in the registration should be limited to what is necessary to ensure transparency requirements and the effective enforcement of the proposed Directive.

text: 8. The EDPS also welcomes the definition of the storage period for logs of personal data processing operations within national registries in Article 9(4) of the Proposal.

text: 3. Publication of personal data

text: 9. The EDPS notes that the Proposal provides for public access of some categories of personal data, in particular the name of entities carrying out interest representation activities on behalf of third countries or, if they are established outside the Union, the name of their designated legal representatives.

text: 10. As noted in the explanatory memorandum , the Court of Justice of the European Union has considered that making personal data accessible to a potentially unlimited number of persons constitutes a serious interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter . At the same time, these rights are not absolute rights, and they may be restricted if such restriction is provided by law, respects the essence of these rights and is strictly necessary and proportionate in relation to the objective of general interest recognised by the European Union .

text: 11. The EDPS notes that the Proposal provides for safeguards to ensure that the publication of personal data is limited to what is necessary to achieve transparency. According to Article 12(1) of the draft Proposal, it seems that, among data which shall be made publicly available, and which are listed exhaustively in Annex I of the Proposal, only a limited number of them may be considered as personal data (essentially names of natural persons, when they represent an entity, and names and addresses of legal representatives of entities established outside the Union).

text: 12. The EDPS observes that the Proposal foresees in publication of the address of a designated legal representative of an entity referred to in

text: Article 3(1)

text: that is established outside the Union . However, the Proposal does not provide for the publication of the address of the place of establishment of the entity referred to in

text: Article 3(1)

text: . The EDPS therefore recommends reassessing whether the publication of the address of a legal representative is necessary to achieve the envisaged objective. If so, the choice to make available the address of the representative (and not that of the entity referred to in

text: Article 3(1)

text: ) should be duly justified.

text: 13. The EDPS welcomes that Article 12(3) of the Proposal provides for the possibility to limit partially or fully public access to those data, where the entity demonstrates that the limitation is justified on grounds of an overriding legitimate interest, ‘including a serious risk that the publication would expose an individual to a violation of their fundamental rights’. The EDPS understands that the enumeration of the fundamental rights mentioned in

text: Article 12(3)

text: is not intended to be exhaustive .

text: 14. Paragraph 4 of

text: Article 12

text: also specifies that any decision taken by a supervisory authority on an application for a derogation from the publication shall be subject to judicial redress in the Member State of registration.

text: 15. In light of the above, the EDPS is generally satisfied that the safeguards provided by the Proposal to limit the publication of personal data are sufficiently detailed and founded to support the legitimacy of the objective pursued, and meet the requirements of necessity and proportionality.

text: 4. Roles and responsibilities

text: 16. The EDPS recalls that the concepts of controller, joint controller and processor play a crucial role in the application of data protection law, since they determine who is responsible for compliance with different data protection rules, and how data subjects can exercise their rights in practice.

text: 17. Against this background, the EDPS welcomes the designation, in Article 9(2) of the Proposal, of the national authorities of Member States as ‘controllers within the meaning of

text: Article 4

text: , point 7 of

text: Regulation (EU) 2016/679

text: ’, when maintaining national registries for the purpose of ensuring transparency of interest representation activities carried out on behalf of third countries.

text: 18. The EDPS also notes that Article 15 of the Proposal provides that Member States shall designate public authorities responsible for the supervision and enforcement of the proposed Directive. These supervisory authorities should cooperate both at national and at Union level, and exchange information with the Commission, which may imply the processing of personal data. The EDPS welcomes in this context the provision included in

text: Article 18(4)

text: , according to which these authorities ‘shall act as controllers within the meaning of

text: Article 4

text: , point 7 of

text: Regulation (EU) 2016/679

text: , and the Commission shall act as a controller within the meaning of

text: Article 3

text: , point 8 of

text: Regulation (EU) 2018/1725

text: with respect to their own data processing activities’.

text: 5. Conclusions

text: 19. In light of the above, the EDPS is generally satisfied with the provisions of the Proposal laid down to ensure the protection of personal data processed in the context of the general objective of transparency of interest representation activities carried out on behalf of third countries, and makes the following recommendation: - reassess whether the publication of the information in Annex I, point 1, point (f)(ii), as provided for by

text: Article 12(1)

text: (a) of the Proposal, is necessary. Brussels, 6 February 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7

type: vagledning

utgivare: edps


text: COM(2025) 179 final.

text: COM(2025) 179 final.

text: OJ L 295, 21.11.2018, p. 39. 4 COM(2025) 179 final. Article 1 of the Proposal. 6 COM(2020) 789 final.

text: COM(2025) 179 final, p. 2. 8 Annex 1, Part I, point 2, point (e) and point (f) of the Proposal. 9

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (Text with EEA relevance), OJ L 119, 4.5.2016, p. 1.

identifier: EDPS yttrande 11/2025

title: Opinion 11/2025 on the Proposal for a Directive on the registration documents for vehicles and vehicle registration data recorded in national vehicle registers and repealing Council Directive 1999/37/EC

text: on the Proposal on the registration documents for vehicles and vehicle registration data recorded in national vehicle registers and repealing

text: Council Directive 1999/37/EC

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Directive of the European Parliament and of the Council on the registration documents for vehicles and vehicle registration data recorded in national vehicle registers and repealing

text: Council Directive 1999/37/EC

text: . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: Council Directive 1999/37/EC

text: (‘the Proposal’).

text: The Proposal aims to lay down common rules on the vehicle registration documents issued by the Member States, on certain data to be recorded in national vehicle registers and on the exchange of such data between Member States.

text: The EDPS notes that the Proposal would require Member States to record in vehicle registers certain personal data in accordance with Annex I. In addition,

text: Article 6(1)

text: defines additional data to be recorded in the vehicle registers, including the outcome of mandatory periodic roadworthiness tests, information on changes to the ownership of vehicles and information on reasons for the cancellation of the vehicle registration.

text: The EDPS welcomes that the Proposal recalls that any processing of personal data for the implementation of the Proposal should comply with the data protection framework of the Union. For the sake of clarity, the EDPS recommends making particular reference to the General Data Protection Regulation (the ‘GDPR’).

text: The EDPS also welcomes that the Proposal indicates that any personal data used in the verification of a vehicle’s registration data should not be retained by the verifier, unless such retention is authorised by Union or national law.

text: Finally, the EDPS positively notes that the Proposal specifies that the Member States should ensure that the issuing authority of the registration certificate is not notified about the verification process of physical vehicle registration certificates, and that it processes the information received through the notification only for the purpose of responding to the verification request for mobile vehicle registration certificates.

text: Contents

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (the ‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 24 April 2025, the European Commission issued a Proposal for a Directive of the European Parliament and of the Council on the registration documents for vehicles and vehicle registration data recorded in national vehicle registers and repealing

text: Council Directive 1999/37/EC

text: (‘the Proposal’).

text: 2. The objective of the Proposal is to lay down common rules on the vehicle registration documents issued by the Member States, on certain data to be recorded in national vehicle registers and on the exchange of such data between Member States .

text: 3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 15 of May, pursuant to Article 42(1) of the EUDPR. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of the EUDPR.

text: 2. General remarks

text: 4. The Sustainable and Smart Mobility Strategy called for adjustments to the roadworthiness legislative framework to ensure a vehicle’s lifetime compliance with emission and safety standards.

text: 5. The Proposal aims to further improve road safety in the EU, contributing to sustainable mobility and facilitating the free movement of people and goods in the EU. In particular, it aims to improve the electronic storage and the exchange of relevant vehicle identification 4 and status data in order to address the lack of availability of such data and improve mutual recognition by enforcing authorities. It introduces general rules applicable to vehicle registration certificates, in particular by distinguishing between physical and mobile vehicle registration certificates. In addition, by ensuring more accurate status data (such as mileage) and a more efficient exchange of information among Member States, the Proposal would also help identify vehicles with tampered odometers .

text: 6. The EDPS notes that Article 6(1) of the Proposal would require Member States to record in vehicle registers certain personal data in accordance with Annex I . Such data include the identity and address of owner of the vehicle, as well as the identity and address of a natural or legal person who may use the vehicle by virtue of a legal right other than that of ownership. These data would be kept up-to-date by the Members States. In addition,

text: Article 6(1)

text: 7. The EDPS welcomes recital 10 of the Proposal, indicating that it should be ensured that personal data processing for the implementation of the Proposal complies with the data protection framework of the Union. For the sake of clarity, the EDPS recommends including in the same recital of the Proposal a particular reference to the applicability of the

text: Regulation (EU) 2016/679

text: (the ‘General Data Protection Regulation’).

text: 8. The EDPS also welcomes Article 7 of the Proposal, providing that any personal data used in the verification of a vehicle’s registration data should not be retained by the verifier, unless such retention is authorised by Union or national law. Furthermore, the EDPS positively notes that Article 7 of the Proposal specifies that the Member States should ensure that the issuing authority of the registration certificate is not notified about the verification process of physical vehicle registration certificates, and that it processes the information received through the notification only for the purpose of responding to the verification request for mobile vehicle registration certificates.

text: 9. The EDPS notes the absence of the reference to this consultation in a recital of the Proposal. Therefore, the EDPS recommends inserting such a reference in a recital of the Proposal.

text: 10. Given the subject matter and the provisions of the Proposal, which do not raise specific issues having regard to the protection of personal data, the EDPS does not have any further comments on the Proposal. 5

text: 3. Conclusion

text: 11. In light of the above, the EDPS makes the following recommendations: (1) to include in recital (10) a reference to the applicability of the

text: Regulation (EU) 2016/679

text: ; (2) to insert a reference to this consultation in a recital. Brussels, 23 June 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 6


text: COM(2025) 1031 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2025) 1031 final. 4 COM(2025) 1031 final, Explanatory Memorandum, p. 1. COM(2025) 1022 final. See also EDPB-EDPS Joint Opinion 3/2026 On the Proposal for a Regulation on establishing a framework of measures for strengthening Union’s biotechnology and biomanufacturing sectors particularly in the area of health (European Biotech Act), adopted on 10 March 2026. 6 COM(2025) 1031 final, Explanatory Memorandum, p. 1. 7 Ibid. 8 Directive

text: of the European Parliament and of the Council of 12 March 2001 on the deliberate release into the environment of genetically modified organisms and repealing

text: Council Directive 90/220/EEC

text: - Commission Declaration, OJ L 106, 17.4.2001, pp. 1–39. 9 Directive

text: of the European Parliament and of the Council of 7 July 2010 on standards of quality and safety of human organs intended for transplantation, OJ L 207, 6.8.2010, pp. 14–29. 4

text: European Commission, ‘New measures to make EU health sector more innovative, competitive and resilient’, Press Release 16.12.2025, https://ec.europa.eu/commission/presscorner/detail/en/ip_25_3077. 11 COM(2025) 1031 final, Explanatory Memorandum, p. 2. 12 Ibid. 13 Recital 2 of Proposal. 5

text: Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ L 281, 23.11.1995, pp. 31–50. 15

text: Article 17(2)

text: (h) Directive

text: . 6

text: EDPS Opinion on the proposal for a directive on standards of quality and safety of human organs intended for transplantation, OJ C192, 15.08.2009. 17 Idem, paragraph 12. 18 Idem, paragraph 17. 19 See also Recital 34 GDPR. 20

text: Article 2(2)

text: (a) Proposal. 21 See, for example,

text: recital 12

text: of

text: Directive 2010/53/EU

text: : Pre-transplant evaluation of potential donors is an essential part of organ transplantation. 22 See, in particular,

text: Article 15(1)

text: and (3) of Directive

text: . 7

text: Article 2(53)

text: Regulation (EU) 2017/745

text: . 24 See, in this respect, EDPS Guidance for co-legislators on key elements of legislative proposals, 7 May 2025, Section 4. 8

identifier: EDPS yttrande 11/2026

title: EDPS Opinion 11/2026 on the Proposal for a Directive as regards the placing on the market of genetically modified micro-organisms and the processing of organs

text: Opinion 11/2026

text: on the Proposal for a Directive amending Directives

text: and

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Directive of the European Parliament and of the Council amending Directives

text: and

text: as regards the placing on the market of genetically modified micro-organisms and the processing of organs . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal for a Directive of the European Parliament and of the Council amending Directives

text: and

text: as regards the placing on the market of genetically modified micro-organisms and the processing of organs that are relevant from a data protection perspective.

text: Executive Summary

text: and

text: as regards the placing on the market of genetically modified micro-organisms and the processing of organs.

text: The objective of the Proposal is to create and reinforce favourable conditions for health biotechnology while safeguarding high standards of protection of human health, patient safety and animal health, the environment, ethics, quality of products, food and feed safety, and biosecurity. The Proposal accompanies the Proposal for a European Biotech Act and aims to make targeted updates to two pieces of sectoral legislation, Directives

text: and

text: , to ensure this new framework operates effectively within the existing acquis.

text: The EDPS welcomes the Proposal’s objectives of improving consistency, legal clarity and the smooth functioning of the Union legislative framework for biotechnology, and eventually to ensure the availability of safe and high-quality therapies and other products for Union citizens. The EDPS recalls that compliance with data protection rules must be ensured, as the provision of healthcare by its nature entails the processing of personal data, including special categories of data.

text: Exceptions to the prohibition on processing of personal data concerning health may be provided for by Union law where necessary for reasons of preventive or occupational medicine, medical diagnosis, and the provision of healthcare or treatment based on Union or Member State law or pursuant to contract with a health professional. The EDPS recommends explicitly clarifying that Directive

text: , as amended by the Proposal, aims to provide an exception to the prohibition to process sensitive categories of data under

text: Article 9(2)

text: (h) GDPR.

text: The Proposal makes reference to the exchange of clinical outcome data between competent authorities. Considering the sensitivity of personal data concerning health, the EDPS recommends that the Proposal clearly define what constitutes clinical outcome data, how this data is exchanged and what safeguards apply. The EDPS also recommends clarifying the allocation of roles and responsibilities of the competent authorities exchanging this data under EU data protection law.

text: Finally, considering that organ exchange and transplantation may occur between Member States and third countries, the EDPS recommends clarifying if the authorisation of organ processing may also involve the transfer of personal data to third countries.

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 16 December 2025, the European Commission adopted the Proposal for a Directive of the European Parliament and of the Council amending Directives

text: and

text: as regards the placing on the market of genetically modified micro-organisms and the processing of organs (‘the Proposal’). On 1 April 2026, the Commission formally requested an opinion from the EDPS in accordance with

text: Article 42(1)

text: EUDPR.

text: 2. The objective of the Proposal is to create and reinforce favourable conditions for health biotechnology, from research and development to the timely placing on the Union market and production of biotechnology innovations and products, while safeguarding high standards of protection of human health, patient safety and animal health, the environment, ethics, quality of products, food and feed safety, and biosecurity .

text: 3. The Proposal accompanies the Proposal for a Regulation of the European Parliament and of the Council to establish measures to strengthen the Union’s biotechnology and biomanufacturing sectors (‘Proposal for a European Biotech Act’) , which establishes a legislative framework to strengthen the competitiveness of the health biotechnology sector . The Proposal also aims to make targeted updates to two pieces of sectoral legislation for the new framework to operate effectively within the existing acquis , namely 8 9 Directive

text: and Directive

text: . This Proposal was announced as part of a package of measures to improve the health of EU citizens, while ensuring the long-term resilience and competitiveness of the health sector .

text: 4. The proposed amendments to Directive

text: aim to unlock the innovation potential of genetically modified micro-organisms (‘GMMs’) and to render the EU market more attractive for their development, production and marketing by making the applicable rules on GMMs fit for purpose . Directive

text: was primarily designed to regulate genetically modified plants, making it less suitable for GMMs which differ significantly from plants in terms of biological properties, capabilities and potential applications. The adjustments in the Proposal aim to create a tailored, more efficient and streamlined regulatory framework for GMMs.

text: 5. The proposed amendments to Directive

text: aim to address the extension of the exvivo time window between procurement from the donor and transplantation into the recipient, which creates opportunities for applying different types of processing to maintain or improve the functional status of organs prior to transplantation . The Proposal introduces, with the aim of legal certainty, provisions clarifying how these processing activities can be organized under the oversight of transplant authorities. Clarifying the regulatory treatment of organ processing and strengthening oversight mechanisms aligns Directive

text: with current clinical practice and supports coordinated implementation across Member States.

text: 6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 1 April 2026, pursuant to Article 42(1) of EUDPR.

text: 2. General remarks

text: 7. The EDPS welcomes the Proposal’s objectives of improving consistency, legal clarity and the smooth functioning of the Union legislative framework for biotechnology, and eventually to ensure the availability of safe and high-quality therapies and other products for Union citizens .

text: 8. As the provision of healthcare by its nature entails the processing of personal data, the EDPS recommends inserting a recital recalling the applicability of the GDPR and of the EUDPR to any processing of personal data conducted in relation to the processing of personal data covered by the Proposal.

text: 9. The EDPS notes that there is no reference in the Proposal to the consultation of the EDPS in accordance with

text: Article 42(1)

text: EUDPR and recommends including such a reference in a recital to the Proposal.

text: 10. The EDPS notes that Directive

text: contains provisions addressing data protection aspects.

text: Article 16

text: in particular makes reference to Directive

text: , now repealed by the GDPR, and requires that Member States ensure that the fundamental right to protection of personal data is fully and effectively protected in all organ donation and transplantation activities, in conformity with Union provisions on the protection of personal data such as Articles

text: and

text: of Directive 95/46/EC.

text: Article 17 of Directive 2010/53/EU

text: also provides that competent authorities must ensure that the fundamental right to protection of personal data is fully and effectively protected in all organ transplantation activities, in conformity with Union provisions on the protection of personal data, in particular Directive

text: 11. The EDPS recalls that, as per

text: Article 94(2)

text: GDPR, references to the repealed Directive

text: are to be construed as references to the GDPR. However, as the Proposal aims to amend and update Directive

text: , the EDPS recommends updating Articles

text: and

text: of Directive 2010/53/EU to make references to the relevant provisions of the GDPR.

text: 3. Amendments to Directive

text: on the deliberate release into the environment of genetically modified organisms

text: 12. Proposed

text: Article 24

text: b and 24e(3)(c) empower the Commission to adopt delegated acts, in accordance with proposed

text: Article 29

text: a of Directive

text: , to amend Annex III of Directive

text: to provide for specific information requirements in notifications concerning 1) the placing on the market of GMMs, and 2) the placing on the market of lowrisk GMMs respectively. Annex III sets out the information required in the notification to the competent authority. Annex III A, in particular, sets out the information required in notifications concerning releases of GM organisms other than higher plants, including the name, qualifications and experience of responsible scientist(s). Proposed

text: Article 24

text: g also empowers the Commission to adopt implementing acts on adapted modalities and additional information required for the notification. The EDPS recalls that if delegated or implementing acts provide for the processing of personal data, the EDPS should be consulted pursuant to

text: Article 42(1)

text: EUDPR.

text: 4. Amendments to Directive

text: on quality and safety of human organs intended for transplantation

text: 13. The EDPS previously issued an Opinion on the Proposal for a Directive of the European Parliament and of the Council on standards of quality and safety of human organs intended for transplantation . In this Opinion, the EDPS noted that while it is questionable whether biological materials of human origin, such as organs, tissues, cells or blood, can be as such considered as personal data, it is undisputed that such materials can be used as sources of personal information about their holder . Furthermore, this Opinion noted that Directive

text: (now replaced by the GDPR) applied to the collection, storage and processing of identifiable organs and the subsequent extraction of information from such organs, for as long as it remains possible, with due account of all means likely reasonably to be used, to identify the person concerned . The permanent traceability of organs as set out by

text: Article 10 of Directive 2010/53/EU

text: keeps the persons identifiable throughout the lifecycle of organs. Moreover,

text: Article 16 of Directive 2010/53/EU

text: provides that donors and recipients whose data are processed within the scope of this Directive must not be identifiable, except as permitted by

text: Article 8(2)

text: and (3) of Directive

text: (corresponding to the derogation under

text: Article 9(2)

text: (i) GDPR).

text: 14. As information about organs reveals information about the health status of the donor, and thus qualify as ‘data concerning health’ under

text: Article 4(15)

text: GDPR, it is particularly important to ensure robust safeguards. Information about organs may also constitute genetic data under

text: Article 4(13)

text: GDPR, notably if they contain an analysis of the deoxyribonucleic acid (DNA) of the donor or otherwise provide information about the inherited or acquired genetic characteristics of a natural person which give unique information about their physiology or health . Both genetic data and data concerning health are especially protected under

text: Article 9(1)

text: GDPR.

text: 15. The Proposal modifies the current definition of ‘transplantation’ in

text: Article 3

text: (q) by removing the specific mention of a donor, whereby transplantation is amended to mean ‘a process intended to restore certain functions of the human body by transferring an organ to a recipient’ . Other parts of Directive

text: continue to refer to the donor in the context of transplantation . In particular,

text: Article 15 of Directive 2010/53/EU

text: requires that Member States take all necessary measures to ensure the highest possible protection of living donors to fully guarantee the quality and safety of organs for transplantation, and that Member States must keep a register or record of the living donors in accordance with Union and national provisions on the protection of personal data and statistical confidentiality .

text: Article 16 of Directive 2010/53/EU

text: further requires that Member States ensure that the fundamental right to protection of personal data is fully and effectively protected in all organ donation and transplantation activities. The EDPS understands that, notwithstanding the removal of the word “donor” from the definition of transplantation, the relevant protections for donors continue to apply.

text: 16. Proposed

text: Article 6

text: a(8) provides that competent authorities under Directive

text: , Directive

text: Regulation (EC) No 726/2004

text: Regulation (EU) 2017/745

text: and

text: Regulation (EU) 2024/1938

text: must collaborate to exchange clinical outcome data. A definition of clinical outcome data is not provided by these legal acts, although

text: Regulation (EU) 2017/745

text: notes that clinical outcomes may “includ[e] […] outcome(s) related to diagnosis, or a positive impact on patient management or public health” . Considering that clinical outcome data might constitute personal data pertaining to the health status of a data subject and thus qualify as ‘data concerning health’ under

text: Article 4(15)

text: GDPR, a derogation from the prohibition under

text: Article 9(1)

text: GDPR would be required in order to process clinical outcome data. The EDPS understands that

text: Article 16 of Directive 2010/53/EU

text: would provide for a derogation to

text: Article 9(1)

text: GDPR under

text: Article 9(2)

text: (h) GDPR, but recommends making this explicit in a recital of the Proposal.

text: 17. In addition, the EDPS recommends that the Proposal defines the term “clinical outcome data” and provides further clarifications which categories of personal data, in particular those concerning health, that the clinical outcome data may include. The EDPS further recommends specifying how this information is exchanged and which safeguards shall be in place. The EDPS also considers that the Proposal should determine the roles and responsibilities of the parties exchanging clinical outcome data under

text: Article 6

text: a of the Proposal under EU data protection law .

text: 18. Proposed

text: Article 6

text: a(12) confers on the Commission the power to adopt implementing acts, in particular to lay down detailed rules for the application and authorisation of organ processing in accordance with the procedure referred to in

text: Article 30(2) of Directive 2010/53/EU

text: . The EDPS recalls that, where such implementing acts provide for the processing of personal data, the EDPS should be consulted pursuant to

text: Article 42(1)

text: EUDPR. The EDPS also recommends clarifying in a recital to the Proposal whether the authorisation of organ processing may involve the transfer of data on organs to third countries. If so, the EDPS reminds that Chapter V GDPR continues to apply when transfers occur.

text: 5. Conclusions

text: 19. In light of the above, the EDPS makes the following recommendations: (1) to add a recital to the Proposal recalling the applicability of the GDPR and of the EUDPR; (3) to update Articles

text: and

text: of Directive 2010/53/EU in the Proposal to make references to the relevant provisions of the GDPR; (4) to make explicit in the Proposal that

text: Article 16 of Directive 2010/53/EU

text: provides for a derogation to

text: Article 9(1)

text: GDPR under

text: Article 9(2)

text: (h) GDPR; (5) to define ‘clinical outcome data’ in the Proposal; (6) to determine in a recital to the Proposal what the exchange of clinical outcome data involves, in what environment this exchange occurs, and what safeguards should be put in place to ensure the security of this data; (7) to determine in a recital to the Proposal the roles and responsibilities of the parties exchanging clinical outcome data under

text: Article 6

text: a of the Proposal under EU data protection law; (8) to clarify in a recital to the Proposal whether the authorisation of organ processing involves the transfer of data on organs to third countries. Brussels, 27 May 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 9


text: OJ L 295, 21.11.2018, p. 39. 2 COM (2022) 166 final. 3 Agreement between the European Union and the Kingdom of Norway on administrative cooperation, combating fraud and recovery of claims in the field of value added tax (OJ L 195, 1.8.2018, p. 3-22). 4 COM (2022) 166 final, p. 2. 4

text: 6 904/2010 and

text: Council Directive 2010/24/EU

text: to fight against VAT fraud, and assist each other to recover claims in the field of VAT.

text: Council Regulation (EU) No 904/2010 of 7 October 2010

text: on administrative cooperation and combating fraud in the field of VAT (OJ L 268, 12.10.2010, p. 1-18).

text: Council Directive 2010/24/EU of 16 March 2010

text: concerning mutual assistance for the recovery of claims relating to taxes, duties and other measures (OJ L 84, 31.3.2010, p. 1-12). 7

text: Council Regulation (EU) 2018/1541 of 2 October 2018

text: amending Regulations

text: (EU) No 904/2010

text: and

text: (EU) 2017/2454

text: as regards measures to strengthen administrative cooperation in the field of value added tax (OJ L 259, 16.10.2018, p. 1–11). 8 Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31–50). 9

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1–88). 10 See Preamble, Whereas (1) of the Proposal. 11 COM (2022) 166 final, p. 1. 12

text: Article 6

text: (‘Confidentiality and protection of personal data’). 5

identifier: EDPS yttrande 12/2022

title: Recommendation for a Council Decision authorizing the Commission to open negotiations regarding the Agreement between EU & Norway on administrative cooperation, fight against fraud & recovery of claims in the area of VAT

text: 20 June 2022

text: Opinion 12/2022

text: on the Recommendation for a Council Decision to authorise the Commission to open negotiations for the amendment of the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, fight against fraud and recovery of claims in the area of value added tax

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the EDPS' mission to advise the EU institutions on coherently and consistently applying the EU data protection principles, including when negotiating agreements with third countries. It builds on the general obligation that international agreements must comply with the provisions of TFEU and the respect for fundamental rights that stands at the core of EU law. In particular, compliance with Articles 7 and 8 of the Charter of Fundamental Rights of the EU and Article 16 TFEU must be ensured.

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Recommendation that are relevant from a data protection perspective.

text: Executive Summary

text: The objective of the Proposal is to amend the Agreement currently in place between the European Union and the Kingdom of Norway on administrative cooperation (‘the Agreement’). The Agreement allows the EU Member States and Norway to cooperate to fight against VAT fraud and assist each other to recover claims in the field of VAT in a similar way as EU Member States do under

text: Council Regulation (EU) No 904/2010

text: and

text: Council Directive 2010/24/EU

text: . The amendment of the Agreement would allow administrative cooperation with Norway with new cooperation tools, similar to the ones introduced in

text: Council Regulation (EU) 904/2010

text: with

text: Council Regulation (EU) 2018/1541

text: The Annex to the Proposal contains the negotiating directives for the amendment of the Agreement, which would cover administrative cooperation via the exchange of information by using other means than standard forms; administrative enquiries carried out jointly and Eurofisc follow-up actions, introduced by

text: Council Regulation (EU) 2018/1541

text: . The negotiating directives also indicate the need to replace the reference to the repealed Directive

text: by

text: Regulation (EU) 2016/679

text: (‘the GDPR’).

text: The EDPS takes note of the data protection safeguards concerning the principle of purpose limitation and of storage limitation laid down in

text: Article 55(5) of Council Regulation (EU) No 904/2010

text: as amended by

text: Council Regulation (EU) 2018/1541

text: , according to which cooperation between Norway and the EU Member States shall take place. However, the EDPS recommends including in the negotiating directives an explicit reference to these safeguards.

text: The EDPS takes note of the safeguards concerning the protection of personal data already contained in the Agreement. However, the EDPS recommends further substantial alignment of Article 6(7) of the Agreement with the provisions contained in Chapter V of the GDPR.

text: The EDPS also recommends inserting a reference to this consultation of the EDPS in a Recital of the Proposal.

text: Contents

text: 3. Need for further alignment with Chapter V of the GDPR .. 6

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 26 April 2022, the European Commission issued a Proposal for a Recommendation for a Council Decision to authorise the Commission to open negotiations for the amendment of the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, fight against fraud and recovery of claims in the area of value added tax (‘the Proposal’).

text: 2. The objective of the Proposal is to amend the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, fight against fraud and recovery of claims in the area of value added tax (‘the Agreement’) by including new tools that would allow for better cooperation and enhance the fight against fraud, thus bringing advantages to both parties to the Agreement (Norway and Member States) .

text: 3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 28 April 2022, pursuant to Article 42(1) of EUDPR.

text: 2. General remarks

text: 4. The Proposal aims at amending the Agreement by including new tools that would enhance administrative cooperation between the competent authorities of Norway and the Member States in the area of the fight against tax fraud concerning value added tax (‘VAT’).

text: 5. The Agreement entered into force in September 2018 and allows the EU Member States and Norway to cooperate according to the rules established under Council Regulation (EU) No

text: 6. The Annex to the Proposal contains the negotiating directives for the amendment of the Agreement. According to the Annex, the negotiations should cover the following administrative cooperation tools, introduced by

text: Council Regulation (EU) 2018/1541

text: amending

text: Council Regulation (EU) No 904/2010

text: : - the exchange of information by using other means than standard forms; - administrative enquiries carried out jointly by competent authorities of Norway and of the Member States; - Eurofisc follow-up actions.

text: 7. The negotiating directives indicate the need to replace the reference to the repealed 8 9 Directive

text: by

text: Regulation (EU) 2016/679

text: (‘the GDPR’) .

text: 8. The EDPS takes note that, according to the Commission, the administrative cooperation, including the exchange of information between competent authorities, pursuant to the Agreement has already shown a very positive outcome .

text: 9. The EDPS also takes note that the Joint Committee established under Article 41 of the Agreement has recommended the opening of negotiations to supplement and amend the Agreement as specified in the Proposal.

text: 10. The EDPS notes that the Agreement, pursuant to which the administrative cooperation and exchange of information is currently taking place, contains a specific article on the protection of personal data , laying down in particular that any information obtained by a State under the Agreement is subject to protection of personal data in accordance with Directive

text: 11. The EDPS notes that the provisions of Article 6 of the Agreement lay down among others the purpose of the exchange of information; which authority can access the information exchanged; safeguards on onward transfers, as well as safeguards concerning transfers to third countries. The EDPS also notes that both the competent authorities and the communication channel for the administrative cooperation are specified in Article 3 of the Agreement. Furthermore, the Joint Committee, established under Article 41 of the Agreement, is in charge of determining among others the frequency of practical arrangements for, and the exact categories of information subject to, automatic exchange.

text: 12. Furthermore, the EDPS notes and welcomes that the negotiation directives include an explicit reference that the negotiations should not lead to the possibility for Norway to “access the databases of the Member States”.

text: 13. The EDPS also notes that

text: Council Regulation (EU) 2018/1541

text: amending

text: Council Regulation (EU) No 904/2010

text: , according to which cooperation between Norway and the EU Member States shall take place, amends

text: laying down data protection safeguards concerning the principle of purpose limitation (

text: Article 5(1)

text: (b) GDPR) and of storage limitation (

text: Article 5(1)

text: (e) GDPR). However, the EDPS recommends that these safeguards are explicitly referred to in the negotiation directives.

text: 14. The EDPS welcomes the inclusion in the negotiating directives of the update concerning the applicable data protection law (namely, the GDPR, repealing Directive

text: 15. The EDPS also notes that Article 6(7) of the Agreement details the conditions applicable to the transfer of information obtained in accordance with the Agreement to third countries. However, these conditions do not exactly reflect the possibilities and limitations provided for by the provisions in Chapter V of the GDPR. In particular,

text: Article 6(7)

text: (c) of the Agreement refers to “assistance arrangements” between the State transmitting the information and the third country, instead of referring to legally binding and enforceable instruments between public authorities and bodies and to administrative arrangements between public authorities or bodies pursuant to

text: Article 46(2)

text: (a) and

text: Article 46(3)

text: (b) GDPR and to the possible derogations pursuant to

text: Article 49

text: GDPR.

text: 16. Therefore, the EDPS recommends including in the negotiating directives a reference to the need to align the provisions in Article 6(7) of the Agreement to the relevant provisions contained in Chapter V of the GDPR.

text: 4. Reference to this consultation

text: 17. The EDPS notes the absence of a reference to this consultation in a Recital of the Proposal. Hence, the EDPS recommends inserting a reference to the EDPS consultation in a Recital of the Proposal. 6

text: 5. Conclusions

text: 18. In light of the above, the EDPS makes the following recommendations: (1) including in the negotiating directives an explicit reference to the data protection safeguards concerning the principle of purpose limitation and of storage limitation laid down in

text: as amended by

text: Council Regulation (EU) 2018/1541

text: ; (2) including in the negotiating directives a reference to the need to align the provisions in Article 6(7) of the Agreement to the relevant provisions contained in Chapter V of the GDPR; (3) inserting a reference to the EDPS consultation in a Recital of the Proposal. Brussels, 20 June 2022 [e-signed] Wojciech Rafał Wiewiórowski 7