text: OJ L 119, 4.5.2016, p.1 OJ L 8, 12.1.2001, p.1 Explanatory memorandum to the Proposal for a Directive of the European Parliament and the Council on the re-use of public sector information (recast), p.3 Communication from the Commission to the European Parliament, the Council , the European Economic and Social Committee and the Committee of the Regions “Towards a common European data space”, p. 5 https://edps.europa.eu/sites/edp/files/publication/16-09-23_bigdata_opinion_en.pdf , on re-use p.9. European Data Protection Supervisor Opinion 05/2018-Preliminary Opinion on Privacy by Design Section V of

text: Article 29

text: WP Opinion 06/2013. OJ L 145/43, 30.05.2001, Art. 4(b) Opinion of the European Data Protection Supervisor on the ‘Open-Data Package’ of the European Commission including a Proposal for Directive amending Directive

text: on re-use of public sector information (PSI), a Communication on Open Data and

text: Commission Decision 2011/833/EU

text: on the reuse of Commission documents, 18 April 2012, paras. 63 and 64. http://www.ema.europa.eu/ema/index.jsp?curl=pages/regulation/general/general_content_001743.jsp&mid= WC0b01ac0580ae88cc http://ec.europa.eu/eurostat/web/european-statistical-system/reuse-ess-statistics Comments of the EDPS on a Proposal for a Regulation of the European Parliament and of the Council on a framework for the free-flow of non-personal data in the European Union. https://edps.europa.eu/sites/edp/files/publication/18-06- 08_formal_comments_freeflow_non_personal_data_en.pdf

identifier: EDPS yttrande 05/2018

amnesord:
General Data Protection Regulation
Privacy by Design
Privacy by Default
IPEN
Technologies

publisher: Europeiska datatillsynsmannen

sprak: en

title: Privacy by Design

serie: yttranden

text: Opinion 5/2018

type: rubrik

text: EDPS Opinion on the proposal for a recast of the Public Sector Information (PSI) re-use Directive

text: (Directive of the European Parliament and of the Council on the re-use of public sector information)

text: 10 July 2018 1 | P a g e

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 41(2) of Regulation 45/2001 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to privacy, are respected by the Community institutions and bodies’, and ‘…for advising Community institutions and bodies and data subjects on all matters concerning the processing of personal data’. Under Article 28(2) of Regulation 45/2001, the Commission is required, ‘when adopting a legislative Proposal relating to the protection of individuals’ rights and freedoms with regard to the processing of personal data...’, to consult the EDPS.

text: He was appointed in December 2014 together with the Assistant Supervisor with the specific remit of being constructive and proactive. The EDPS published in March 2015 a five-year strategy setting out how he intends to implement this remit, and to be accountable for doing so.

text: This Opinion is based on

text: Article 41(2) of Regulation 45/2001/EC

text: and provides for recommendations on how to better safeguard the right to privacy and the protection of personal data in the proposed recast of Directive of the European Parliament and the Council on the re-use of public sector information.

text: 2 | P a g e

text: Executive Summary

text: The Public Sector Information (PSI) Directive aims to facilitate the re-use of public sector information throughout the European Union by harmonising the basic conditions that make PSI available to re-users, to enhance the development of Community products and services based on PSI and to avoid distortions in competition.

text: The new provisions include the extension of the scope of the Directive to documents held by public undertakings active in the areas on procurement such as entities operating in the water, energy, transport and postal services sectors. Moreover, it applies to documents held by public undertakings acting as public services operators, as long as such documents are produced as part of the services in the general interest. In addition, the Proposal’s scope will also be extended to specific research data such as results of scientific fact-finding processes.

text: The Opinion focuses on specific recommendations in order to better clarify the relation and coherence of the PSI Directive with the GDPR exceptions and on the reference to applicable data protection law. Additionally it provides for further recommendations on anonymisation and its relation to costs and data protection, also focusing on a data protection impact assessment, while taking into account an ‘acceptable re-use policy’.

text: The EDPS with this Opinion on PSI re-use builds on the work already done on the ‘Good

text: Big Data’ (the ‘EU values-based data sharing’), and notably on EDPS opinions and

text: formal comments previously issued, consistently with our practice on supervision cases. Moreover, we point out to the issues that need harmonization at EU level to allow the recast of the PSI Directive to rip the expected benefits.

text: the relationship and coherence of the PSI with the GDPR by putting forward a drafting

text: suggestion.

text: Moreover, the EDPS suggests to re-introduce the specific provision currently contained in Article 1(4) of the Directive

text: in the main provisions of the Directive and to clealry state in the Proposal that the definition of ‘personal data’ according to

text: Article 4(1)

text: of the GDPR applies. The EDPS also recommends to add the reference to the

text: The EDPS also recommends to support the use of anonymisation by making a reference to ‘anonymous information’ in the legal text and extending the scope of the entities entitled to include anonmysation costs within the costs that can be charged to reusers.

text: As a last recommendation, the EDPS suggests to provide for data protection impact assessments, for specific sectors dealing with sensitive data, such as the health sector, on which the licensor should base its decision and consequently take into account the conditions for re-use.

text: 3 | P a g e

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty of the Functioning of the European Union, and in particular

text: Article 16

text: thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles

text: and

text: thereof, Having regard to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) , Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular

text: Article 41(2)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction and background

text: 1. On 25 April 2018, the Commission adopted a Proposal for a Directive amending Directive

text: (following a review of Directive

text: ) on the re-use of public sector information (PSI) (the ‘Proposal’). The Proposal is part of the ‘2018 Data Package’, which also includes other important documents: (i) a Commission Communication entitled “Towards a common European data space” (the ‘Communication’); (ii) Guidance on sharing private sector data, in the form of a Staff Working Document (‘Guidance’); and (iii) an evaluation of the PSI Directive.

text: 2. The objective of the Proposal is to update and amend the existing text of Directive

text: and Directive

text: on re-use of public sector information (the PSI Directive).

text: 3. The review of the Directive is one of the three ‘measures’ proposed by the Commission towards a common data space in the EU (see the ‘umbrella’ Communication from the Commission COM (2018) 232, hence ‘the Communication’), together with the Guidance on sharing private sector data [...] and the update of the Recommendation on access to and preservation of scientific information [...].

text: 4. In proposing to amend the PSI Directive, the European Commission aims to facilitate the re-use of public sector information such as legal, traffic, meteorological, economic and financial data throughout the European Union by harmonising the basic conditions that make PSI available to re-users, to enhance the development of Community products and services based on PSI and to avoid distortions in competition.

text: 5. In particular, the Proposal’s overall objective is to be in line with the Digital Single Market Strategy’s objectives. The Proposal aims to enhance the effect of the Directive by strengthening specific provisions and modifying them accordingly in order to 5 | P a g e increase the amount of public sector data available for re-use. Specifically, the initiative also aims to strengthen Small and Medium Enterprises’ position in the data market by granting fairer competition and an easier access to markets, together with the enhancement of cross-border innovation.

text: 6. Relevant new provisions to the Directive include the extension of its scope to documents held by public undertakings active in the areas on procurement by entities operating in the water, energy, transport and postal services sectors. Moreover, it applies to documents held by public undertakings acting as public services operators, as long as such documents are produced as part of the services in the general interest. The proposal’s scope will also be extended to specific research data such as results of scientific fact-finding processes (i.e. experiments and surveys). The Proposal in practice “(...) lays down a horizontal framework providing minimum harmonisation of reuse conditions across domains and sectors.”

text: 7. The EDPS positively notes that according to the European Commission the recast of the PSI Directive aims to foster the reuse of public sector information, as pointed out in the Communication, by “reducing market entry barriers, in particular for small and medium-sized enterprises; minimising the risk of excessive first-mover advantage, which benefits large companies and thereby limits the number of users of the data in question; increasing business opportunities by encouraging the publication of dynamic data and the uptake of application programming interfaces (APIs).”

text: 8. The PSI directive is part of the EU vision on the fostering of “Good Big Data”. Public sector information is a key source of “the raw material” of the Big Data of the Digital Single Market. The smart use of data, including its processing via Artificial Intelligence, can have a transformative effect on all sectors of the economy.

text: 9. Already in September 2016, the EDPS, with the Opinion on coherent enforcement of fundamental rights in the age of big data , has put forward a strategy for shaping an EU cyberspace based on EU values, pointing out to issues such as concentration of market and informational power; and a weak market for Privacy Enhancing Technologies (‘PETs’) as measures for minimising personal data processing without losing the functionality of a product or a service (as inspired by the principle of privacy by design and by default).

text: 10. Moreover, the EDPS would like to recall the data protection-relevance of the ‘key principles’ that, according to the European Commission, should be respected in the context of data re-use, namely (i) minimised data lock-in and ensure undistorted competition; (ii) transparency and societal participation on the purpose of the reuse vis-à-vis the citizens/data subjects as well as transparency and clear purpose definition between the licensor and the licensees; (iii) data protection impact assessment and appropriate data protection safeguards for reuse (according to a ‘do no harm’- under the data protection viewpoint- principle).

text: 11. While the EDPS has been informally consulted by the European Commission, it has not been formally consulted as required by

text: Article 28 (2) of Regulation (EC) No 45/2001

text: . The Opinion is therefore based on Article 41(2) of the same Regulation. The EDPS recommends that a reference to this Opinion be included in the preamble of the adopted instrument. 6 | P a g e

text: 12. As a preliminary remark, the EDPS welcomes the provision under

text: Article 1(2)

text: (g) of the Proposal which excludes the re-use of documents on grounds of data protection. The EDPS particularly appreciates the fact that the draft Proposal underlines that not all data which is accessible under relevant access regimes will also be automatically available for re-use. Such an interpretation had already been given by the

text: Article 29

text: Working Party in its Opinion , which the EDPS fully supports.

text: 13. In particular, under

text: Article 1(2)

text: (g), the Proposal provides for an exception from the scope of the PSI Directive on grounds of data protection, by stating that the Directive would not apply to “ documents access to which is excluded or restricted by virtue of the access regimes on the grounds of protection of personal data, and parts of documents accessible by virtue of those regimes which contain personal data the reuse of which has been defined by law as being incompatible with the law concerning the protection of individuals with regard to the processing of personal data”.

text: 14. While the EDPS appreciates the intention behind this wording, we also take note that it might not be sufficiently clear and lead to challenges in interpreting the law. In particular, we consider that the legal text could be simplified and rephrased by distinguishing the two types of documents at stake and by simplifying the reference to the incompatibility with data protection law.

text: 15. The EDPS recalls the wording set out in

text: Article 4(1)

text: (b) of Regulation EC No 1049/2001 providing that the European institutions shall refuse access to a document where such disclosure “would undermine the protection of privacy and integrity of the individual, in particular in accordance with [Union] legislation regarding the protection of personal data”. In line with such wording, the Article could be rephrased so to create better legal certainty and consistency. provide for specific wording on the difference between ‘documents’ and ‘parts of documents’ to which the PSI Directive would not be applicable on data protection grounds. This would better clarify the relationship and coherence of the PSI Directive with the GDPR. Moreover, it could specifically and more consistently refer to ‘regimes which contain personal data the re-use of which’ could undermine the fundamental right to privacy and the protection of personal data.

text: 17. As a minor recommendation, the EDPS suggests to add a reference to the Proposal, to further enhance the link between the re-use of public sector information and the protection of personal data. 7 | P a g e

text: 3. Reference to applicable data protection law

text: 18. The EDPS welcomes the reference to data protection law provided for in Recital 47 of the Proposal. In particular, we take note that the same recital provides for reference, both with regards to data protection legislation and data anonymisation.

text: 19. However, we also note that the Proposal does not mention data protection Union law in any of the main substantive provisions of the legislative draft. While Article 1(4) of the current Directive

text: contains a well-informed statement on the application of data protection law to the re-use of public sector information, the Proposal provides for a deletion of the same article.

text: 20. Although the EDPS appreciates the intention of inserting specific reference to data protection Union law in recital 47 of the current Proposal, we believe that the wording contained in

text: Article 1(4) of Directive 2013/37/EU

text: should not disappear from the substantive provisions of the Directive. Indeed, maintaining a clear provision on the applicability of Union legislation on data protection would enhance legal certainty and contribute to the consistency of the overall regulatory framework.

text: 21. More specifically, a provision should be re-introduced in the Proposal to underline that the Directive would “leave intact and in no way affect the level of protection of individual with regard to the processing of personal data under the provisions of Union and national law” and that it would not “alter any obligations and rights set out in” the data protection legislation currently in force, thus providing for better legal certainty and guaranteeing that fundamental rights are not undermined.

text: 22. Therefore, considering that the provision currently in place grants legal certainty and consistency with the data protection legal framework, the EDPS recommends to re-

text: in the substantive part of the Proposal (including the necessary update of references to the legal instruments currently in force).

text: 4. Anonymisation of personal data

text: 23. In its previous Opinion on the 2013 PSI Directive the EDPS had recommended to provide for an exception in order to allow public sector bodies to charge re-users the reasonable expenses they incur in to pre-process, aggregate and/or anonymise the personal data offered for re-use, in situations where the use of such techniques would be justified in light of the increased risks deriving from offering such data for re-use. In fact, in certain cases, the anonymisation of exisiting documents held by public sector bodies, can be a complex, time-consuming and expensive tasks shich require expertise that might not always be available.

text: 24. The EDPS welcomes that his informal comments have been taken into account regarding anonymisation. Recitals 32 and 33 of the Proposal, together with

text: Article 6

text: , paragraphs (1), (3) and (4) provide for specific reference to anonymisation costs and to a clear distinction between ‘anonymisation of personal data’ and ‘anonymisation of commercially confidential information’. 8 | P a g e

text: 25. However, the EDPS also notes that the provisions set out in

text: Article 6(1)

text: and (2) of the Proposal seem to limit the possibility to charge such costs to only some of the organisations falling under the scope of the PSI Directive, particularly to (i) public sector bodies that are required to generate revenue to cover a substantial part of their costs in relation to the performance of their public task, (ii) libraries, museums and archives and (iii) public undertakings. The EDPS considers that this possibility should be available to all organisations falling within the scope of the PSI Directive. Therefore, the EDPS would suggest to allow every organisation falling within the scope of the Proposal to charge costs of anonymising the information.

text: 26. Given the importance of anonymisation as a means of finding a balance between the interests in making public sector information re-use possible and the various obligations under data protection legislation, the EDPS notes that the draft Proposal could contain a reference to ‘anonymous information’ as defined in Recital 26 of the GDPR, “(...) namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable”. Therefore, the EDPS suggests to include a reference to ‘anonymous information’ in the Proposal, in order to better clarify its meaning and application.

text: 27. The EDPS finally underlines that the re-use of anonymised public source information (extended by the recast Proposal of the PSI Directive to the providers of public services) is a way to foster the use of big data in a pro-competitive perspective while also meeting the data protection requirements.

text: 28. As a reference to the last point, the EDPS would also like to point out some best practices with reference to the re-use of anonymised data in the public sector. In particular, the European Medicines Agency (EMA) has developed extensive guidance for industry to facilitate compliance with this policy. Moreover, we also refer to the European Statistical System (ESS) which provides its statistics free of charge as a public good of high quality irrespective of subsequent commercial or non-commercial use. The ESS subscribes to an open, free access and re-use policy for its publicly released statistics in line with the PSI Directive.

text: 5. Blurring distinction between personal and non-personal data

text: 29. The EDPS notes that Article 2(5) of the current Directive

text: providing for a definition of ‘personal data’ has been deleted from the current draft Proposal. However, given the subject and the scope of the PSI Directive together with the growing number of situations where making a clear distinction between personal and non-personal data, the EDPS recommends to clearly state in the Proposal that the

text: 30. Moreover, when referring to personal data, the EDPS would like to recall his recently published comments regarding the Proposal for a Regulation on the free flow of nonpersonal data . As referred to in the published document, “[w]ithin the context of a rapidly growing data-intensive society, users or the machines they own produce more and more data every day and where the possibility to single out a person on the basis 9 | P a g e of very few data points is becoming easier (...).” It is therefore essential to highlight the particular challenges that might arise when trying to differentiate the two types of data.

text: 31. Consequently, the EDPS would like to draw attention to the fact that while much of the data already today and increasingly in the future is generated and processed by machines, such data are often likely to fall within the scope of the definition of personal data. In this view, the EDPS calls upon the European legislator when drafting new PSI legislation having an impact on personal data to keep in mind that in any case, the data subjects’ fundamental rights to privacy and data protection must be fully ensured.

text: 6. Data Protection Impact Assessment

text: 32. Since ensuring the free flow of personal data is one of the objectives of EU data protection law, the EDPS considers that -rather than (trying to) define a kind of ‘facilitated highway’ for ‘non personal’ data- the legislator should better address stakeholder concerns related to the necessary protection of personal data, especially in sensitive sectors such as the health sector, when they take the decision on the reuse of PSI.

text: 33. For this reason, we make recommendations (some of them are expressed as wording suggestions to be integrated in the legal text of the PSI directive) on: (i) the data protection impact assessment on which, especially for some “sensitive sectors” (health sector, but also transport or energy grids), should be based the decision by the licensor on the reuse (for example, clarifying the risks of re-identification of anonymised data and the safeguards against those risks); (ii) taking into account the DPIA, the conditions for data re-use (the “acceptable reuse policy”).

text: 34. Therefore, the EDPS recommends licensors to perform data protection impact assessments, in particular for specific sectors routinely dealing with special categories of personal data, such as the health sector, or other “sensitive” data, when taking the decisions on the scope and conditions for the re-use.

text: 7. Conclusion

text: Therefore the EDPS recommends:

text:  to modify

text: Article 1(2)

text: (g) of the Proposal and to provide for specific wording on the difference between ‘documents’ and ‘parts of documents’ to which the PSI Directive would not be applicable on data protection grounds.

text:  to add a reference to the Supervisory Autority set up by Article 51 of the GDPR under Article 4(4) of the Proposal, in order to further enhance the link between the re-use of public sector information and the protection of personal data.

text: 10 | P a g e

text:  to re-introduce the specific provision on applicable data protection law currently

text: Proposal (including the necessary update of references to the legal instruments currently in force).  to further point out to the use of anonymisation in the context of the reuse of public sector information by including a reference to ‘anonymous information’ in the legal text and extending the scope of the entities entitled to include anonmysation

text: costs within the costs that can be charged to reusers.

text:  to clearly state in the Proposal that the definition of “personal data” according

text:  to provide for data protection impact assessments, for specific sectors dealing with sensitive data, such as the health sector, on which the licensor should base its decision and consequently take into account the conditions for re-use.  As a last comment, in putting forward these recommendations, the EDPS stresses the data protection-relevance of the following ‘key principles’, that according to the Commission should be respected in the context of data re-use, namely:

text: (i) Minimised data lock-in and ensure undistorted competition;

text: (ii)Transparency and societal participation on the purpose of the reuse vis-à-vis the citizens/data subjects as well as transparency and clear purpose definition between the licensor and the licensees;

text: (iii) Data protection impact assessment and appropriate data protection safeguards for reuse (according to a ‘do no harm’ -under the data protection viewpointprinciple).

text: 11 | P a g e

text: Brussels, Giovanni BUTTARELLI 12 | P a g e

text: Notes

text: 13 | P a g e

type: vagledning

utgivare: edps


text: OJ L 119, 4.5.2016, p. 1. OJ L 295, 21.11.2018, p. 39 (hereinafter “Regulation No 2018/1725”) Proposal COM(2018)378 final (hereinafter the “taking of evidence proposal”) and proposal COM (2018)379 final (hereinafter the “service of documents proposal”). Explanatory memorandum, p. 2. Commission work programme 2018: an agenda for a more united, stronger and more democratic Europe (COM(2017)650 final, 24.10.2017), Annex II, points 10 and 11. Commission Staff working documents SWD(2018)285 and SWD(2018)287. Explanatory memorandum of the taking of evidence proposal, p. 3 and of the service of documents proposal, p.4:“[w]hile in principle nothing prevents Member States from digitalising the way they communicate, past experience and projections of what will happen without EU action show that progress would be very slow and that, even where Member States take action, interoperability cannot be ensured without a framework under EU law. The objective of the proposal cannot be sufficiently achieved by the Member States themselves and can be achieved only at Union level”. P8_TA(2019)0103 and P8_TA(2019)0104. Outcome of the Council meeting (9970/19), p. 7, provisional version available at: https://www.consilium.europa.eu/media/39709/st09970-en19.pdf According to the Presidency Paper (9566/19), par. 8 and 13, “in the Commission Impact Assessments accompanying both proposals, e-CODEX is considered the most suitable and only readily available IT system. The development of another decentralised system would mean that the same challenges already addressed in the context of the development of the e-CODEX would be addressed once again”. “One of the existing solutions is e- CODEX, a system developed with EU financial support by a consortium of Member States over a period of almost ten years. E-CODEX is currently used for the following: Business Registers Interconnection System (BRIS); the interconnection of national insolvency registers; the e-Evidence Digital Exchange System. However, insofar as use cases based on voluntary cooperation are concerned, e-CODEX is not yet implemented and used by all the Member States. In this context, during the discussions in the Working Party, for the Member States where there are currently no IT systems that support electronic procedures, the Commission could consider the development of a reference implementation solution for a back-end system at national level, provided that there is sufficiently strong and broad delegations' support for mandatory electronic communication. All systems would have to be technically interoperable and compliant with the same set of technical specifications (protocols, standards, XML

text: schemas and workflows).”

text: See EDPS Opinion on the Commission Decision of 12 December 2007 concerning the implementation of the Internal Market Information System (IMI) as regards the protection of personal data (

text: ), OJ 2008/C 270/01, par. 20-22: “Based on the case-law under the ECHR, there should be no doubt about the legal status of provisions restricting fundamental rights. Those provisions must be laid down in a legal instrument, on the basis of the EC Treaty, which can be invoked before a judge. If not, the result would be legal uncertainty for the data subject since he cannot rely on the fact that he can invoke the rules before a Court. 21. The issue of legal certainty is even more eminent since under the system of the EC Treaty it will be primarily the national judges who will have discretion to decide which value they attach to the IMI Decision. This might lead to different outcomes in different Member states and even within one Member State. This legal uncertainty is not acceptable. 22. The absence of (security about) a legal remedy would be in any event contrary to Article 6 of the ECHR which provides for the right of a fair trial, and the case law on this Article. In such a situation, the Community would not fulfil its obligations under Article 6 of the Treaty on the European Union (‘TEU’), which requires the Union to respect fundamental rights, as guaranteed by the ECHR.” Taking of evidence proposal, p. 6 and service of documents proposal, p. 9 and 10. OJ L 257, 28.8.2014, p. 73. Taking of evidence proposal, p. 6 and service of documents proposal, p. 9 and 10. In case of use of publicly available electronic communications services, the requirements of Directive

text: of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ L 201, 31.7.2002, p. 37) would apply. See new

text: Article 18

text: a introduced by Article 1(12) of the service of documents proposal. See new

text: Article 15

text: a introduced by Article 1(10) of the service of documents proposal. See new

text: Article 17

text: a introduced by Article 1(4) of the taking of evidence proposal.

text: See also Working Party 29 Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679 (wp248rev.01), footnote 21: “ When a DPIA is carried out at the stage of the elaboration of the legislation providing a legal basis for a processing, it is likely to require a review before entry into operations, as the adopted legislation may differ from the proposal in ways that affect privacy and data protection issues. Moreover, there may not be sufficient technical details available regarding the actual processing at the time of adoption of the legislation, even if it was accompanied by a DPIA. In such cases, it may still be necessary to carry out a specific DPIA prior to carrying out the actual processing activities.” See also EDPS “Accountability on the ground Part I: Records, Registers and when to do Data Protection Impact Assessments”, p. 10: “[...] even where a DPIA according to the standards of the Regulation was carried out at the stage of the proposal for the legal basis, it would very likely require a review before entry into operations. The reason is that the adopted legal basis may differ from the proposal in ways that affect the impact on privacy and data protection. Additionally, it is usually not the case that all design choices with an impact on privacy and data protection are already determined by the legal basis. In practice, such DPIAs in the legislative process can at most be the first iteration of the DPIA process”. With regard to the proposed digitalisation measures and their impact on fundamental rights, the explanatory memorandum of the taking of evidence proposal further explains that “the system to be introduced for electronic exchanges between the designated courts should feature a fully reliable and secure technical solution that ensures the integrity and privacy of the transmitted data. A pre-defined set of users of the system (only Member States’ courts and judicial authorities) gives an additional guarantee that personal data will be handled appropriately. Furthermore, the system should introduce a decentralised structure, enabling communication directly between its end-points and thus reducing risk by minimising the number of data processors” (p. 6. [emphasis added]). The explanatory memorandum of the service of documents proposal underlines that: “the proposed change towards using electronic communication is expected to have an effect on the protection of personal data (Article 8 of the Charter). Technical implementation and operation of the electronic infrastructure would be determined and controlled by Member States themselves, even if the infrastructure is partially developed and financed at the EU level. The infrastructure should be based on a decentralised architecture. Data protection requirements would therefore apply exclusively at national level for the different procedures” (p. 9. [emphasis added]). It further explains that such system “would ensure the safe electronic communication and exchange of documents between the users of the decentralised IT system, and it would provide for automatic recording of all steps of the workflow. It would also have security features to ensure that only authorised participants with verified identities may use the system” (p. 8). See Articles 2(2), 3 and 22 of the taking of evidence Regulation. Under the taking of evidence proposal, it is proposed to define “court” as “any judicial authority in a Member State which is competent for the performance of taking of evidence according to this Regulation” (addition of a paragraph 4 to Article 1 of the Regulation) so as to clarify that it includes for instance notaries public if empowered under national law to perform tasks of taking of evidence (explanatory memorandum, p. 8). According to Article 2 of the service of documents Regulation, these agencies are the public officers, authorities or other persons competent for the transmission of judicial or extrajudicial documents to be served in another Member State and for the receipt of such documents from another Member State. They are designated by the Member States. The information is communicated to the Commission and published on the OJEU (see Article 23 of the Regulation and Article 1(3) of the service of documents proposal inserting a new

text: Article 3

text: a (1)). See list of indicators in the taking of evidence impact assessment, p. 40 and the service of documents impact assessment, p. 54.

identifier: EDPS yttrande 05/2019

amnesord:
Charter of Fundamental Rights
General Data Protection Regulation
Judicial Cooperation
Privacy in the EU Institutions
IT at Work

title: Service of documents and taking of evidence in civil or commercial matters

text: 13 September 2019 1 | P a g e

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’. Under Article 57(1)(g) of Regulation 2018/1725, the EDPS shall ‘advise on his or her own initiative or on request, all Union institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data’.

text: He was appointed in December 2014 together with the Assistant Supervisor with the specific remit of being constructive and proactive. The EDPS published in March 2015 a five-year strategy setting out how he intends to implement this remit, and to be accountable for doing so.

text: This Opinion provides advice on two Commission proposals for the revision of the Regulations on the service of documents and the taking of evidence in civil or commercial matters, in particular with regard to the use of an IT system for their purposes.

text: 2 | P a g e

text: Executive Summary

text: On 31 May 2018, the European Commission issued two proposals for a Regulation of the European parliament and the Council amending

text: Council Regulation (EC) No 1206/2001 of 28 May 2001

text: on cooperation between the courts of the Member States in the taking of evidence in civil or commercial matters, on the one hand and a Regulation amending

text: Regulation (EC) No 1393/2007

text: of the European Parliament and of the Council on the service in the Member States of judicial and extrajudicial documents in civil or commercial matters, on the other hand. The proposals mainly aim at improving the smooth functioning of judicial cooperation in these areas, by inter alia providing for transmission of documents and taking of evidence requests through a decentralised IT system.

text: The EDPS acknowledges that exchanges of personal data are necessary elements of the creation of an area of Freedom, Security and Justice. Therefore he welcomes the overall objectives of the proposals to improve the efficiency of judicial cooperation in civil or commercial matters in relation to the taking of evidence and the service of documents, in particular through digitalisation and the use of IT technology. He shares the view that the proposed legislation could have a real impact on the everyday lives of EU citizens.

text: This Opinion makes three main recommendations in order to constructively assist the legislators in achieving this very important objective while ensuring compliance with the Charter and the GDPR:

text: - providing a clear legal basis for the IT system which would be used for the transmission of documents, requests and communications for the purposes of these Regulations. In particular, in case the IT system would entail the involvement of an EU institution, body, agency or office, this legal basis should in principle be provided in an EU legislative act. Also, even in case the processing of personal data would take place in the framework of an existing IT system, the EDPS recommends providing for the use of such system in the legislative act itself. However, the existing system envisaged to be used should itself be duly established on the basis of a legal act adopted at EU level, which is currently not the case of e-CODEX. Should the EU legislator choose the e-CODEX solution, the lack of a legal instrument at EU level establishing and regulating the system should be remedied without delay.

text: - including in the legislative acts themselves a high level description of the IT system aspects, such as data protection responsibilities or relevant applicable safeguards, to be further defined in implementing acts. In particular, to the extent the Commission or another EU institution, body, agency or office would be implicated in the operation of the new system, the legal act should ideally define its responsibilities as a (joint) controller or a processor.

text: - conducting an impact assessment on data protection when preparing the implementing acts.

text: Further detailed recommendations are provided by the EDPS in this Opinion.

text: The EDPS remains at the disposal of the institutions for further advice during the legislative process and at the implementing phase of the Regulations once adopted.

text: 3 | P a g e

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular

text: Article 16

text: thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles

text: and

text: thereof, Having regard to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) , Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: , in particular Articles

text: (g) and 58(3)(c) thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction and background

text: 1. On 31 May 2018, the Commission adopted two proposals for a Regulation of the European parliament and the Council that would amend: 

text: on cooperation between the courts of the Member States in the taking of evidence in civil or commercial matters (hereinafter the “taking of evidence Regulation”); 

text: Regulation (EC) No 1393/2007

text: of the European Parliament and of the Council on the service in the Member States of judicial and extrajudicial documents in civil or commercial matters (hereinafter the “service of documents Regulation”).

text: 2. The taking of evidence Regulation, which has applied since 2004, provides for two ways of taking of evidence between Member States: taking of evidence through the requested court and the direct taking of evidence by the requesting court.

text: 3. The service of documents Regulation, which has applied since 2008, provides for different ways of transmitting documents from one Member State to another, for purposes of service in the latter, through transmitting and receiving agencies or through transmission by consular or diplomatic channels. It also sets uniform legal conditions for serving a document by post directly across borders and provides for a direct service through the competent person of the Member State addressed where permitted under the law of that Member State. It includes certain minimum standards on the protection of the rights of defence. The application of the Regulation “is not restricted to proceedings before civil tribunals, because its scope covers also ‘extrajudicial’ documents, the service of which may arise in various out-of-court proceedings (e.g. in succession cases before a public notary, or in family law cases before a public authority), or even in the absence of any underlying judicial proceedings” . 5 | P a g e

text: 4. The proposals are included in the Commission’s 2018 work programme under REFIT initiatives in the area of justice and fundamental rights based on mutual trust . The proposals are accompanied by an impact assessment .

text: 5. Both proposals provide for the transmission of documents, requests and communications through a mandatory decentralised IT system composed of national IT systems interconnected by a communication infrastructure enabling the secure and reliable crossborder exchange of information between the national IT systems. They also provide for the application of

text: Regulation (EU) No 910/2014

text: on electronic identification and trust services for electronic transactions in the internal market .

text: 6. On 13 February 2019, the European Parliament adopted its legislative resolutions on both proposals at first reading , inter alia agreeing on the establishment of a decentralised IT system, providing that such system be based on e-CODEX and that the implementation of such system be ensured via delegated acts.

text: 7. On 6 June 2019, a policy debate took place in Council. The presidency concluded that “the Council confirmed the need to modernise our processes when it comes to judicial cooperation in civil and commercial matters. The presidency noted the preference expressed for a decentralised and secured IT system. It added that ministers could accept mandatory use of the system only with certain conditions, including a longer transition period and with a backend reference system to be provided by the Commission. A list of necessary exceptions will also have to be considered. Finally, the presidency noted that e- CODEX could be the software solution to be used for that purpose. Further work will have to be conducted at technical level” .

text: 8. On 23 April 2019, the Commission has submitted a request for consultation to the European Data Protection Supervisor (hereinafter the “EDPS”) in order to assess the conformity of both proposals with the General Data Protection Regulation (hereinafter the “GDPR”). The EDPS welcomes the consultation by the Commission.

text: 2. Recommendations

text: 2.1. Legal basis

text: 9. The EDPS acknowledges that exchanges of personal data are indispensable for the creation of an area of Freedom, Security and Justice. Therefore he welcomes the overall objectives of the proposals to improve the efficiency of judicial cooperation in civil or commercial matters in relation to the taking of evidence and the service of documents, in particular through digitalisation and the use of IT technology. He shares the view that such legislation may have a real impact on the everyday lives of EU citizens.

text: 10. The EDPS recalls that any establishment of a new IT system processing personal data as well as its essential elements require a legal basis . He stresses in particular that where such IT system entails the involvement of an EU institution, body, agency or office, this legal basis should in principle be provided in an EU legislative act.

text: 11. Also, even in case the processing of personal data would take place in the framework of an existing IT system, the EDPS recommends providing for the use of such system in the 6 | P a g e legislative act itself. However, the existing system envisaged to be used should itself be duly established on the basis of a legal act adopted at EU level, which is currently not the case of e-CODEX. Should the EU legislator choose the e-CODEX solution, the lack of a legal instrument at EU level establishing and regulating the system should be remedied without delay. 2.2. Legislative acts

text: 12. The EDPS recommends including in the legislative acts a high level description of the IT system aspects to be further defined in implementing acts. These elements, based on an assessment of the risks for the fundamental rights of the individuals, should cover at least data protection responsibilities (i.e. the roles of controller, joint controller, processor, as appropriate) as well as relevant applicable safeguards, including those to ensure the security of the personal data processed. Respect for data protection is not only a legal obligation but also a key element for success of the envisaged system, e.g. ensuring quality of data exchanges. 2.2.1. Principles of data protection by design and by default

text: 13. The explanatory memorandum of both proposals underlines that “[i]mportant external factors with regard to the protection of personal data in the context of the proposed policy package are: – the General Data Protection Regulation (GDPR), applied as of May 2018, which should increase awareness and prompt action to ensure the security and integrity of databases, and swift reactions to breaches of privacy in the judiciary; (...)” . As the GDPR is applicable to the processing of personal data for the purposes of judicial cooperation in civil or commercial matters under both Regulations, the EDPS recommends applying its principles already at the stage of setting up the IT system, in particular the principles of data protection by design and by default set out in Article 25 of the GDPR.

text: 14. In this regard, the EDPS welcomes the identification of a high-level architecture of the system in the legislative acts themselves and the obligation of a reliable exchange of information as well as the need to use trust services as defined in

text: Regulation (EU) No 910/2014

text: of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive

text: . He recalls that the choice of the IT system architecture minimising the impact on data protection should be made based on an assessment of the risks for the individuals whose data are processed, rather than on what architecture minimises possible responsibilities of the Member States or EU institutions. Unless there is a specific need for centrally based functionalities, a decentralised architecture might indeed, in general, avoid single points of failure and support the data minimisation principle.

text: 15. The explanatory memorandum of both proposals underlines that the other important external factor to take into account is the “persistent threats to cybersecurity in the public sector. Attempted attacks on public IT infrastructure are expected to proliferate and to affect the judiciary in the Member States; their impact may be exacerbated by the growing interconnectedness of IT systems (nationally and at EU level)” . It is utterly important that the data processed in this IT system are protected against any possible attackers and security incidents. In particular, with regard to the taking of evidence proposal, the EDPS recommends being more specific on the required appropriate safeguards to ensure 7 | P a g e the security of the videoconference . These safeguards should be further detailed in the implementing act (see section 2.3. below). 2.2.2. Definition of responsibilities

text: 16. The EDPS underlines that the choice of a decentralised architecture automatically entails that the Member States are responsible for the civil or commercial records databases and the processing of personal data within these databases. More specifically, the authorities of the Member States are the controllers of the record databases that they are responsible for. As such, they are responsible for the content of the databases and for the integrity of the information that is exchanged. It is essential to ensure that responsibilities with regard to compliance with data protection rules are clearly defined and allocated.

text: 17. Whereas the proposals aim at establishing a high level architecture for the planned IT system, it does not define governance and high level roles and responsibilities of the Member States and of the Commission (if any). These roles and responsibilities are however essential for assigning the controller role and relevant obligations under the applicable data protection law. To the extent the Commission or another EU institution, body, agency or office would be implicated in the operation of the new system, the legal act should ideally define its responsibilities as a (joint) controller or a processor. The EDPS therefore strongly recommends defining governance and high level roles and responsibilities of the Member States and of the Commission or any other EU institution, body, agency or office (if any) in the legislative act. In case there would be a role for the Commission or any other EU institution, body, agency or office in the processing of these data, Regulation No 2018/1725 would be applicable to such processing.

text: 18. In case of joint controllership, obligations of Article 26 of the GDPR or Article 28 of Regulation No 2018/1725 would apply and the relationship among joint controllers and the content of the mandatory arrangements among them should be defined in the implementing acts. 2.3. Implementing acts

text: 19. The EDPS notes that only the service of documents proposal foresees the adoption of an implementing act for the establishment of the decentralised IT system . He therefore recommends providing for such implementing act in both proposals.

text: 20. Such implementing acts should lay down important elements of the system in more detail. They should also help ensure compliance with data protection requirements by further specifying necessary safeguards to be implemented in the IT system. Consequently, the EDPS recommends providing in the legislative acts for the implementing act to cover also the new provisions on electronic service and on direct taking of evidence by videoconference .

text: 21. As the impact assessments accompanying the proposals do not contain any in depth analysis of the impact of these proposals on data protection, the EDPS strongly recommends the Commission to conduct an impact assessment when preparing the implementing acts. This is without prejudice to obligations of controllers under the GDPR and, as the case may be, Regulation No 2018/1725, to in particular conduct a Data Protection Impact Assessment 8 | P a g e as provided for under Article 35 of the GDPR or Article 39 of Regulation No 2018/1725, should the conditions be fulfilled .

text: 22. Furthermore, from the explanatory memorandum of both proposals , the EDPS understands that the future IT system might be the same for both of them and that its access would be limited to specific users: for the taking of evidence proposal, the number of users would be limited to the courts , central authorities and competent authorities within the meaning of the Regulation, as communicated by the Member States while for the service of documents proposal, the number of users would be limited to transmitting and receiving agencies and central bodies designated by the Member States. The EDPS recommends that safeguards ensuring an access to a limited number of authorised users be specified in the implementing acts.

text: 23. Finally, the proposals would introduce a new

text: Article 23

text: a to the service of documents Regulation and a new

text: Article 22

text: a to the taking of evidence Regulation according to which Member States shall provide the Commission with the data and other evidence necessary for the monitoring programme that the Commission shall establish by two years after the date of application of the Regulations. The EDPS understands that these monitoring programmes would entail the collection of statistical data and recommends that the statistical elements to be collected be defined in further detail as far as possible in the implementing acts.

text: 3. Conclusions

text: 24. The EDPS welcomes the overall objectives of the proposals to improve the efficiency of judicial cooperation, in particular through digitalisation and the use of IT technology, in relation to the taking of evidence and the service of documents in civil or commercial matters. Therefore, this Opinion aims at providing constructive and objective advice to the EU institutions.

text: 25. The EDPS welcomes the identification of a high-level architecture of the system in the legislative act itself and the obligation of a reliable exchange of information as well as the need to use trust services as defined in

text: Regulation (EU) No 910/2014

text: 26. There are three major recommendations the EDPS makes to ensure compliance with the Charter and the GDPR:  providing a clear legal basis for the IT system which would be used for the transmission of documents, requests and communications for the purposes of these Regulations. In particular, in case the IT system would entail the involvement of an EU institution, body, agency or office, this legal basis should in principle be provided in an EU legislative act. Also, even in case the processing of personal data would take place in the framework of an existing IT system, the EDPS recommends providing for the use of such system in the legislative act itself. However, the existing system envisaged to be used should itself be duly established on the basis of a legal act adopted at EU level, which is currently not the case of e-CODEX. Should the EU legislator choose the e- CODEX solution, the lack of a legal instrument at EU level establishing and regulating the system should be remedied without delay. 9 | P a g e  including in the legislative acts themselves a high level description of the IT system aspects, such as data protection responsibilities or relevant applicable safeguards, to be further defined in implementing acts. In particular, to the extent the Commission or another EU institution, body, agency or office would be implicated in the operation of the system, the legal act should ideally define its responsibilities as a (joint) controller or a processor.  conducting an impact assessment on data protection when preparing the implementing acts.

text: 27. The EDPS also recommends:  providing in both legislative acts for an implementing act to further detail the IT system and that the implementing acts cover the new provisions on electronic service and on direct taking of evidence by videoconference so as to include specific safeguards also on these processing operations.  in case of joint controllership, defining in the implementing acts the relationship among joint controllers and the content of the mandatory arrangements among them.  specifying in the implementing acts safeguards ensuring an access to a limited number of authorised users.  defining in further detail as far as possible the statistical elements to be collected in the implementing acts.

text: 28. Finally, the EDPS remains at the disposal of the Commission, the Council and the European Parliament to provide advice at further stages of this process. The recommendations made in this Opinion are without prejudice to any additional comments that the EDPS could make as further issues may arise. He recalls that, in accordance with Article 42(1) of Regulation No 2018/1725, the Commission has the obligation to consult the EDPS when preparing implementing or delegated acts having an impact on the protection of individual’s rights and freedoms with regard to the processing of personal data. The EDPS expects therefore to be consulted later on the provisions of the draft implementing or delegated acts in this respect. Brussels, 13 September 2019 Wojciech Rafał WIEWIÓROWSKI 10 | P a g e

text: Notes

text: 11 | P a g e

text: 12 | P a g e