text: OJ L 295, 21.11.2018, p. 39. 2 COM(2022) 702 final. 3 See impact assessment report (SWD(2022) 395 final), page 7. 4 See page 172: ‛asset tracing is a “follow the money” tool, that enables courts, insolvency practitioners or parties that demonstrated a legitimate interest to determine and locate the assets, examine the revenue generated by often fraudulent activity, and follow its trail. “Asset tracing” is a legal process of identifying and locating misappropriated assets or their proceeds (values) belonging to the debtor’s estate. It includes both the preservation (freezing) of the assets identified and the repatriation (if the asset is to be found in another State)’. [‛UNCITRAL, Civil asset tracing and recovery in insolvency proceedings. Note by the Secretariat, 4 October 2021 (A/CN.9/WG.V/WP.175), § 29. See previously the Report of the Colloquium on Civil Asset Tracing and Recovery (Vienna, 6 December 2019) (A/CN/9/1008). The documents are available at www.uncitral.org’]. See impact assessment report, pages 26 -28 and 172. 4

text: Under

text: Article 2

text: (b), a Court means the judicial body of a Member State. 7 According to

text: Article 2

text: (d) of the Proposal, "centralised bank account registries" means the centralised automated mechanisms, such as central registries or central electronic data retrieval systems, put in place in accordance with

text: Article 32

text: a(1) of

text: Directive (EU) 2015/849

text: . 8 OJ L 141, 5.6.2015, p. 73. 9 According to

text: Article 32

text: a (3) of the Anti-Money Laundering Directive, the ‘following information shall be accessible and searchable through the centralised mechanisms referred to in paragraph 1: —for the customer-account holder and any person purporting to act on behalf of the customer: the name, complemented by either the other identification data required under the national provisions transposing point (a) of

text: Article 13(1)

text: or a unique identification number; —for the beneficial owner of the customer-account holder: the name, complemented by either the other identification data required under the national provisions transposing point (b) of

text: Article 13(1)

text: or a unique identification number; —for the bank or payment account: the IBAN number and the date of account opening and closing; —for the safe-deposit box: name of the lessee complemented by either the other identification data required under the national provisions transposing

text: Article 13(1)

text: or a unique identification number and the duration of the lease period’. 10

text: Article 2

text: (a) of the Proposal defines insolvency practitioners as ‛a practitioner appointed by a judicial or administrative authority in procedures concerning restructuring, insolvency and discharge of debt, as referred to in Article 26 Directive (EU)2019/1023’. 11 Proposal for a Directive of the European Parliament and of the Council on the mechanisms to be put in place by the Member States for the prevention of the use of the financial system for the purposes of money laundering or terrorist financing and repealing

text: Directive (EU) 2015/849

text: (COM(2021)423 final). 12 OJ L 172, 26.6.2019, p. 18.

text: Article 28

text: Use of electronic means of communication: ‛Member States shall ensure that, in procedures concerning restructuring, insolvency and discharge of debt, the parties to the procedure, the practitioner and the judicial or administrative authority are able to perform by use of electronic means of communication, including in cross-border situations, at least the following actions: 5

text: (a) filing of claims; (b) submission of restructuring or repayment plans; (c) notifications to creditors; (d) lodging of challenges and appeals’. 13 COM/2020/590 final. 14 Explanatory Memorandum to the Proposal, page 1. 15 OJ L 119, 4.5.2016, p. 1. 16 Chapters 1 and 2 of Title III. 17 Explanatory Memorandum page 12. Recitals 13 to 18. 6

text: See

text: Article 32

text: a(3): ‛The following information shall be accessible and searchable through the centralised mechanisms referred to in paragraph 1: − for the customer-account holder and any person purporting to act on behalf of the customer : the name, complemented by either the other identification data required under the national provisions transposing point (a) of

text: Article 13(1)

text: or a unique identification number; − for the beneficial owner of the customer-account holder : the name, complemented by either the other identification data required under the national provisions transposing point (b) of

text: Article 13(1)

text: or a unique identification number; − for the bank or payment account : the IBAN number and the date of account opening and closing; − for the safe-deposit box : name of the lessee complemented by either the other identification data required under the national provisions transposing

text: Article 13(1)

text: or a unique identification number and the duration of the lease period.’ 19

text: Article 14(3)

text: . 7

text: He notes what seems to be a clerical error under point (a) (“legal owner” should be replaced by “beneficial owner”). 8

text: COM(2021)759 final. 22 OJ L 141, 5.6.2015, p. 19. 9

identifier: EDPS yttrande 05/2023

title: EDPS Opinion on the Proposal for a Directive of the European Parliament and of the Council harmonising certain aspects of insolvency law

text: 6 February 2023

text: Opinion 5/2023

text: on the Proposal for a Directive harmonising certain aspects of insolvency law

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’. Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’. This Opinion relates to the Proposal for a Directive of the European Parliament and of the Council harmonising certain aspects of insolvency law (COM(2022) 702 final). This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 7 December 2022 the European Commission issued a Proposal for a Directive of the European Parliament and of the Council harmonising certain aspects of insolvency law. The objective of the Proposal is to lay down rules enhancing the convergence in selected aspects of the laws of the Member States concerning business non-bank insolvency procedures.

text: The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 13 December 2022, pursuant to Article 42(1) of EUDPR. It focuses on the provisions which may have an impact on the fundamental right to data protection.

text: The EDPS welcomes the safeguards provided for the access by designated courts of the Member States to information contained in national centralised bank account registries.

text: However, he makes the following recommendations:

text: First, concerning the access by insolvency practitioners to national asset registers, the EDPS recommends specifying the purpose of such access not only in the preamble but also in the enacting terms of the future directive.

text: Second, the EDPS recommends introducing at EU level the necessary safeguards for the new access by insolvency practitioners, established by the Proposal, to personal data contained in beneficial ownership registers and national asset registers.

text: In addition, concerning the interconnection of the auction platforms, the EDPS recommends clarifying that the legal basis for such interconnection would be the future Directive and not Commission implementing acts.

text: The EDPS further recommends ensuring that the Commission implementing acts, to be adopted for setting up this interconnection, are in place when the future Directive and the Member States laws transposing it are applicable.

text: Finally, concerning the electronic communications, the EDPS recommends clarifying, as the case may be, whether the future Regulation on the digitalisation of judicial cooperation and access to justice in cross-border civil, commercial and criminal matters would be relied upon for the electronic communications provided for in the Proposal.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 7 December 2022 the European Commission issued a Proposal for a Directive of the European Parliament and of the Council harmonising certain aspects of insolvency law (‘the Proposal’) .

text: 2. The objective of the Proposal is to lay down rules enhancing the convergence in selected aspects of the laws of the Member States concerning business non-bank insolvency procedures . According to the impact assessment report, consultations with stakeholders revealed difficulties related to asset tracing , especially where the asset is situated in another Member State than the one where the proceedings have been opened. The effectiveness of asset tracing is of key importance in the maximisation of the value of the insolvency estate as debtors have an incentive to remove assets from the insolvency estate. The means available for insolvency practitioners to trace and freeze assets belonging to the estate in another Member State are insufficient or inadequate which often results in the dissipation of those assets by the time action is taken. Essential information for the purpose of asset tracing are included in national registers, but these registers are either not accessible and/or not comprehensible by the insolvency practitioners (due to language barriers). In addition, each Member State has its own rules and entrusts the insolvency practitioners with different powers in respect of asset tracing. Missing or cumbersome possibilities of asset tracing impair the capacity of courts, insolvency practitioners or other parties with a legitimate interests to determine and locate the assets, examine the revenue generated by often fraudulent activity, and follow its trail .

text: 3. Title III of the Proposal on tracing assets belonging to the insolvency estate provides for: • the access by specifically designated competent national courts to the national centralised bank account registry established pursuant to

text: Directive (EU) 2015/849

text: on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (‘Anti-Money Laundering Directive’) , and in particular to the bank account information listed in

text: Article 32

text: a(3) thereof . The access would be granted upon request of the insolvency practitioner appointed in on-going insolvency proceedings, where necessary for the purposes of identifying and tracing assets belonging to the insolvency estate of the debtor in that proceedings, including those subject to avoidance actions. The future Directive would impose on the Member States an obligation to ensure that such designated courts have the power to access information available in another Member State, through the bank account registers single access point that would be put in place by the new Anti-Money Laundering Directive when adopted (

text: Articles 13

text: to 16); • indirect access by insolvency practitioners to this information by requesting the designated courts in the Member State to access and run searches (recital 16); • direct access by insolvency practitioners to beneficial ownership information (

text: Article 17

text: ); • direct access by insolvency practitioners to national asset registers, where available (

text: Article 18

text: 4. In addition, the Proposal (

text: Article 40

text: ) would require Member States to ensure that in simplified winding-up proceedings for insolvent micro-enterprises, all communications between the competent authority, and, where relevant, the insolvency practitioner, on the one hand, and the parties to such proceedings, on the other hand, can be performed by electronic means, in accordance with

text: Article 28 of Directive (EU) 2019/1023

text: of the European Parliament and of the Council of 20 June 2019 on preventive restructuring frameworks, on discharge of debt and disqualifications, and on measures to increase the efficiency of procedures concerning restructuring, insolvency and discharge of debt and amending

text: Directive (EU) 2017/1132

text: (Directive on restructuring and insolvency) .

text: 5. Finally, the Proposal would provide for the establishment and maintenance by Member States of one or several electronic auction platforms for the sale of assets of the insolvency estate in simplified winding-up proceedings (

text: Article 50

text: ) and for their interconnection to be set up by the Commission by means of implementing acts (

text: Article 51

text: 6. This initiative, announced in September 2020, is part of the Commission’s priority to advance the Capital Markets Union , a key project to further financial and economic integration in the European Union .

text: 7. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 13 December 2022, pursuant to

text: Article 42(1)

text: EUDPR. The EDPS welcomes the reference to this consultation in recital 63 of the Proposal. In this regard, the EDPS also positively notes that he was previously informally consulted pursuant to recital 60 EUDPR.

text: 2. General remarks

text: 8. The EDPS welcomes recitals 18, 61 and 62 which specify that any personal data obtained under the proposed Directive should only be processed in accordance with the applicable data protection rules by designated courts and insolvency practitioners where it is necessary and proportionate for the purposes of identifying and tracing assets belonging to the insolvency estate of the debtor in on-going insolvency proceedings, that the Proposal respects fundamental rights and in particular data protection and privacy, and that

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (the ‛GDPR’) applies to the processing of personal data for the purposes of the proposed Directive.

text: 9. The EDPS notes that the Commission proposes to expand access, by designated courts and insolvency practitioners , to central national bank account registries or electronic data retrieval systems established under

text: Directive (EU) 2015/849

text: , through the bank account registers single access point that would be put in place by the new Anti-Money Laundering Directive when adopted, and to beneficial ownership registers established under

text: Directive (EU) 2015/849

text: , where necessary and proportionate for the purposes of identifying and tracing assets belonging to the insolvency estate of the debtor in ongoing insolvency proceedings .

text: 10. Pursuant to the purpose limitation principle set out in

text: Article 5(1)

text: (b) GDPR, personal data must not be further processed in a manner that is incompatible with the purposes for which it was collected. The EDPS notes that the specific purposes for which data would be processed under the Proposal would be different from the purposes of preventing, detecting and effectively combating money laundering and terrorist financing for which these registers where established under

text: Directive (EU) 2015/849

text: and possibly from the purposes of all or some of the national asset registers established under national law. He notes however that the purpose of the access established under the Proposal would be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controllers in accordance with

text: Article 6(1)

text: (e). It would hence be compatible with the purpose for which the registers were established, in accordance with

text: Article 6(4)

text: GDPR, given that, together with the safeguards (see below) provided by the Proposal, the Proposal would constitute a necessary and proportionate measure in a democratic society to safeguard an important objective of general public interest of the Union referred to in

text: Article 23(1)

text: (e) GDPR (see however below for the access to beneficial ownership registers and national asset registers).

text: 11. The EDPS welcomes the safeguards set out in

text: Articles 13

text: to 16, which would apply to the access and search by the designated courts of bank account information. Indeed, under these provisions, only courts designated among the courts that are competent to hear cases related to procedures in restructuring, insolvency or discharge of debt would have the power to access directly bank account information. In addition, such power is provided only where necessary for the purposes of identifying and tracing assets belonging to the insolvency estate of the debtor in an ongoing proceedings and upon request by the insolvency practitioner appointed in these proceedings.

text: 12. Also the personal data accessed under these provisions are limited to those exhaustively 18 19 listed in

text: Article 32

text: a(3) of

text: Directive (EU) 2015/849

text: as the Proposal specifically excludes for access the additional information that Member States may include in the registries pursuant to

text: Article 32

text: a(4) of

text: Directive (EU) 2015/849

text: 13. The Proposal furthermore sets out the conditions for such access and its monitoring i.e. that it shall be performed on a case-by-case basis, by the staff specifically appointed and authorised within the designated courts. It sets out an obligation for Member States to ensure high professional standards of the staff (confidentiality, integrity, and appropriate skills) and high standard technical and organisational security measures.

text: 14. The Proposal finally establishes an obligation on Member States to ensure that logs are kept for each time a designated court accesses and searches the information and specifies what these logs must include, in particular the name of the designated court and the unique identifier of the staff member who made the query. The logs must be checked by the authorities operating the centralised bank account registries. The monitoring must include verifying the admissibility of a request and the lawfulness of personal data processing and whether the integrity and confidentiality of personal data is ensured. The logs must be protected by appropriate measures and be erased five years after their creation, unless they are required for monitoring procedures that are ongoing.

text: 15. These safeguards are particularly important given the sensitivity of the information concerned to ensure the implementation of the principles of purpose limitation, data minimisation and integrity and confidentiality set out in

text: Article 5

text: GDPR.

text: 16. The EDPS also positively notes that

text: Article 17(2)

text: on the access by insolvency practitioners to beneficial ownership information exhaustively lists the information that may be accessed to and clearly limits such access to cases where it is necessary for identifying and tracing assets belonging to the insolvency estate of the debtor in ongoing insolvency proceedings .

text: 17. Similarly to the other accesses provided for under the Proposal, the EDPS recommends clarifying in the enacting terms (

text: Article 18

text: ), not only in a recital (recital 18), that access by insolvency practitioners to national asset registers is allowed only where necessary for the purposes of identifying and tracing assets belonging to the insolvency estate of the debtor in an on-going insolvency proceeding.

text: 18. The EDPS would like to finally underline that the Proposal would introduce a limitation on the right to data protection by extending access to personal data contained in the beneficial ownership registers and national asset registers for a different purpose (see above). It is therefore of utmost importance that the relevant safeguards are provided for also at EU level. In this regard, he notes that the safeguards are provided for in much more detail for the access to bank account registries, and recommends the co-legislators to consider the additional safeguards to introduce at EU level as regard access to beneficial ownership registers and national asset registers so as to ensure a necessary and proportionate measure.

text: 3. Interconnection of electronic auction systems

text: 19. The EDPS notes that under Article 51 of the Proposal the Commission must establish a system for the interconnection of the national electronic auction systems set up in the Proposal by means of implementing acts. While welcoming

text: Article 53

text: clarifying the role of the Commission as a controller, the EDPS recommends clarifying, that the Proposal would establish a legal basis for the interconnection of the national electronic auction systems, e.g. by stating in the enacting terms that the national electronic auction systems must be interconnected (in addition to providing for the concrete setting up of this interconnection system by implementing acts).

text: 20. The EDPS also draws attention to the fact that, as it stands,

text: Article 51

text: does not ensure that such implementing acts would be in place at the time when the national laws of Member States transposing the proposed Directive would apply. Indeed this provision sets an obligation to adopt the implementing act within one year after the transposition deadline of the proposed Directive defined in

text: Article 71

text: . Since the implementing acts would specify, among others, the applicable data protection safeguards (

text: Article 51(2)

text: (j)), the EDPS recommends modifying this provision so as to ensure that the implementing acts setting up the interconnection of the national electronic auction systems are adopted at the time national laws transposing the directive apply.

text: 4. Electronic communications

text: 21. Finally, the Proposal provides for the use of electronic communications, including crossborder (

text: Article 40

text: ). The EDPS would like to draw attention to the Proposal, currently under negotiation, for a Regulation of the European Parliament and of the Council on the digitalisation of judicial cooperation and access to justice in cross-border civil, commercial and criminal matters, and amending certain acts in the field of judicial cooperation . Pursuant to its

text: Article 1

text: , that Proposed Regulation aims at establishing a legal framework for electronic communication between competent authorities in judicial cooperation procedures in civil, commercial and criminal matters and for electronic communication between natural or legal persons and competent authorities in judicial procedures in civil and commercial and criminal matters and it would be applicable to insolvency proceedings falling within the scope of

text: Regulation (EU) 2015/848

text: of the European Parliament and of the Council of 20 May 2015 on insolvency proceedings (recast) (see Annex 1) . The EDPS recommends clarifying, as the case may be, whether this proposed Regulation would apply in the context of the electronic communications provided for under the Proposal.

text: 5. Conclusions

text: 22. In light of the above, the EDPS makes the following recommendations: (1) to clarify in the enacting terms of the future Directive that access by insolvency practitioners to national asset registers is allowed only where necessary for the purposes of identifying and tracing assets belonging to the insolvency estate of the debtor in an on-going insolvency proceeding; (2) to introduce at EU level the necessary safeguards for the new access by insolvency practitioners, established by the Proposal, to personal data contained in beneficial ownership registers and national asset registers; (3) to clarify that the future Directive would establish the interconnection of the national electronic auction systems; (4) to ensure that the implementing acts to be adopted by the Commission for the setting up of the interconnection of the electronic auction systems would be in place at the time national laws transposing the directive apply so that the data protection safeguards to be specified through these implementing acts are also in place; (5) to clarify, as the case may be, whether the future Regulation on the digitalisation of judicial cooperation and access to justice in cross-border civil, commercial and criminal matters would be relied upon for the electronic communications provided for in the Proposal. Brussels, 6 February 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 10


text: COM(2023) 752 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 752 final, p. 2. 4

text: COM(2023) 753 final. 5 EDPS Opinion 6/2024 on on the Proposal for a Regulation amending Regulations

text: (EC) No 261/2004

text: (EC) No 1107/2006

text: (EU) No 1177/2010

text: (EU) No 181/2011

text: and

text: (EU) 2021/782

text: as regards enforcement of passenger rights in the Union, issued on 24 January 2024. Article 5(8) of the Proposal. 7

text: Article 9(2)

text: and Article 14 of the Proposal. 8

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (Text with EEA relevance), OJ L 119, 4.5.2016, p. 1-88. 9 EDPS Formal comments on the draft Commission Implementing Regulation establishing a common form for rail passengers’ reimbursement and compensation requests for delays, missed connections and cancellations of rail services in accordance with

text: Regulation (EU) 2021/782

text: of the European Parliament and of the Council, issued on 29 March 2023. 10

text: Regulation (EU) 2021/782

text: of the European Parliament and of the Council of 29 April 2021 on rail passengers’ rights and obligations (recast), OJ L 172, 17.5.2021, p. 1–52. 5

text: COM (2023) 752 final,

text: Article 5(8)

text: . 12 See also

text: Article 5(1)

text: (b) GDPR. 13

text: Article 5(1)

text: (e) GDPR. 14 COM (2023) 753 final,

text: Article 1

text: , amending

text: Regulation (EC) No 261/2004

text: Article 15

text: a;

text: Article 3

text: , amending

text: Regulation (EC) No 1177/2010

text: Article 24

text: a;

text: Article 4

text: , amending

text: Regulation (EU) No 181/2011

text: Article 26

text: a.

identifier: EDPS yttrande 05/2024

amnesord:
Transport
EU Passengers Name Record

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 5/2024 on the Proposal for a Regulation on passengers rights in the context of multimodal journeys

serie: yttranden

text: 24 January 2024

type: rubrik

text: Opinion 5/2024

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’. This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on passengers rights in the context of multimodal journeys . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: The aim of the Proposal is to ensure that passengers enjoy a similar level of protection when switching between different modes of transport. Specifically, the Proposal aims to ensure: nondiscrimination between passengers with regard to transport conditions and the provision of tickets; minimum and accurate information to be provided to passengers in an accessible format and in a timely manner; passengers’ rights in the context of a missed connection between different transport modes; non-discrimination against, and assistance for, persons with disabilities and persons with reduced mobility; the definition and monitoring of service quality standards; the handling of complaints.

text: The EDPS welcomes the attention paid to the data protection aspects of the Proposal, notably having regard to the transmission of the contact details of the passenger to the carrier in case the passenger booked the ticket via an intermediary. To be consistent with the provisions of the Proposal for a Regulation amending Regulations

text: (EC) No 261/2004

text: (EC) No 1107/2006

text: (EU) No 1177/2010

text: (EU) No 181/2011

text: and

text: (EU) 2021/782

text: , the EDPS recommends specifying that the carrier’s report on service quality standards should not contain personal data.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 29 November 2023, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on passenger rights in the context of multimodal journeys (‘the Proposal’). The Proposal is accompanied by an annex providing the list of urban nodes (Annex I) and by an annex on minimum service quality standards (Annex II).

text: 2. The objective of the Proposal is to provide for passenger rights having regard to multimodal journeys and to ensure: (1) non-discrimination between passengers with regard to transport conditions and the provision of tickets; (2) minimum and accurate information to be provided to passengers in an accessible format and in a timely manner to passengers; (3) passenger rights in the event of disruption, in particular in the context of a missed connection between different transport modes; (4) non-discrimination against, and assistance for, persons with disabilities and persons with reduced mobility; (5) the definition and monitoring of service quality standards; (6) the handling of complaints; (7) general rules on enforcement .

text: 3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 29 November 2023, pursuant to Article 42(1) of EUDPR. The EDPS positively notes that he was already previously informally consulted pursuant to Recital 60 of EUDPR.

text: 2. General remarks

text: 4. The EDPS recognises the importance of ensuring that passengers enjoy a level of protection where they switch between transport modes during a journey that is similar to the standards of protection for passengers when they travel by air, rail, sea and inland waterways, and bus and coach. The EDPS also notes that the proposal is consistent with the proposal amending Regulations

text: (EC) No 261/2004

text: (EC) No 1107/2006

text: , (EU) No 1177/20,

text: (EU) No 181/2011

text: and

text: (EU) 2021/782

text: as regards enforcement of passenger rights in the 4 5 Union . The EDPS adopted his Opinion on that Proposal on 25 January 2024 .

text: 6. The EDPS observes that the Proposal entails the processing of personal data, notably of the passenger’s contact details , or about his or her qualification as ‘person with reduced 7 8 mobility’ , by the carriers.

text: Regulation (EU) 2016/679

text: (‘the GDPR’) is therefore applicable to the processing of personal data in the context of the Proposal. The EDPS welcomes the reference to the applicability of the GDPR under recital 21 of the Proposal. The EDPS also welcomes, in the same recital, the specification that the obligations to provide information to passengers concerning their (consumer) rights are without prejudice to the obligation of the controller to provide information to the data subject pursuant to the GDPR.

text: 3. Common form for reimbursement and compensation requests

text: 7. The EDPS notes that the Proposal, under

text: Article 11

text: , empowers the Commission to adopt an implementing act establishing a common form for reimbursement and compensation requests.

text: 8. The EDPS recalls the Commission that the EDPS should be consulted on these implementing acts pursuant to

text: Article 42(1)

text: EUDPR where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data. The EDPS also recalls that he has already provided formal comments on the draft Commission Implementing Regulation establishing a common form for rail passengers’ reimbursement and compensation requests for delays, missed connections and cancellations of rail services in accordance with

text: Regulation (EU) 2021/782

text: 4. Transmission of passenger contact details by intermediaries

text: 9. The EDPS notes that the Proposal contains provisions on the transmission of contact details of the passenger and of the booking details by the intermediary to the carrier . In this regard, the EDPS welcomes that the Proposal describes the purposes of the processing in a clear and explicit manner . In particular, the EDPS positively notes that

text: Article 5(8)

text: specifies that the contact details of the passenger can only be used by the carrier to the extent necessary to comply with its obligations to provide information, provision of care, reimbursement, re-routing and compensation, and to fulfil its obligations under applicable Union law on safety and security.

text: 10. In accordance with the principle of storage limitation, personal data may not be retained in a form which permits identification for longer than is necessary . The EDPS therefore welcomes the specification that the carrier must delete the contact details within 72 hours after the completion of the contract of carriage, unless further retention of the contact details is justified to fulfil its obligations in respect of the passenger’s right to re-routing, reimbursement or compensation.

text: 5. Information to be transmitted by carriers to the national enforcement bodies

text: 11. The EDPS notes that Article 17 of the Proposal would require carriers offering single multimodal contracts to establish service quality standards (covering the items listed in Annex II), to monitor their performance, and to publish a report on service quality performance on the carrier’s website.

text: 12. The EDPS notes that the Proposal for a Regulation amending Regulations

text: (EC) No 261/2004

text: (EC) No 1107/2006

text: (EU) No 1177/2010

text: (EU) No 181/2011

text: and

text: (EU) 2021/782

text: as regards enforcement of passenger rights in the Union, issued together with the Proposal, specifies that “this report [the report on service quality performance] shall not contain personal data”. The EDPS considers that the report on service quality standards, to fulfil its function, can be limited to statistical data (e.g. on the number of complaints, types of complaints, etc.). Therefore, the EDPS recommends specifying in Article 17 of the Proposal that the report on service quality standards should not contain personal data. 6

text: 6. Conclusions

text: 13. In light of the above, the EDPS recommends to specify in Article 17 of the Proposal that the report on service quality standards should not contain personal data. Brussels, 24 January 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7

type: vagledning

utgivare: edps


text: COM(2025) 33 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2025) 33 final. 4 Explanatory memorandum of the Proposal, page 2, and Article 1 of the Proposal. Explanatory memorandum of the Proposal, page 1; 4

text: EDPS Opinion 3/2024 on the signing and conclusion on behalf of the European Union, of the Protocol amending the Agreement between the European Union and Japan for an Economic Partnership regarding free flow of data, paragraph 11, available on the EDPS wesbite. 5

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1–88. 6

identifier: EDPS yttrande 05/2025

amnesord: Electronic Communications, Information Society

title: Opinion 5/2025 on the Proposal for a Council Decision establishing the position on behalf of the EU in the World Trade Organization on adding the Agreement on Electronic Commerce into the Agreement establishing the World Trade Organization

text: on the Proposal for a Council Decision establishing the position to be taken in the World Trade Organization on adding the Agreement on Electronic Commerce into the Agreement establishing the World Trade Organization

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Council Decision establishing the position to be taken on behalf of the European Union in the World Trade Organization on adding the Agreement on Electronic Commerce into the Agreement establishing the World Trade Organization, pursuant to Article 218 TFEU. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: In January 2019, the World Trade Organisation (‘WTO’) Joint Initiative on Electronic Commerce was established with the aim to start negotiations towards the Agreement on Electronic Commerce (‘AEC’ or ‘Agreement’).

text: On 26 July 2024, after 5 years of negotiations, the participants of the WTO Joint Initiative on Electronic Commerce reached a stabilised text of the Agreement, which covers a wide range of digital trade disciplines.

text: Once integrated into the legal framework of WTO, it will represent the first set of global rules governing digital trade. This will facilitate e-commerce both within countries and across borders, improve trust for consumers and businesses and ensure a more reliable international digital trade environment.

text: On 6 February 2025, the European Commission issued the Proposal for a Council Decision establishing the position to be taken on behalf of the European Union in the WTO on adding the Agreement into the Agreement establishing the World Trade Organisation.

text: The objective of the Proposal is limited to enabling the EU to join a possible consensus at the General Council of the World Trade Organisation on the adoption of the envisaged Agreement.

text: The EDPS takes this opportunity to welcome the inclusion of specific provisions on data protection in the Agreement, which allow each Party to adopt or maintain a legal framework that provides for the protection of personal data related to electronic commerce, in particular

text: Article 16

text: “Personal Data Protection” and

text: Article 25

text: “Personal Data Protection Exception”.

text: For the sake of clarity, the EDPS recommends clarifying that nothing in the Agreement shall affect the protection of personal data and privacy afforded by the parties’ respective safeguards, including in situations where specific controllers or processors would be required by EU to store specific personal data in the EU/EEA, based on grounds related to the fundamental rights to data protection and privacy.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union (‘TFEU’),

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 6 February 2025, the European Commission issued the Proposal for a Council Decision establishing the position to be taken on behalf of the European Union in the World Trade Organisation on adding the Agreement on Electronic Commerce into the Agreement establishing the World Trade Organisation (‘the WTO Agreement’), pursuant to

text: Article 218

text: TFEU (‘the Proposal’).

text: 2. The objective of the Proposal is limited to enable the EU to join a possible consensus at the General Council of the World Trade Organisation (‘WTO’) regarding the legal incorporation of the Agreement on Electronic Commerce to Annex 4 to the WTO Agreement .

text: 3. On 26 July 2024, after 5 years of negotiations, the participants of the World Trade Organisation Joint Initiative on Electronic Commerce reached a stabilised text of the Agreement on Electronic Commerce (‘AEC’ or ‘Agreement’ ), which is the first set of global rules governing digital trade . The AEC is set to become part of the WTO legal framework as a plurilateral agreement, formally appended to Annex 4 of the WTO Agreement.

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 6 February 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in the third citation of the Proposal.

text: 2. General remarks

text: 5. The Agreement on Electronic Commerce creates a framework which aims to facilitate digital trade both within countries and across borders, with provisions on e-authentication and esignatures, e-contracts, e-invoicing, paperless trading, single windows data exchange and systems interoperability, and e-payments. Furthermore, the AEC contains provisions to improve trust in the digital trade environment for both consumers and businesses, including provisions on unsolicited commercial electronic messages, online consumer protection, cybersecurity, or open internet access; as well as provisions leading to a more reliable international digital trade environment, facilitating consumers’ and companies’ continued access to the internet and electronic services at affordable prices.

text: 6. The Agreement includes also two main provisions on data protection, namely

text: Article 16

text: titled ‘Personal data protection’, and

text: Article 25

text: titled ‘Personal data protection exception’.

text: 7. The EDPS recalls that, as the protection of personal data is a fundamental right in the European Union (‘EU’), it cannot be subject to negotiations in the context of EU trade agreements. It is for the EU alone to decide how to implement fundamental rights protection in Union law. The Union should not embark on any international trade commitments that are incompatible with its domestic data protection legislation. Dialogues on data protection and trade negotiations with third countries can complement each other, but must follow separate tracks. Personal data flows between the EU and third countries should be enabled by using the mechanisms provided under the EU data protection legislation .

text: 8. In this regard, the EDPS positively notes that

text: Article 16

text: leave it to the Parties to adopt or maintain a data protection legal framework. Moreover, the exception clause introduced by

text: Article 25

text: allows Parties to adopt and maintain their rules on the protection of personal data and privacy, including rules on cross-border data transfers insofar as they provide for instruments enabling transfers under conditions of general application.

text: 3. Provisions on data protection

text: 9. The EDPS welcomes the fact that Article 16 of the Agreement recognises the Parties’ right to ‘adopt or maintain a legal framework that provides for the protection of the personal data of users of electronic commerce’. However, he understands that the right of the EU to regulate personal data protection as a fundamental right might be constrained by Article 25 of the Agreement, since the provision would only allow the Parties to adopt or maintain measures on the protection of personal data and privacy, including with respect to cross-border transfers of personal data, under the condition that they also provide for ‘instruments enabling transfers under conditions of general application for the protection of the data transferred’. It is not clear whether all duly justified cases in which the EU would decide to require certain controllers or processors to store specific categories of personal data in the EU/European Economic Area (‘EEA’), based on grounds related to the fundamental rights to data protection and privacy, would qualify as conditions of general application under Article 25 of the Agreement.

text: 10. Therefore, the EDPS invites the Commission to clarify whether Article 25 of the Agreement allows the EU to require, in duly justified cases, certain controllers or processors to store specific categories of personal data in the EU/EEA, based on grounds related to the fundamental rights to data protection and privacy.

text: 11. In any case, the EDPS considers that it is possible to interpret Article 25 of the Agreement as allowing the EU to require, in duly justified cases, certain controllers or processors to store specific categories of personal data in the EU/EEA based on grounds related to the fundamental rights to data protection and privacy, as long as there is a general framework (such as Chapter V of the General Data Protection Regulation ) enabling transfers under conditions of general application.

text: 4. Cooperation

text: 12. The EDPS recognises the importance of international cooperation in different fields of activities including data protection to globally ensure effective data protection standards.

text: 13. Therefore, the EDPS positively notes that, among the areas of cooperation that the Parties endeavour to implement, Article 19 of the Agreement specifically includes the protection of personal data.

text: 5. Interplay with other provisions

text: 14. The EDPS notes that other provisions of the Agreement may have an interplay with existing EU legislation in various areas (often related to personal data protection). Such is the case, in particular, of

text: Article 12

text: dedicated to Open Government Data, as well as

text: Article 14

text: on online consumer protection and

text: Article 15

text: , on unsolicited commercial electronic messages.

text: 15. The EDPS recalls that, in the EU, various acts of secondary law are liable of applying to the same circumstances and compliance with one legal instrument does not ensure compliance with other legal instruments. It therefore welcomes that the horizontal nature of

text: Article 16

text: and of Article 25 of the Agreement ensures that the data protection framework applies and must be complied with whenever personal data are processed, notwithstanding the simultaneous application of other legal instruments, notably ones that seek to protect consumers and privacy.

text: 6. Conclusions

text: 16. In light of the above, the EDPS makes the following recommendation: (1) to clarify the interpretation of Article 25 of the Agreement as allowing the EU to require, in duly justified cases, certain controllers or processors to store specific categories of personal data in the EU/EEA, based on grounds related to the fundamental rights to data protection and privacy. Brussels, 1 April 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7


text: COM(2025) 838 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2025) 838 final. 4 COM(2025) 838 final, p. 1. 5 Ibid. 6 Ibid. 7 COM(2025) 30 final. 8 Id., p. 18. 4

text: Article 5

text: a(1) of

text: Regulation (EU) No 910/2014

text: of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive

text: , OJ L 257, 28.8.2014, pp. 73–114, as amended by

text: Regulation (EU) 2024/1183

text: of the European Parliament and of the Council of 11 April 2024 amending

text: Regulation (EU) No 910/2014

text: as regards establishing the European Digital Identity Framework, OJ L, 2024/1183, 30.4.2024, ELI: http://data.europa.eu/eli/reg/2024/1183/oj. 10 Recital 55 of the Proposal and

text: Article 5

text: a(1) of the eIDAS Regulation (footnote 9). 11 COM(2025) 838 final, p. 2: “market-driven digital tool”. 12 Recital 6 of the Proposal. 13 COM(2025) 838 final, p. 7: “adopting a cloud-based solution like the European Business Wallets”; Recital 24 of the Proposal: “secure digital platform for storing and exchanging business documents”. 14 COM(2025) 838 final, p. 2: “including the digital management of representation rights and mandates, and a secure channel for exchanging official documents and attestations”. See also Recitals 11 and 21 of the Proposal. 15

text: Article 5(1)

text: (j) of the Proposal. 16 The Proposal establishes the European Digital Directory as “the trusted source of information for European Business Wallet owners” to enable them “to be easily contacted,” thereby promoting legal certainty in dealings between businesses and with public sector bodies (

text: Article 10(1)

text: and Recital 38 of the Proposal). 5

text: The Directory would be operated and maintained by the Commission, accessible only to authorised Wallet users and providers, and would rely on information from authentic sources (including business registers via the Business Registers Interconnection System - BRIS), ensuring secure, interoperable, and non-duplicative cross-border communication (

text: Article 10(1)

text: –(4) and Recital 38 of the Proposal). 18 Judgment of the Court of Justice of 9 November 2010, Schecke, Joined Cases

text: and

text: , ECLI:EU:C:2010:353, paragraph 53. 19

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, pp. 1–88. 20 Cf. COM(2025) 838 final, p. 2. See also SWD(2025) 837 final p. 14 (“While the EU Digital Identity Wallets prioritise user control, privacy, and minimal disclosure for natural persons to protect their personal data, these principles can conflict however with economic operators’ needs. They require traceability to keep track of all shared attributes for risk management, fraud prevention, and compliance and auditing purposes (e.g. tracking supply chain attributes or financial transactions). In professional contexts, transparency, verifiability, traceability and accountability are essential for enabling trusted transactions and may take precedence over the privacy-by-default principles33 applicable in natural persons interactions. Economic operators’ digital identity needs differ: their sensitive business data flows across complex collaborations and activities, demanding solutions that integrate with existing tools and align with their operating model and organizational structures.”). 6

text: Article 10(4) of the Proposal. 22

text: Regulation (EU) No 910/2014

text: , see footnote 9. 23 Article 11 of the Proposal. 24 Article 13(1) of the Proposal. 25 Article 13(4) of the Proposal. 26

text: Article 13(5)

text: (g) of the Proposal. 7

text: Regulation (EU) No 910/2014

text: , see footnote 9. 28 Recital 55 of the Proposal. 8

identifier: EDPS yttrande 05/2026

amnesord:
Transfers of data
Finance & Economy

title: Opinion 5/2026 on the Proposal for a Regulation on the establishment of European Business Wallets

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on the establishment of European Business Wallets . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 19 November 2025, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on the establishment of European Business Wallets.

text: The objective of the Proposal is to provide a harmonised, trusted, and user-friendly digital framework for economic operators and public sector bodies to securely identify, authenticate and exchange data with full legal effect across EU borders. The European Business Wallet would complement the European Digital Identity Wallets by introducing a market-driven digital tool designed for the specific needs of business transactions.

text: The EDPS understands the need for additional transparency, verifiability, traceability and accountability in a business-to-government and business-to-business context, which explains why different design choices may need to be made for European Business Wallets (used by economic operators acting in a commercial or professional capacity) in comparison to the European Digital Identity Wallet (used by individuals acting in a private capacity). That being said, the EDPS recalls that compliance with data protection rules must be ensured where data amounts to personal data. Against this background, the EDPS welcomes that the Proposal (1) recalls the need to ensure compliance with EU data protection rules; (2) provides for the functionality of selective disclosure; and that (3) the Commission would be required to make the European Digital Directory only accessible to European Business Wallet owners and their authorised representatives and providers of European Business Wallets. His recommendations relate to a further clarification of the applicable data protection rules and principles, and to establishing a duty for the European Commission as supervisory authority for Union entities issuing business wallets to cooperate with the EDPS.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 19 November 2025, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on the establishment of European Business Wallets (‘the Proposal’).

text: 2. The objective of the Proposal is to provide a harmonised, trusted, and user-friendly digital framework for economic operators and public sector bodies to securely identify, authenticate and exchange data with full legal effect across EU borders . It aims to enable a new harmonised and digital approach to cross-border business-to-government and business-to-business interactions .

text: 3. The European Business Wallets proposal aims at complementing the European Digital Identity Wallets by introducing a market-driven digital tool designed for the specific needs of business transactions .

text: 4. The Communication from the Commission to the European Parliament, the European Council, the Council, the European Economic and Social Committee and the Committee of the Regions of 29 January 2025 , subtitled ‘A Competitiveness Compass for the EU’, explicitly mentions the European business wallet as the cornerstone of doing business simply and digitally in the EU, providing a seamless environment for companies to interact with all public administrations .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 25 November 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 58 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 6. The EDPS welcomes the underlying objectives of the Proposal to further promote digitalisation in governments and increased uptake of trust services in the business environment and beyond.

text: 7. The EDPS notes that, despite the similarity in names, the European Business Wallets and the European Digital Identity Wallets have different providers, offer partially different services and are based on different technical solutions. The EU Digital Identity Wallet is 9 10 issued by or on behalf of Member States to natural (or legal) persons , is based on mobile technology, and provides eID and Trust Services. The European Business Wallets as 11 12 provided for in the Proposal would be issued by service providers , to economic operators , would be cloud-based , and would offer additional services such as secure business-tobusiness or business-to-government communication, data sharing and access control mechanisms . The European Business Wallets would therefore complement the European Digital Identity Wallet, but not replace it.

text: 8. The European Business Wallets would cover a wide range of use cases for economic operators, while building on the existing eIDAS framework. As an economic operator’s European Business Wallet would be in the cloud, several representatives of the operator could be empowered to use it at the same time and for different purposes . The European Business Wallets would support many different use cases, simplifying interactions in a business environment.

text: 9. In addition, the Proposal would create a European Digital Directory. This Directory would serve as a trusted, Union-wide contact and discovery mechanism that allows economic operators and public sector bodies using European Business Wallets to be reliably identified and contacted, thereby increasing legal certainty in business-to-business and business-togovernment interactions . It would support secure, interoperable, and traceable communication across borders by providing a reference source maintained by the Commission, while avoiding duplication of existing registers and relying on authentic sources such as business registers .

text: 10. The EDPS recalls that self-employed persons and sole traders that would use the European Business Wallets would be considered ‘data subjects’ under the GDPR. The same can be applicable in certain circumstances where legal persons would use European Business Wallets, notably where the official title of the legal person identifies the natural person behind the legal person .

text: 11. Against this background, the EDPS welcomes the clarification in Recital 39 of the Proposal that the

text: Regulation (EU) 2016/679

text: (‘GDPR’) applies to all personal data processing activities under the Proposal. As the European Digital Directory would be established and maintained by the Commission, the EPDS recommends also making reference to

text: Regulation (EU) 2018/1725

text: 12. The EDPS also welcomes the explicit reference to the core data protection principles of data minimisation and purpose limitation, as well as obligations such as data protection by design and by default, in the second sentence of the Recital. However, the EDPS notes that these references are only made in relation to the European Digital Directory, whereas these requirements and principles are of general application. Therefore, the EDPS recommends rephrasing the second sentence of Recital 39 of the Proposal so that it applies to all personal data processing under the Proposal and not only to the European Digital Directory.

text: 13. The EDPS takes note of the explanations provided in the Explanatory Memorandum and Staff Working Document regarding the need for additional transparency, verifiability, traceability and accountability in the context of a trusted, standardised channel for business-to-government and business-to-business interactions . The EDPS welcomes these clarifications, which explain why different design choices may need to be made for European Business Wallets (used by economic operators acting in a commercial or professional capacity) in comparison to the European Digital Identity Wallet (used by individuals acting in a private capacity). The EDPS acknowledges the need to document transactions, including the fulfilment of reporting obligations, the conclusion of contracts, and other use cases for the communications channel, including legally binding proof of delivery, and information on who represented the economic operator in these transactions.

text: 14. That being said, the EDPS recalls that compliance with data protection rules must be ensured where data amounts to personal data. Against this background, the EDPS welcomes the Business Wallet functionality of selective disclosure, which facilitates compliance with the data minimisation principle. The EDPS further welcomes that the Commission would be required to make the European Digital Directory only accessible to European Business Wallet owners and their authorised representatives and providers of European Business Wallets .

text: 3. Governance

text: 15. The EDPS notes that in contrast with the European Digital Identity Wallet, a certification of European Business Wallets is not mandatory and not provided for in the Proposal. While the EDPS fully supports the mandatory certification requirement for the European Digital Identity Wallet, he notes that in a business environment a different approach may be adequate, provided necessary safeguards are in place. Additionally, important elements such as trust services that may become part of the European Business Wallet will already be certified under the eIDAS Regulation .

text: 16. The EDPS further notes that entities that intend to provide European Business Wallets would be required to notify that intention together with certain information to the competent supervisory body , simplifying ex-post surveillance.

text: 17. In each Member State, the supervisory bodies designated pursuant to

text: Article 46

text: a of

text: Regulation (EU) No 910/2014

text: would also be the supervisory bodies for the purposes of the Proposal . Their role would be to monitor compliance with the requirements laid down in the Proposal and to unfold ex post supervisory activities where necessary . The EDPS welcomes that those auhorities would be obliged to cooperate with supervisory authorities established pursuant to Article 51 of the GDPR, in particular, by informing them, without undue delay, where personal data protection rules appear to have been breached and about security breaches which appear to constitute personal data breaches under the GDPR .

text: 18. Article 15(1) of the Proposal recognises the possibility that a Union entity is a provider of a European Business Wallet. In that case, the European Commission shall be its supervisory body. By analogy to

text: Article 13(5)

text: (g) of the Proposal, concerning the cooperation between a Member State’s supervisory authorities, the EDPS recommends including a similar duty for the Commission to cooperate with the EDPS under Article 15 of the Proposal.

text: 4. Amendments to

text: Regulation (EU) No 910/2014

text: 19. The EDPS notes that the Proposal would remove the reference to legal persons in

text: Article 5

text: a(1) of the amended eIDAS Regulation as beneficiaries of European Digital Identity Wallets . The intention seems to be to reposition the EUDIW as a citizen-centric instrument, and to shift professional and organisational use cases for legal persons to the European Business Wallet (EBW) framework, as the Proposal explicitly acknowledges that uncertainty around EUDIWs for legal persons has created legal and technical complexity .

text: 20. The EDPS notes that the Proposal already allows self-employed persons and sole traders to use European Digital Identity Wallets to access European Business Wallet trust services and the secure communication channel.

text: 5. Conclusions

text: 21. In light of the above, the EDPS makes the following recommendations: (1) to rephrase Recital 39 of the Proposal so that it applies to all personal data processing under the Proposal and not only to the European Digital Directory and to also make reference to Regulation 2018/1725; (2) to include in Article 15 of the Proposal a duty for the Commission as supervisory authority over Union entities providing Business Wallets to cooperate with the EDPS, in analogy with

text: Article 13(5)

text: (g) of the Proposal. Brussels, 20 January 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI