text: The EDPS considers that issues of lack of contestability and possibilities of market entry that the Proposal seeks to address are exacerbated by the closed nature of gatekeepers (“walled gardens”). Increased interoperability has the potential to facilitate the development of a more open, pluralistic digital environment, as well as to create new opportunities for the development of innovative digital services.

text: The EDPS recommends the co-legislature to consider introducing minimum interoperability requirements for gatekeepers, with explicit obligations on gatekeepers to support interoperability, as well as obligations not to take measures that impede such interoperability. The EDPS suggests to draw up at European level technical standards on interoperability which should be supported by gatekeepers (in its various specifications, namely protocol interoperability, data interoperability, full protocol interoperability ). Such technical standards should be in compliance with European data protection law, not lower the level of security provided by platforms and not hinder innovation via too detailed interoperability standards. The European standardisation organisations, in consultation with the European Data Protection Board where appropriate, should draw up standards which satisfy these requirements. The Commission should have the possibility to request the European standardisation organisations to develop such European standards, in accordance with the applicable Union legislation on European standardisation.

text: OJ L 119, 4.5.2016, p. 1. OJ L 201, 31.7.2002, p. 37. OJ L 295. 21.11.2018, p. 39. COM(2020) 842 final. COM(2020) 67 final. COM(2020) 842 final p. 1. COM(2020) 842 final p. 2. https://edps.europa.eu/press-publications/press-news/press-releases/2020/shaping-safer-digital-future-newstrategy-new_de Explanatory Memorandum of the Proposal, p. 2. Recital (61) of the Proposal. “A new pro-competition regime for digital markets Advice of the Digital Markets Taskforce”, 8 December 2020, available at: https://assets.publishing.service.gov.uk/media/5fce7567e90e07562f98286c/Digital_Taskforce_-_Advice_--.pdf “Investigation of competition in digital markets, Majority Staff Report and Recommendations, Subcommittee on Antitrust, Commercial and Administrative Law of the Committee on the Judiciary, United States, 2020, available at: https://judiciary.house.gov/uploadedfiles/competition_in_digital_markets.pdf Among others, “Preliminary Opinion of the European Data Protection Supervisor Privacy and competitiveness in the age of big data: The interplay between data protection, competition law and consumer protection in the Digital Economy”, March 2014, available at: https://edps.europa.eu/sites/edp/files/publication/14-03-26_competitition_law_big_data_en.pdf Opinion 7/2015, “Meeting the challenges of big data. A call for transparency, user control, data protection by design and accountability”, available at: https://edps.europa.eu/sites/edp/files/publication/15-11-19_big_data_en.pdf Opinion 8/2016, “Opinion on coherent enforcement of fundamental rights in the age of big data”, available at: https://edps.europa.eu/sites/edp/files/publication/16-09-23_bigdata_opinion_en.pdf EDPS Opinion on coherent enforcement of fundamental rights in the age of Big Data, 23 September 2016, available at: https://edps.europa.eu/data-protection/our-work/publications/opinions/big-data_en EDPS blogpost “Carrying the torch in times of darkness”, 30 April 2020 available at: https://edps.europa.eu/press-publications/press-news/blog/carrying-torch-times-darkness_en COM(2020) 842 final p. 4.

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1). We note that Article 1(3) of the Proposal excludes markets related to electronic communications networks and electronic communications services from its scope. A particularity of the e-Privacy Directive, however, is that two of its provisions (

text: Article 5(3)

text: and

text: Article 13

text: ) have a wider scope of application than the other provisions, for which the scope of application is limited to the provision of publicly available electronic communications services in public communications network. As a result, the ePrivacy Directive having regard to aforesaid provisions applies to providers of electronic communication services as well as website operators (e.g. for cookies) or other businesses (e.g. for direct marketing). See European Data Protection Board, “Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR, in particular regarding the competence, tasks and powers of data protection authorities”, adopted on 12 March 2019, in particular at paragraphs 23 and 28.

text: https://edpb.europa.eu/sites/edpb/files/files/file1/201905_edpb_opinion_eprivacydir_gdpr_interplay_en_0.pdf This triggers the applicability of the e-Privacy Directive also in the context of the Proposal.

text: Article 2

text: , definition (20).

text: Article 2

text: , definition (21). Recital (61); Article 13 of the Proposal; see the definition of ‘profiling’ in

text: Article 4(4)

text: GDPR. Recital (55); (61);

text: Articles 5

text: (a); 6(1)(i); 11(2) of the Proposal; see the definition of ‘consent’ in

text: Article 4(11)

text: GDPR.

text: Article 6(1)

text: (h) of the Proposal; see

text: Article 20

text: GDPR for the right to data portability. See also Recital (2) of the Proposal In the “EDPS feedback to the Roadmap for the Evaluation of the Commission Notice on the definition of relevant market for the purposes of Community competition law”, the EDPS observed the following: “As experienced by Supervisory Authorities in charge of data protection including the EDPS, in most cases digital services rely on the processing of personal data relating to the users (extensive processing of personal data, providing insight on users’ preferences and behaviours) as key component -if not the most important one- of their “for free” business model. The

text: Regulation (EU) 2016/679

text: (hence, “the GDPR”), as interpreted and enforced by Supervisory Authorities, is

text: therefore a key interfacing regulation having regard to competition law and policy, and, more specifically, with reference to issues of market power and market definition. Let me point out in this regard, among others, to the principles relating to processing of personal data under Article 5 of the GDPR, to the right to data portability under

text: Article 20

text: (aiming, among others, at addressing the issue of user’s lock-in) of the GDPR, as well as to the provisions

text: of the GDPR relating to “profiling”.

text: With specific reference to the Commission Notice, we would like to highlight, as preliminary observation, that the so-

text: called ‘data power’ (market power stemming from the capability of the undertaking to process vast amount and types

text: of personal data) is relevant under both:

text: (i) demand substitution (for instance, once personal data from different sources are collected by and made available

text: to the same undertaking, for instance a digital platform -either since most of user’s data are on that platform, and/or because most of the persons the user is interested in are on that platform- this makes more difficult for the user to

text: switch to another provider, so-called user’s lock-in);

text: (ii) supply substitution (the integration of data, and of services based on these data) can make more difficult, if not possible, for competitors to supply similar products in the short term).

text: These considerations, linked to the processing of personal data, might feed the assessment by DG Competition of

text: market power and of the possibility to raise the price to consumers (also the non-monetary price, in a freemium

text: model) after the merger. Having regard to this last aspect, we highlight that there is growing consensus in the academia on the need to consider the ‘privacy cost’ or ‘privacy harm’ (the possible degradation of the level of protection of personal data) as degradation of service, and hence as non-monetary price.” See EDPB Guidelines on Targeting of social media users, para 50: “[..] the WP29 has previously considered that it would be difficult for controllers to justify using legitimate interests as a legal basis for intrusive profiling and tracking practices for marketing or advertising purposes, for example those that involve tracking individuals across multiple websites, locations, devices, services or data-brokering.” Guidelines on the right to data portability, Adopted on 13 December 2016, as last Revised and adopted on 5 April 2017, available at: https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=611233 See in particular at page 9, “The following categories can be qualified as “provided by the data subject”: - Data actively and knowingly provided by the data subject (for example, mailing address, user name, age, etc.) - Observed data provided by the data subject by virtue of the use of the service or the device. They may for example include a person’s search history, traffic data and location data. It may also include other raw data such as the heartbeat tracked by a wearable device. In contrast, inferred data and derived data are created by the data controller on the basis of the data “provided by the data subject”. For example, the outcome of an assessment regarding the health of a user or the profile created in the context of risk management and financial regulations (e.g. to assign a credit score or comply with anti-money laundering rules) cannot in themselves be considered as “provided by” the data subject.” Recital (61): “Ensuring an adequate level of transparency of profiling practices employed by gatekeepers facilitates contestability of core platform services, by putting external pressure on gatekeepers to prevent making deep consumer profiling the industry standard [..]”.

text: See also J. Crémer, Y.-A. de Montjoye and H. Schweitzer, “Competition Policy for the digital era”, 2019, p. 58 and following, at: https://ec.europa.eu/competition/publications/reports/kd0419345enn.pdf . See also the EDPS Opinion on the Digital Services Act.

text: The European Commission should ask the European Standardisation Organisations in accordance with

text: Regulation (EU) No 1025/2012

text: of the European Parliament and of the Council of 25 October 2012 on European standardisation, amending Council Directives

text: and

text: and Directives

text: and

text: of the European Parliament and of the Council and repealing

text: Council Decision 87/95/EEC

text: and Decision No

text: of the European Parliament and of the Council. OJ L 316, 14.11.2012, p. 12–33.

text: See at https://www.digitalclearinghouse.org/. The Digital Clearinghouse serves a forum for discussion among data protection, consumer protection, competition authorities which contributed to shifting the analysis of the interaction among the three policy areas from the more academic level to the policy-making and regulatory context. The Digital Clearinghouse was established by the EDPS in 2016 with the Opinion on coherent enforcement of fundamental rights in the age of Big Data, 23 September 2016, more info available at https://edps.europa.eu/data-protection/ourwork/subjects/big-data-digital-clearinghouse_en

identifier: EDPS yttrande 02/2021

title: Digital Markets Act

text: Opinion 2/2021

text: on the Proposal for a Digital Markets Act

text: 10 February 2021 1 | P a g e The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’. Wojciech Wiewiorówski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’ and under article 57(1)(g), the EDPS shall ‘advise on his or her own initiative or on request, all Union institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data’. This Opinion is issued by the EDPS, within the period of eight weeks from the receipt of the request for consultation laid down under

text: Article 42(3) of Regulation (EU) 2018/1725

text: , having regard to the impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data of the Commission Proposal for a Regulation of the European Parliament and of the Council on contestable and fair markets in the digital sector (Digital Markets Act). 2 | P a g e Executive Summary On 15 December 2020, the Commission published a Proposal for a Regulation of the European Parliament and of the Council on contestable and fair markets in the digital sector (Digital Markets Act). The Proposal follows the Communication Shaping Europe’s Digital Future, which indicated that additional rules may be needed to ensure contestability, fairness and innovation and the possibility of market entry, as well as public interests that go beyond competition or economic considerations. The Proposal establishes ex ante rules to ensure that markets characterised by large platforms with significant network effects (“gatekeepers”), remain fair and contestable. In doing so, the Proposal sets out provisions concerning the designation of gatekeepers which takes into account the data driven advantage related among others to the provider’s access to and collection of personal data; obligations and prohibitions to which the gatekeepers are subject; rules for carrying out market investigations; provisions concerning the implementation and enforcement of the Proposal. In this Opinion the EDPS welcomes the Proposal, as it seeks to promote fair and open markets and the fair processing of personal data. Already in 2014, the EDPS pointed out how competition, consumer protection and data protection law are three inextricably linked policy areas in the context of the online platform economy. The EDPS considers that the relationship between these three areas should be a relationship of complementarity, not a relationship where one area replaces or enters into friction with another. The EDPS highlights in this Opinion those provisions of the Proposal which produce the effect of mutually reinforcing contestability of the market and ultimately also control by the person concerned on her or his personal data. This is the case for instance of

text: Article 5

text: (f), prohibiting the mandatory subscription by the end-users to other core platforms services offered by the gatekeeper;

text: Article 6(1)

text: (b), allowing the end-user to un-install pre-installed software applications on the core platform service;

text: Article 6(1)

text: (e), prohibiting the gatekeeper from restricting the ability of end-users to switch between different software applications and services; and

text: Article 13

text: , laying down the obligation for the gatekeeper to submit to the Commission an independently audited description of any techniques for profiling of consumers that the gatekeeper applies to or across its core platform services. At the same time, the EDPS provides specific recommendations to help ensure that the Proposal complements the GDPR effectively, increasing protection for the fundamental rights and freedoms of the persons concerned, and avoiding frictions with current data protection rules. In this regard, the EDPS recommends in particular specifying in

text: Article 5

text: (a) of the Proposal that the gatekeeper shall provide end-users with a solution of easy and prompt accessibility for consent management; clarifying the scope of the data portability envisaged in

text: Article 6(1)

text: (h) of the Proposal; and rewording

text: Article 6(1)

text: (i) of the Proposal to ensure full consistency with the GDPR; and raising the attention on the need for effective anonymisation and re-identification tests when sharing query, click and view data in relation to free and paid search generated by end users on online search engines of the gatekeeper. Moreover, the EDPS invites the co-legislators to consider introducing minimum interoperability requirements for gatekeepers and to promote the development of technical standards at European level, in accordance with the applicable Union legislation on European standardisation. 3 | P a g e Finally, building among others on the experience of the Digital Clearinghouse, the EDPS recommends specifying under

text: Article 32(1)

text: that the Digital Markets Advisory Committee shall include representatives of the EDPB, and calls, more broadly, for an institutionalised and structured cooperation between the relevant competent oversight authorities, including data protection authorities. This cooperation should ensure in particular that all relevant information can be exchanged with the relevant authorities so they can fulfil their complementary role, while acting in accordance with their respective institutional mandates. 4 | P a g e THE EUROPEAN DATA PROTECTION SUPERVISOR, Having regard to the Treaty on the Functioning of the European Union, and in particular

text: Article 16

text: thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles

text: and

text: thereof, Having regard to

text: Regulation (EU) 2016/679

text: (General Data Protection Regulation) , Having regard to Directive

text: of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) , Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data , and in particular

text: Article 42(1)

text: thereof, HAS ADOPTED THE FOLLOWING OPINION: 1. INTRODUCTION AND BACKGROUND 1. On 15 December 2020, the European Commission adopted the Proposal for a Regulation of the European Parliament and of the Council on contestable and fair markets in the digital sector (Digital Markets Act) (hereafter, “the Proposal”) . 2. The Proposal follows the Communication Shaping Europe’s Digital Future, which indicated that additional rules may be needed to ensure contestability, fairness and innovation and the possibility of market entry, as well as public interests that go beyond competition or economic considerations. The Communication also announced that the Commission would explore ex ante rules to ensure that markets characterised by large platforms with significant network effects acting as gatekeepers, remain fair and contestable for innovators, businesses, and new market entrants. 3. According to the Explanatory Memorandum to the Proposal, a few large platforms in the digital sector increasingly act as gateways or “gatekeepers” between business users and end users. Such gatekeepers are said to be entrenched in digital markets, leading to significant dependencies of many business users and negative effects on the contestability of the core platform services concerned. In certain cases, the dependencies lead to unfair behaviour visà-vis these business users . 4. The objective of the Proposal is to address at EU level the most salient incidences of unfair practices and weak contestability in relation to so-called “core platform services”. To this end, the Proposal: 6 | P a g e - establishes the conditions under which providers of core platform services should be designated as “gatekeepers” (Chapter II); - sets out the practices of gatekeepers that limit contestability and that are unfair, laying down obligations that the designated gatekeepers should comply with, some of which are susceptible to further specification (Chapter III); - provides rules for carrying out market investigations (Chapter IV); and - contains provisions concerning the implementation and enforcement of this Regulation (Chapter V). 5. The EDPS was consulted informally on the draft Proposal for a Digital Markets Act on 8 December 2020. The EDPS welcomes the fact that he has been consulted at this early stage of the procedure. 6. In addition to the Proposal, the Commission has also adopted a Proposal for a Regulation of the European Parliament and of the Council on Single Market for Digital Services (Digital Services Act) and amending Directive

text: . In accordance with Article 42(1) of Regulation 2018/1725, the EDPS has also been consulted on the Proposal for a Digital Services Act, which is the subject matter of a separate Opinion. 2. GENERAL COMMENTS 7. The EDPS recalls that the digital future of Europe is at the heart of the EDPS Strategy for 2020-2024, which aims to shape a safer, fairer and more sustainable digital Europe, particularly for the most vulnerable in our societies . 8. The EDPS supports the Commission’s intention to ensure fairness and contestability of markets in the digital sector, in particular as regards core platform services. The EDPS also welcomes the recognition that additional rules may be necessary to ensure public interests that go beyond competition or economic considerations, in addition to the need to ensure innovation and market entry . 9. The EDPS especially welcomes the explicit recognition that “[t]he data protection and privacy interests of end users are relevant to any assessment of potential negative effects of the observed practice of gatekeepers to collect and accumulate large amounts of data from end users” . 10. The EDPS is also aware that the need for a ‘digital update’ of competition law has been the object of in-depth debates not only in the EU, but also globally, including in the United 11 12 Kingdom and in the United States .

text: 11. Given the business model of certain platforms (further identified as “gatekeepers”), the Proposal necessarily includes rules (ex ante regulation) that at the same time seek to promote fair and open markets and the fair processing of personal data.

text: 12. Already in 2014, the EDPS pointed out how competition, consumer protection and data protection law are three inextricably linked policy areas in the context of the online platform economy . The EDPS considers that the relationship between these three areas should be a relationship of complementarity, convergence and coherent application, not a relationship where one area replaces or enters into friction with another. 7 | P a g e

text: 13. Services in the digital ecosystem rely on covert tracking of individuals, who are generally unaware of the nature and extent of that tracking . This predominant business model is often paired with trends in the digital economy sitting at the crossroad of those different fields of laws. Those include: information and power asymmetry between large platforms and individuals; insufficient transparency and accountability; growing inequality in the distribution of value; manipulative and addictive patterns; platforms as gatekeepers for solutions, choice, and innovation, online manipulation and disinformation .

text: 14. The EDPS therefore welcomes the statement that the Proposal aims to complement data protection laws, in particular by supplementing the existing level of protection and helping to inform enforcement under the General Data Protection Regulation (‘GDPR’). Given the complementarity of aims pursued, the EDPS fully supports the objectives of the Proposal.

text: 15. The remainder of this Opinion contains specific recommendation to help ensure that the Proposal complements the GDPR effectively and increases protection for the fundamental rights and freedoms of the persons concerned and avoids frictions with current data protection rules. 3. SPECIFIC RECOMMENDATIONS 3.1. Subject matter and scope

text: 16. Recital (11) of the Proposal confirms that the Regulation should “complement” and is “without prejudice” to the application of

text: Regulation (EU) 2016/679

text: . For the sake of clarity, the EDPS recommends further specifying that the Proposal complements both Regulation 2016/679 and Directive

text: . It should also be specified in the recital that the Proposal does not particularise or replace any of the obligations of core platform services under Regulation 2016/679 and Directive

text: 17. The EDPS recommends supplementing Article 1 of the Proposal to reflect the wording of Recital (11), by explicitly stating that the Proposal complements and is without prejudice to Regulation 2016/679 and Directive

text: . 3.2. Definitions

text: 18. The EDPS notes that Article 2 of the Proposal correctly refers to several definitions provided 19 20 by the GDPR (“personal data” ; “non-personal data” ), rather than introducing other definitions that might generate ambiguities or difficulty of interpretation.

text: 19. The EDPS notes however that the Proposal contains requirements referring to concepts which are already defined and employed by Regulation 2016/679 and/or Directive 2002/58, such as 21 22 23 “profiling” , “consent” , and “data portability” . As a result, further clarification is necessary to avoid confusion (beyond stating that this Regulation is “without prejudice” to the GDPR).

text: 20. In particular, the EDPS submits that for the sake of clarity, the term “profiling” referred to Article 13 of the Proposal should have the same meaning as ‘profiling’ defined in Article 4(4) of the GDPR, and suggests adding in Article 2 of the Proposal (‘Definitions’) a specific 8 | P a g e reference to the definition of “profiling” as defined in Article 4(4) of the GDPR insofar as the profiling of end users or consumers is concerned. As regards the reference to “consent” in

text: Articles 5

text: (a); 6(1)(i); and 11(2), the Proposal makes clear that this refers to consent “in line with Regulation 2016/679”. The EDPS suggests adding in Article 2 of the Proposal (‘Definitions’) a specific reference to the definition of “consent” as defined in Article 4(11) of the GDPR insofar as the consent of end users is concerned. The EDPS also suggests introducing further clarifications in relation to “data portability” referred to in

text: Article 6(1)

text: (h) of the Proposal, which are explained later on in this Opinion (see below para. 29). 3.3. Designation of gatekeepers

text: 21. Among the elements relevant for the designation of “gatekeepers”, the EDPS welcomes the reference to the “data driven advantages, in particular in relation to the provider’s access to and collection of personal and non-personal data or analytics capabilities” (

text: Article 24

text: 25 3(6)(c) ); as well as to “user’s lock-in” (

text: Article 3(6)

text: (e)) . Indeed, the EDPS considers that online platforms who, as a key component of their business model, engage in profiling of individuals, can derive considerable competitive advantages because of their unique abilities to collect vast amounts and types of personal data. User lock-in in turn may also enable gatekeepers to raise the prices for consumers, including non-monetary prices, which may lead to possible degradation of the level of protection of personal data for end users. 3.4. Practices of gatekeepers that limit contestability and are unfair

text: 22. In light of the entry barriers that result from the data driven advantage, but also (indirectly) from user’s lock-in,

text: Article 5

text: (a) of the Proposal provides that the gatekeeper shall: “refrain from combining personal data sources from these core platform services with personal data from any other services offered by the gatekeeper or with personal data from third-party services, and from signing in end users to other services of the gatekeeper in order to combine personal data, unless the end user has been presented with the specific choice and provided consent in the sense of

text: Regulation (EU) 2016/679

text: .” Recital (36) clarifies that “The conduct of combining end user data from different sources or signing in users to different services of gatekeepers gives them potential advantages in terms of accumulation of data, thereby raising barriers to entry. To ensure that gatekeepers do not unfairly undermine the contestability of core platform services, they should enable their end users to freely choose to opt-in to such business practices by offering a less personalised alternative. The possibility should cover all possible sources of personal data, including own services of the gatekeeper as well as third party websites, and should be proactively presented to the end user in an explicit, clear and straightforward manner.”

text: 23. The EDPS welcomes this provision, as it both helps to address competition concerns and further strengthens the protection of the fundamental rights to privacy and to the protection of personal data in relation to gatekeepers.

text: 24. For the sake of clarity, however, the EDPS recalls that online platforms who are not designated as “gatekeepers” may still need to obtain the consent of the persons concerned before combining data across their services or with data from third-party services pursuant to the GDPR and/or the ePrivacy Directive.

text: Article 5

text: (a) should therefore not be understood as 9 | P a g e suggesting that platforms that are not designated as gatekeepers may freely combine personal data across services without the individual’s consent. The EDPS recommends adding wording in a recital to that effect.

text: 25. The EDPS recommends specifying that the gatekeeper shall provide end-users with a userfriendly solution (of easy and prompt accessibility) for consent management in line with Regulation 2016/679, and, in particular, the requirement of data protection by design and data protection by default laid down in Article 25 of Regulation 2016/679. For example, the Proposal could specify that the functionalities for giving information and offering the opportunity to grant, modify or revoke consent should be as user-friendly as possible.

text: 26. The EDPS also welcomes

text: Article 5

text: (f) of the Proposal, laying down a prohibition for the gatekeeper to require the business user or the end users to subscribe or register with any other core platform services offered by the gatekeeper. This provision may mitigate competition concerns (on compulsory ‘bundling of services’), as well as reduce excessive collection and combination of personal data. The EDPS considers that while

text: Article 5

text: (f) of the Proposal indirectly enhances the safeguards to data protection and privacy, it does so without encroaching upon the GDPR, given that the requirement is also justified by the peculiar position of the gatekeeper and by the functioning of the platform economy.

text: 27. The EDPS observes that rationale of

text: Article 5

text: (f) would also apply to

text: Article 5

text: (e), which establishes the prohibition for the gatekeeper to require the business user (but not the end user) to use, offer or interoperate with an identification service of the gatekeeper in the context of services offered by the business users using the core platform services of that gatekeeper. Therefore, the EDPS recommends inserting the wording “or end users” after “business users” in

text: Article 5

text: (e).

text: 28. The EDPS observes that the following provisions similarly demonstrate that competition law and data protection law can usefully complement and enhance each other: -

text: Article 6(1)

text: (a), providing that the gatekeeper shall “refrain from using, in competition with business users, any data not publicly available, which is generated through activities by those business users, including by the end-users of these business users, of its core platform services or provided by those business users of its core platform services or by the end-users of these business users”; -

text: Article 6(1)

text: (b), providing that the gatekeeper shall “allow end-users to un-install any preinstalled software application on its core platform service (..)”; ability of end-users to switch between and subscribe to different software applications and services to be accessed using the operating system of the gatekeeper, including as regards the choice of the internet service provider for end-users”. of data generated through the activity of a business user or end-user and shall, in particular, provide tools for end users to facilitate the exercise of data portability, in line with Regulation EU 2016/679, including by the provision of continuous and real-time access”. 10 | P a g e The EDPS recalls that under

text: Article 20

text: GDPR, the right to data portability includes the right of the data subject to receive the personal data concerning him or her, which he or she has provided to a controller, and the right to transmit those data to another controller. As clarified by the

text: Article 29

text: Working Party and later confirmed by the EDPB , the scope of the personal data which can be ‘ported’ encompass the personal data provided knowingly and actively by the data subject, as well as the personal data generated by his or her activity (provided the legal basis of the processing is consent or contract, which is likely to be the case here). Therefore, the EDPS also welcomes the reference to “data generated through the activity of a [...] end user” in

text: Article 6(1)

text: (h) of the Proposal. The EDPS however considers that

text: Article 6(1)

text: (h) should be worded more precisely as to who would be entitled to port personal data and which data, if personal or non-personal, would form the object of the portability. The EDPS recommends specifying that, insofar as it concerns the data portability to end-users, a gatekeeper shall provide the end-user with tools to facilitate effective portability of the personal data relating to her or him, including personal data generated through her or his activity as end-user of platform services in accordance with Article 20 of Regulation 2016/679, including by the provision of continuous and real-time access.

text: Article 6(1)

text: (i) of the Proposal requires gatekeepers to “provide business users, or third parties authorised by a business user, free of charge, with effective, high-quality, continuous and real-time access and use of aggregated or non-aggregated data, that is provided for or generated in the context of the use of the relevant core platform services by those business users and the end users engaging with the products or services provided by those business users; for personal data, provide access and use only where directly connected with the use effectuated by the end user in respect of the products or services offered by the relevant business user through the relevant core platform service, and when the end user opts in to such sharing with a consent in the sense of the

text: Regulation (EU) 2016/679

text: 31. The EDPS considers that the current wording of

text: Article 6(1)

text: (i) may cause confusion that could lead to inconsistency with the GDPR. As currently drafted, the Proposal might be understood in the sense that “aggregated or non-aggregated data” (referred to in the first sentence before “;”, and as opposed to the second sentence starting with “for personal data”) do not include personal data, whereas aggregated or non-aggregated data might include personal data. In addition, the reference to “in the sense of the

text: Regulation (EU) 2016/679

text: ” could be better specified. The EDPS therefore recommends specifying that a gatekeeper shall provide business users, or third parties authorised by a business user, free of charge, with effective, high-quality, continuous and real-time access and use of non-personal data, that is provided for or generated in the context of the use of the relevant core platform services by those business users and the end-users engaging with the products or services provided by those business users; and that a gatekeeper shall provide, in full compliance with the GDPR, business users the possibility to obtain the consent of the data subject, allowing to the business users the access to and use of the personal data where directly connected with the use effectuated by the end user in respect of the products or services offered by the relevant business user through the relevant core platform service. The EDPS also recommends specifying that the 11 | P a g e functionalities for giving information and offering of the opportunity to grant consent should be as user-friendly as possible.

text: Article 6(1)

text: (j) of the Proposal requires gatekeepers to “provide to any third party providers of online search engines, upon their request, with access on fair, reasonable and non- discriminatory terms to ranking, query, click and view data in relation to free and paid search generated by end users on online search engines of the gatekeeper, subject to anonymisation for the query, click and view data that constitutes personal data;” In this regard, the EDPS notes that the query, click and view data in relation to searches generated by individuals constitute personal data. Moreover, these data are likely to be of a highly sensitive nature because they can contribute to build up a profile of individual’s preferences, status (including health status), interests and convictions (including religious and political beliefs). The EDPS also considers that in practice often due attention is not paid by the controller to the effective anonymisation of personal data and that, as a consequence, sharing this information leads to a high risk of re-identification. Indeed, given the high level of insight offered into the private life of data subjects by query, click and view data, the EDPS considers that the impact of a re-identification would in general be very high. In the light of the above, the EDPS recommends specifying in a recital that the gatekeeper shall be able to demonstrate that anonymised query, click and view data have been adequately tested against possible re-identification risks.

text: 33. The EDPS welcomes the specification under Article 7(1) of the Proposal that “The measures implemented by the gatekeeper to ensure compliance with the obligations laid down in Articles

text: and

text: shall be effective in achieving the objective of the relevant obligation. The gatekeeper shall ensure that these measures are implemented in compliance with

text: Regulation (EU) 2016/679

text: and Directive

text: , and with legislation on cyber security, consumer protection and product safety.”

text: 34. On Article 10 of the Proposal, Updating obligations for gatekeepers, the EDPS recommends adding in

text: Article 10(2)

text: (a) a reference to end-users, in addition to business users, when referring to the imbalance of rights and obligations with the gatekeeper and to the advantage that would be obtained by the gatekeeper. This addition would be in line with and further support the overall objectives of the Proposal, aiming at enhancing contestability and fairness of core platform services having regard also to the imbalance between the gatekeeper and the end-user.

text: 35. Article 11(2) of the Proposal stipulates that “[w]here consent for collecting and processing of personal data is required to ensure compliance with this Regulation, a gatekeeper shall take the necessary steps to either enable business users to directly obtain the required consent to their processing, where required under

text: Regulation (EU) 2016/679

text: and Directive

text: , or to comply with Union data protection and privacy rules and principles in other ways including by providing business users with duly anonymised data where appropriate. The gatekeeper shall not make the obtaining of this consent by the business user more burdensome than for its own services.” In this regard, the EDPS recommends replacing “or” [to comply with..] with “and” for the sake of precision. 12 | P a g e

text: Article 13

text: , Obligation of an audit, provides another clear example of the strong complementarity between competition law and data protection law.

text: Article 13

text: states that a gatekeeper “shall submit to the Commission an independently audited description of any techniques for profiling of consumers that the gatekeeper applies to or across its core platform services identified pursuant to

text: Article 3

text: . This description shall be updated at least annually.” In this regard, the EDPS considers that this obligation can be beneficial to reduce the ‘data driven advantage’ of the gatekeeper and at the same time reduce the information asymmetry between the gatekeeper and public oversight authorities (as well as ultimately between gatekeepers and data subjects) on the processing of personal data. Moreover, this audit can contribute to the identification of consumer profiling which is not proportionate, or otherwise not compliant with the GDPR and the fundamental rights to privacy and to the protection of personal data as established under Articles 7 and 8 of the Charter of Fundamental Rights of the European Union . In the light of the above, the EDPS recommends that the Proposal specifies that the audited description, as well as any relevant materials that is collected in the context of supervising the gatekeepers that relate to the processing of personal data, shall be shared by the Commission with any competent supervisory authority represented in the European Data Protection Board, upon its request. 3.5. Platform interoperability 3.6. Digital Markets Advisory Committee

text: 39. On the Digital Markets Advisory Committee, established under Article 32 of the Proposal, the EDPS recommends expressly referring to the authorities of which the Advisory Committee will be composed. Considering the impact of the Proposal on different areas of EU law, and notably, due to interactions with the protection of personal data, the EDPS recommends specifying under

text: Article 32(1)

text: that the Digital Markets Advisory Committee 13 | P a g e shall consist of representatives of the European Data Protection Board established in accordance with

text: Article 68

text: GDPR, as well as of representatives of the competent authorities of the Member States for competition, electronic communications, audio-visual services, electoral oversight, and consumer protection.

text: 40. Building on the experience with the Digital Clearinghouse , the EDPS strongly recommends an institutionalised and structured cooperation between the competent oversight authorities and, notably, the data protection authorities. In this regard, the EDPS considers that the Commission should consult with relevant competent authorities, including data protection authorities, in the context of their investigations and assessments (for instance, on the designation of a gatekeeper); therefore, the EDPS submits that the Proposal should specifically mention this power for the Commission, for the sake of legal certainty.

text: 41. Chapter V of the Proposal should also lay down a clear legal basis to enable the exchange of any relevant information among the relevant authorities (e.g., any relevant material that is collected in the context of supervising the gatekeepers that concerns aspects related to the processing of personal data). This would also entail a modification of Article 31 of the Proposal, which explicitly limits the use of the information collected pursuant to Articles

text: and

text: to the purposes of the DMA only. Doing so would further support the underlying objectives of the Proposal by enabling each competent authority to fulfil their complementary roles, while also acting in accordance with their respective mandate and public service mission. 4. CONCLUSIONS In light of the above, the EDPS makes the following recommendations:  to specify that the Proposal complements both Regulation 2016/679 and Directive

text: , and that the Proposal does not particularise or replace any of the obligations of core platform services under Regulation 2016/679 and Directive

text: ;  to specify in

text: Article 5

text: (a) of the Proposal that the gatekeeper shall provide end-users with a user-friendly solution (of easy and prompt accessibility) for consent management in line with Regulation 2016/679, and, in particular, the requirement of privacy by design and privacy by default laid down in Article 25 of Regulation 2016/679;  to add a reference to end-users under

text: Article 5

text: (f) of the Proposal;  to reword

text: Article 6(1)

text: (i) of the Proposal to ensure consistency with the GDPR, taking into account in particular the definition of “personal data” under Article 4(1) of the GDPR;  to strengthen the reference in

text: Article 6(1)

text: (j) of the Proposal specifying in a recital that the gatekeeper shall be able to demonstrate that the anonymised query, click and view data have been adequately tested against possible reidentification risks; 14 | P a g e  to specify that the audited description shall be shared by the Commission with the EDPB or at least the competent supervisory authorities under the GDPR at their request;  to specify under

text: Article 32(1)

text: that the Digital Markets Advisory Committee shall consist of representatives of the European Data Protection Board, as well as of representatives of the competent authorities of the Member States for competition, electronic communications, audio-visual services, electoral oversight, and consumer protection;  to consider introducing minimum interoperability requirements for gatekeepers and to promote the development of technical standards at the European level, in accordance with the applicable Union legislation on European standardisation;  to establish an institutionalised and structured cooperation between the relevant competent oversight authorities, including data protection authorities. This cooperation should ensure in particular that all relevant information can be exchanged with the relevant authorities so they can fulfil their complementary role, while acting in accordance with their respective institutional mandate. Brussels, 10 February 2021 Wojciech WIEWIÓROWSKI (e-signed) 15 | P a g e NOTES 16 | P a g e 17 | P a g e 18 | P a g e


text: OJ L 295, 21.11.2018, p. 39. 2

text: Council Directive 2000/43/EC of 29 June 2000

text: implementing the principle of equal treatment between persons irrespective of racial or ethnic origin (OJ L 180, 19.7.2000, p. 22). 3

text: Council Directive 2004/113/EC of 13 December 2004

text: implementing the principle of equal treatment between men and women in the access to and supply of goods and services (OJ L 373, 21.12.2004, p. 37). 4 COM(2022)689 final. Directive

text: of the European Parliament and of the Council of 5 July 2006 on the implementation of the principle of equal opportunities and equal treatment of men and women in matters of employment and occupation (recast) (OJ L 204, 26.7.2006, p. 23). 6 Directive

text: of the European Parliament and of the Council of 7 July 2010 on the application of the principle of equal treatment between men and women engaged in an activity in a self-employed capacity and repealing

text: Council Directive 86/613/EEC

text: (OJ L 180, 15.7.2010, p. 1). 7 COM(2022)688 final. 8

text: Article 1(1)

text: and recitals 3 to 7 of the Equal Treatment Proposal. 9

text: Council Directive 79/7/EEC of 19 December 1978

text: on the progressive implementation of the principle of equal treatment for men and women in matters of social security (OJ L 6, 10.1.1979, p. 24). 10

text: Council Directive 2000/78/EC of 27 November 2000

text: establishing a general framework for equal treatment in employment and occupation (OJ L 303, 2.12.2000, p. 16). 4

text: COM(2020)152 https://ec.europa.eu/info/policies/justice-and-fundamental-rights/gender-equality/gender-equality-strategy_en. 12 COM(2020)565https://ec.europa.eu/info/policies/justice-and-fundamental-rights/combatting-discrimination/racism-andxenophobia/eu-anti-racism-action-plan-2020-2025_en. 13 https://ec.europa.eu/info/publications/new-eu-roma-strategic-framework-equality-inclusion-and-participation-full-package_en. 14 COM(2020)698https://ec.europa.eu/info/policies/justice-and-fundamental-rights/combatting-discrimination/lesbian-gay-bitrans-and-intersex-equality/lgbtiq-equality-strategy-2020-2025_en. 15 COM(2021)101 https://ec.europa.eu/social/main.jsp?catId=1484. 16 COM(2021) 615 https://ec.europa.eu/commission/presscorner/detail/en/ip_21_4990. See Explanatory memorandum, page 4. 17 Article (1)(1) of the Proposal. 18 Directive

text: of the European Parliament and of the Council of 25 October 2012 establishing minimum standards on the rights, support and protection of victims of crime, and replacing Council Framework Decision 2001/220/JHA (OJ L 315, 14.11.2012, p. 57). 19

text: Council Directive 2003/8/EC of 27 January 2003

text: to improve access to justice in cross-border disputes by establishing minimum common rules relating to legal aid for such disputes (OJ L 26, 31.1.2003, p. 41). 20

text: Commission Recommendation (EU) 2022/758 of 27 April 2022

text: on protecting journalists and human rights defenders who engage in public participation from manifestly unfounded or abusive court proceedings (‘Strategic lawsuits against public participation’). 21 Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, 2022 Rule of Law Report (COM(2022) 500 final) https://ec.europa.eu/info/policies/justice-andfundamental-rights/upholding-rule-law/rule-law/rule-law-mechanism/2022-rule-law-report_en 22 Explanatory memorandum, page 6. 5

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1). 24 For example, when receiving and handling complaints of discrimination (see Article 6(2) of the Proposals).

text: Judgment of the Court of Justice of 1 August 2022, OT a.o., C 184/20, ECLI:EU:C:2022:601, paragraph 67. 26 Judgment of the Court of Justice of 1 August 2022, OT a.o., C 184/20, ECLI:EU:C:2022:601, paragraph 126.

text: See also European Data Protection Board, Guidelines 3/2019 on processing of personal data through video devices, Version 2.0, 29 January 2020, paragraph 68. 6

identifier: EDPS yttrande 02/2023

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion on the Proposal for a Council Regulation on jurisdiction, applicable law, recognition of decisions and acceptance of authentic instruments in matters of parenthood and on the creation of a European Certificate of Parenthood

serie: yttranden

text: 2 February 2023

type: rubrik

text: Opinion 2/2023

text: on the Proposals for Directives on standards for equality bodies in the field of equal treatment

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Council Directive on standards for equality bodies in the field of equal treatment between persons irrespective of their racial or ethnic origin, equal treatment in the field of employment and occupation between persons irrespective of their religion or belief, disability, age or sexual orientation, equal treatment between women and men in matters of social security and in the access to and supply of goods and services, and deleting

text: Article 13 of Directive 2000/43/EC

text: and

text: Article 12 of Directive 2004/113/EC

text: (COM(2022)689 final) and the Proposal for a Directive of the European Parliament and of yhe Council on standards for equality bodies in the field of equal treatment and equal opportunities between women and men in matters of employment and occupation (COM(2022)688 final). This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposals that are relevant from a data protection perspective.

text: Executive Summary

text: Article 13 of Directive 2000/43/EC

text: and

text: Article 12 of Directive 2004/113/EC

text: and a Proposal for a Directive of the European Parliament and of the Council on standards for equality bodies in the field of equal treatment and equal opportunities between women and men in matters of employment and occupation, and deleting

text: Article 20 of Directive 2006/54/EC

text: and

text: Article 11 of Directive 2010/41/EU

text: The objective of the proposals is to lay down minimum requirements for the functioning of equality bodies to improve their effectiveness and guarantee their independence in order to strengthen the application of the principle of equal treatment.

text: The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 8 December 2022, pursuant to Article 42(1) of EUDPR.

text: The EDPS welcomes such objectives. He notes that the reports, which the equality bodies would provide under

text: Article 15

text: , should not contain personal data and that the cooperation set out under

text: Article 12

text: , as well as the monitoring under

text: Article 16

text: should not involve the processing of personal data.

text: He focuses therefore his recommendations on

text: Article 18

text: concerning the processing of personal data. In particular, he recommends enhancing legal certainty for the equality bodies by considering Article 18 of the Proposals as the legal basis for the data processing and to make an explicit link to

text: Article 9

text: GDPR with regard to special categories of personal data. He recommends clarifying the scope of Article 18(1) of the Proposals to cover not only the collection but also the subsequent processing of personal data by equality bodies, as necessary, exhaustively listing all special categories of personal data within the meaning of the GDPR that may be processed on the basis of the Proposals as well as clarifying the suitable and specific measures to safeguard the fundamental rights and the interests of the data subject required in

text: Article 9(2)

text: (g) GDPR.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 7 December 2022, the European Commission issued a Proposal for a Council Directive on standards for equality bodies in the field of equal treatment between persons irrespective of their racial or ethnic origin, equal treatment in the field of employment and occupation between persons irrespective of their religion or belief, disability, age or sexual orientation, equal treatment between women and men in matters of social security and in the access to and supply of goods and services, and deleting Article 13 of Directive 2 3 4

text: and

text: Article 12 of Directive 2004/113/EC

text: (‘the Equal Treatment Proposal’) and a Proposal for a Directive of the European Parliament and of the Council on standards for equality bodies in the field of equal treatment and equal opportunities between women and men in matters of employment and occupation and deleting Article 20 of Directive 5 6 7

text: and

text: Article 11 of Directive 2010/41/EU

text: (‘the Equal Opportunities Proposal’) .

text: 2. The objective of the Equal Treatment Proposal is to lay down minimum requirements for the functioning of equality bodies to improve their effectiveness and guarantee their independence in order to strengthen the application of the principle of equal treatment as derived from Council Directives

text: (which prohibits discrimination based on sex, in matters of social security),

text: (which prohibits discrimination based on racial or ethnic origin),

text: (which prohibits discrimination on the grounds of religion or belief, disability, age or sexual orientation as regards employment, occupation and vocational training) and

text: (which prohibits discrimination based on sex in access to and supply of goods and services).

text: 3. The Equal Treatment Proposal is part of several strategies and action plans adopted to 11 12 achieve a Union of Equality: the gender equality strategy , the anti-racism action plan , the Roma strategic framework for equality, inclusion and participation , the LGBTIQ 14 15 equality strategy , and the strategy for the rights of persons with disabilities . It was also referred to in the strategy on combating antisemitism and fostering Jewish life .

text: 4. The objective of the Equal Opportunities Proposal is to lay down minimum requirements for the functioning of equality bodies to improve their effectiveness and guarantee their independence in order to strengthen the application of the principle of equal treatment as derived from Directives

text: and

text: . This Proposal is complementary to EU 18 19 legislation adopted in the field of victims’ rights , access to justice and to combat strategic lawsuits against public participation . The 2022 Rule of Law Report highlights that equality bodies need structural guarantees of independence and sufficient resources to work 2122 effectively, and several of these bodies in the Member States continue to face challenges .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 8 December 2022, pursuant to

text: Article 42(1)

text: EUDPR. The EDPS welcomes the reference to this consultation in recital 50 of the Equal Treatment Proposal and recital 49 of the Equal Opportunities Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 EUDPR on the Equal Treatment draft Proposal.

text: 2. General remarks

text: 6. The EDPS welcomes recital 48 of the Equal Treatment Proposal and recital 47 of the Equal Opportunities Proposal recalling that the processing of personal data by equality bodies is to be carried out in full compliance of the

text: Regulation (EU) 2016/679

text: (‘GDPR’).

text: 7. It is clear from the text of the Proposals that, in order to fulfil their tasks, equality bodies would inevitably need to process personal data, including special categories of personal data .

text: 8. Article 6(1) of the GDPR sets out an exhaustive and restrictive list of the cases in which processing of personal data can be regarded as lawful. To be lawful, processing must fall within one of the cases provided for in those provisions . In addition, Article 9(1) of the GDPR provides for the prohibition, inter alia, of processing of personal data revealing racial or ethnic origin, religious or philosophical beliefs and the processing of data concerning a natural person’s sex life or sexual orientation.

text: 9. The purpose of

text: Article 9(1)

text: GDPR is to ensure enhanced protection as regards processing which, because of the particular sensitivity of the data processed, is liable to constitute a particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data, guaranteed by Articles 7 and 8 of the Charter .

text: 10. The EDPS recalls that, with regard to the processing of special categories of personal data, the controller must be able to identify both a legal basis under

text: Article 6

text: GDPR and an exception for processing special categories of data under

text: Article 9

text: (i.e. an exemption from the general rule that one should not process special categories of data), where applicable . In other words: both provisions should be applied cumulatively.

text: 11. The EDPS understands, in particular from recitals 48 and 49 of the Equal Treatment Proposal and recitals 47 and 48 of the Equal Opportunities Proposal, that the Commission’s plan is to leave the choice of the legal basis for the processing of personal data by equality bodies to the national transposition of the future Directives. However, the EDPS would nonetheless like to offer an alternative path and include the relevant elements in the Proposals directly, in order to enhance legal certainty (in this regard, see the recommendations in the next section below).

text: 3. On the processing of special categories of personal data and access to personal data

text: 12. The EDPS welcomes Article 18 of the Proposals according to which equality bodies may collect personal data only where necessary for the fulfilment of a task under the Proposals. However, given the processing of special categories of personal data and against the background of the considerations set out above, the EDPS invites the legislator to consider Article 18 of the Proposals as the legal basis under Union law for the processing of special categories of personal data, and to make an explicit link to

text: Article 9

text: GDPR.

text: 13. More specifically, the EDPS therefore recommends clarifying the scope of Article 18(1) of the Proposals, which currently covers only the “collection” of personal data, to include also subsequent processing of personal data as may be necessary, in line with recital 47 of the Equal Opportunities Proposal and recital 48 of the Equal Treatment Proposal.

text: 14. Secondly, the EDPS notes that the list of special categories of personal data contained in Article 18(2) of the Proposals (data on racial or ethnic origin, religion or belief, disability or sexual orientation) does not include all the categories of sensitive data listed in

text: Article 9(1)

text: GDPR. Consequently, he invites the legislator to consider whether equality bodies process additional categories of sensitive data linked to protected characteristics, such as data concerning health, political opinions, trade union memberships, biometric or genetic data or sex life. The EDPS recommends exhaustively listing all special categories of personal data within the meaning of the GDPR that may be processed on the basis of the Proposals as well as clarifying the suitable and specific measures to safeguard the fundamental rights and the interests of the data subject required in

text: Article 9(2)

text: (g) GDPR.

text: 15. As a minimum, the EDPS recommends redrafting Article 18(2) of the Proposals to clearly require that Member States ensure that their national law transposing the future Directives fulfil the conditions of

text: Article 9(2)

text: (g) GDPR. In particular, national transposition law must exhaustively list the special categories of personal data that may be processed, and provide suitable and specific measures as required in that provision.

text: 4. Other comments

text: 16. The EDPS welcomes

text: Article 6(3)

text: subparagraph 2 of the Proposals specifying the obligation for equality bodies to inform victims of discrimination on the processing of personal data. In addition, he positively notes that Article 14 of the Proposals on data collection and access to equality data clarifies that the disaggregated data would be anonymised or, where not possible, pseudonymised. The EDPS underscores that pseudonymisation should indeed not be seen as a synonym of anonymisation and that, as a result, pseudonymised data would still constitute personal data in the meaning of EU data protection law.

text: 17. The EDPS notes that Article 12 of the Proposals would set out an obligation on Member States to ensure that equality bodies have appropriate mechanisms in place to cooperate not only with other equality bodies in the same Member State but also with relevant public or private entities in other member states or at Union or international level. In this regard, the EDPS welcomes recital 39 of the Equal Treatment Proposal and recital 38 of the Equal 7 Opportunities Proposal clarifying that such cooperation should not imply the processing of personal data.

text: 18. Lastly, the EDPS welcomes recitals 42 and 44 of the Equal Treatment Proposal and recitals 41 and 43 of the Equal Opportunities Proposals clarifying that the reports which the equality bodies must provide under Article 15 of the Proposals should not contain any personal data and that the monitoring of the application of the future Directives under Article 16 of the Proposals should not entail the processing of personal data.

text: 5. Conclusions

text: 19. In light of the above, the EDPS makes the following recommendations: (1) to enhance legal certainty for the equality bodies by considering Article 18 of the Proposals as the legal basis for the data processing and to make an explicit link to

text: Article 9

text: GDPR with regard to the processing of special categories of personal data; (2) to clarify the scope of Article 18(1) of the Proposals to cover not only the collection but also the subsequent processing of personal data by equality bodies, as necessary; (3) to exhaustively list all special categories of personal data within the meaning of the GDPR that may be processed on the basis of the Proposals as well as clarify the suitable and specific measures to safeguard the fundamental rights and the interests of the data subject required in

text: Article 9(2)

text: (g) GDPR. Brussels, 2 February 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8

type: vagledning

utgivare: edps


text: COM(2023) 208 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 208 final. 4

text: Regulation (EU) 2019/881

text: of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing

text: Regulation (EU) No 526/2013

text: (Cybersecurity Act); OJ L 151, 7.6.2019, p. 15. COM(2023) 208 final, p. 1. 6 COM(2023) 208 final, p. 1. 4

text: EDPS Opinion 7/2022 on the Proposal for a Regulation on information security in the institutions, bodies, offices and agencies of the Union, issued on 17 May 2022, paragraphs 9 and 10.

identifier: EDPS yttrande 02/2024

title: EDPS Opinion 2/2024 on the Proposal for a Regulation amending the Cybersecurity Act as regards managed security services

text: 10 January 2024

text: Opinion 2/2024

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council amending

text: Regulation (EU) 2019/881

text: as regards managed security services . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: Regulation (EU) 2019/881

text: as regards managed security services (‘the Proposal’).

text: The objective of the Proposal is to enable the adoption of European cybersecurity certification schemes for ‘managed security services’, in addition to information and technology (ICT) products, ICT services and ICT processes, which are already covered under

text: Regulation (EU) 2019/881

text: . The EDPS has been consulted by the European Commission on 14 November 2023 pursuant to Article 42(1) of EUDPR.

text: In the present Opinion, the EDPS welcomes the objectives of the Proposal and considers that cybersecurity certification schemes for managed security services could indeed incentivize offering such services and at the same time make the choice of a qualified service provider easier for small and medium enterprises that do not have internal security specialists and are dependent on external service providers. The EDPS proposes a number of changes to elements of the new

text: Article 51

text: a and recommends to establish within the Proposal a requirement for providers to self-declare that their services and measures proposed through them comply with the applicable regulatory framework, including data protection, as a condition for certification.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 18 April 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council amending

text: Regulation (EU) 2019/881

text: 2. The objective of the Proposal is to enable, by means of Commission implementing acts, the adoption of European cybersecurity certification schemes for ‘managed security services’, in addition to information and technology (ICT) products, ICT services and ICT processes, which are already covered under the Cybersecurity Act . According to the explanatory memorandum , managed security services play an increasingly important role in the prevention and mitigation of cybersecurity incidents. The certification of managed security services is seen as an effective means of building trust in the quality of those services and thereby facilitating the emergence of a trusted European cybersecurity service industry. Some Member States have already begun adopting certification schemes for managed security services. There is therefore a growing risk of fragmentation of the internal market for managed security services owing to inconsistencies in cybersecurity certification schemes across the Union. This Proposal enables the creation of European cybersecurity certification schemes for those services to prevent such fragmentation .

text: 3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 14 November 2023 pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in the last (not numbered) Recital of the Proposal.

text: 2. General remarks

text: 4. The EDPS welcomes the objectives of the Proposal and considers that cybersecurity certification schemes for managed security services could indeed incentivize offering such services and at the same time make the choice of a qualified service provider easier for small and medium enterprises that do not have internal security specialists and are dependent on external service providers.

text: 5. The EDPS recalls the recommendations provided in the EDPS Opinion 7/2022 , on the relationship between cybersecurity and data protection, which remain valid also in the context of the current Proposal. While cybersecurity has been a part of data protection legislation since its beginnings and is established today by

text: Article 5(1)

text: (f) of the GDPR as one of the main principles relating to the processing of personal data, the EDPS also recalled that information security measures not only enhance personal data security and contribute to the protection of personal data, but that they also have the potential to interfere with the rights and freedoms of data subjects, especially the fundamental rights to the protection of personal data and to the privacy of electronic communications. Some of the services offered as managed security services, for example penetration testing, may have the potential to severely interfere with said fundamental rights. The EDPS therefore considers that providers of managed security services, even where not formally considered controllers of a processing suggested or initiated by them, should make a reasonable effort to deploy or propose only security measures that comply with the regulatory environment applicable to their services and the measures proposed, including data protection legislation, in order to be certified under the European cybersecurity certification schemes for managed security services. This would allow for service providers to propose legally viable measures and reduce compliance risks for small and medium enterprises.

text: 6. Two provisions in the Proposal contain the substance of extending the cybersecurity certification schemes to managed security services. Therefore, the EDPS scrutinized especially the proposed changes in

text: Article 46(2)

text: and the insertion of an

text: Article 51

text: a in

text: Regulation (EU) 2019/881

text: . The EDPS notes that the other changes are editorial consequential changes.

text: 3. Appropriate data protection knowledge

text: 7. The new

text: Article 51

text: a would list the security objectives of European cybersecurity certification schemes for managed security services, that is, at a high level, the objectives ensured by any such certification scheme. The list is based on the previous

text: Article 51

text: on the security objectives of European cybersecurity certification schemes for ICT products, services and processes, but is adjusted to the specificities of managed security services. Similar to ICT products, services and processes, managed security services that have been evaluated in accordance with the certification schemes shall comply with specified security requirements for the purpose of protecting the availability, authenticity, integrity and 5 confidentiality of data, which are accessed, processed, stored or transmitted in relation to the provision of those services . In addition, in the view of the EDPS, the Proposal takes into account that security is managed as a service by providers and the objectives therefore must focus more on factors ensuring the ability of the prospective provider to carry out those services. The EDPS notes that this is achieved by setting the objectives that services are provided continuously with the requisite competence, expertise and experience by staff with a certain level of relevant technical knowledge and professional integrity.

text: 8. The EDPS welcomes the approach taken in the new

text: Article 51

text: a. However, as already indicated in the general remarks, the EDPS has some concerns if regulatory compliance aspects, especially data protection aspects, are not among the objectives to be ensured with the certification schemes.

text: 9. The EDPS recalls that one function of the certification would be to generate trust in the services and to make managed security services of high quality available to those entities with little resources. This function would be counteracted if any proposed measure would have to be legally evaluated by the client. If in particular a small and medium enterprise relies on the certification of its providers, it may well be that it would be overstrained by the task to independently and critically evaluate the lawfulness of the measures proposed, despite of its potential role as controller. In order to avoid situations in which certified providers would propose measures involving disproportionate or otherwise illegal data processing, the EDPS recommends to require a self-declaration of compliance of their services and measures proposed through them with the applicable regulatory framework, including data protection, as a condition for certification.

text: 4. Other comments related to security objectives (

text: Article 51

text: a)

text: Article 51

text: a point (c) contains a requirement for the service provider to protect data processed by the provider in relation to the provision of managed security services. Although the words ‘or otherwise processed’ work as a catch-all provision, the EDPS proposes to add the word ‘generated’ to the list. As defined in the new point 14a of Article 2 of the Cybersecurity Act, ‘managed security service’ means a service consisting of carrying out, or providing assistance for, activities relating to cybersecurity risk management, including incident response, penetration testing, security audits and consultancy. Some of these risk management tools are able to identify and gather information which could be used adversely, for leveraging attacks to organisations (e.g. system vulnerabilities, publicly disclosed information which can be used for social engineering attacks). Systems used for security information and event management (SIEM) aggregate logs and correlate events to identify threats and generate reports on the systems' security. In the opinion of the EDPS, it would therefore be appropriate to emphasize the criticality of the information produced by these systems by explicitly mentioning them, together with the terms ‘accessed, stored, transmitted’ which are already listed, by adding the term ‘generated’.

text: 11. Point (d) sets as an objective of certification schemes to ensure that the availability and access to data, services and functions is restored in a timely manner in the event of a physical or technical incident. The EDPS considers that both aspects - physical or technical - are exhaustive when it comes to security measures, but do not cover the full range of possible security incidents. Security incidents stemming from human errors or malicious acts from employees should also be covered, even if they neither constitute a breach of technical nor physical security. In order not to exclude any type of security incident, the EDPS proposes the following wording: ‘ensure that the availability and access to data, services and functions is restored in a timely manner in the event of a security incident’, without further qualification of the incident.

text: 12. Point (e) sets as an objective to ensure that authorised persons, programs or machines are able only to access the data, services or functions ‘to which their access rights refer’. The EDPS notes that the words ‘to which their access rights refer’ is based on the corresponding point (c) of the existing

text: Article 51

text: . However, the EDPS proposes to seize the opportunity to make both provisions more substantial and also data-protection oriented: currently, they provide that users should only access the resources for which they were granted access. If, instead, the phrase would be replaced by ‘appropriate to the fulfillment of their duties’, the formalistic view would be replaced by a substantive view addressing both security and data protection considerations that access rights must correspond to the ‘need to know’ or ‘need to access’ principle.

text: 5. Conclusions

text: 13. In light of the above, the EDPS makes the following recommendation: − to establish within the Proposal a requirement for providers to self-declare that their services and measures proposed through them comply with the applicable regulatory framework, including data protection, as a condition for certification. Brussels, 10 January 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7