text: This Opinion relates to the EDPS' mission to advise the EU institutions on the data protection implications of their policies and foster accountable policymaking - in line with Action 9 of the EDPS Strategy: ‘Facilitating responsible and informed policymaking’.

text: Executive Summary

text: On 5 July 2016, the Commission published a set of proposed amendments to the AML Directive and to Directive

text: that aim at tackling directly and incisively tax evasion, in addition to anti-money laundering practices, in order to establish a fairer and more effective tax system. This Opinion assesses the data protection implications of such amendments.

text: In general, they seem to take a stricter approach than before to the problem of effectively countering anti-money laundering and terrorism financing. In this respect, among other measures proposed, they focus on new channels and modalities used to transfer illegal funds to the legal economy (e.g. virtual currencies, money exchange platforms, etc.).

text: While we do not express any merit judgment on the policy purposes pursued by the law, in this specific case, we are concerned with the fact that the amendments also introduce other policy purposes -other than countering anti-money laundering and terrorism financing- that do not seem clearly identified.

text: Processing personal data collected for one purpose for another, completely unrelated purpose infringes the data protection principle of purpose limitation and threatens the implementation of the principle of proportionality. The amendments, in particular, raise questions as to why certain forms of invasive personal data processing, acceptable in relation to anti-money laundering and fight against terrorism, are necessary out of those contexts and on whether they are proportionate.

text: As far as proportionality is concerned, in fact, the amendments depart from the risk-based approach adopted by the current version of the AML Directive, on the basis that the higher risk for anti-money laundering, terrorism financing and associated predicate offences would not allow its timely detection and assessment.

text: They also remove existing safeguards that would have granted a certain degree of proportionality, for example, in setting the conditions for access to information on financial transactions by Financial Intelligence Units.

text: Last, and most importantly, the amendments significantly broaden access to beneficial ownership information by both competent authorities and the public, as a policy tool to facilitate and optimise enforcement of tax obligations. We see, in the way such solution is implemented, a lack of proportionality, with significant and unnecessary risks for the individual rights to privacy and data protection.

text: Directive (EU) 2015/849

text: of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending

text: Regulation (EU) No 648/2012

text: of the European Parliament and of the Council, and repealing Directive

text: of the European Parliament and of the Council and

text: Commission Directive 2006/70/EC

text: , OJ L 141, 5.6.2015, p. 73–117. The Financial Action Task Force (FATF) is an inter-governmental body established in 1989 by the Ministers of its Member jurisdictions. The objectives of the FATF are to set standards and promote effective implementation of legal, regulatory and operational measures for combating money laundering, terrorist financing and other related threats to the integrity of the international financial system. COM/2016/050 final. The Commission explicitly makes reference to the “Panama papers” scandal in its Communication on further measures to enhance transparency and the fight against tax evasion and avoidance, COM(2016) 451, final. Proposal for a DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL amending

text: Directive (EU) 2015/849

text: on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing and amending Directive

text: , COM/2016/0450 final. No text was submitted in draft to the EDPS before the publication on 5 July 2016. See http://data.consilium.europa.eu/doc/document/ST-15468-2016-INIT/en/pdf . ECJ judgment of 8 April 2014 in Joined Cases

text: and

text: , Digital Rights Ireland. Digital Rights Ireland, paras 41-42. Moreover, the Court clarifies, “in view of the important role played by the protection of personal data in the light of the fundamental right to respect for private life and the extent and seriousness of the interference with that right caused by Directive 2006/24, the EU legislature’s discretion is reduced, with the result that review of that discretion should be strict”, Digital Rights Ireland, paras 45-48. AML Directive, recital (11). For example, the Directive acknowledges that the risk of money laundering and terrorist financing is not the same in every case and, accordingly, a holistic, risk-based approach should be used. It also clarifies that such risk-based approach is not an unduly permissive option for Member States and so-called obliged entities, but rather the possibility to use of evidence-based decision-making in order to target the risks of money laundering and terrorist financing more effectively. See AML Directive, recital (22). AML Directive, recital (14) and Art. 30(5)(c). Commission Communication on further measures to enhance transparency and the fight against tax evasion and avoidance, COM(2016) 451 final, p. 5. The Commission explains that “"Panama Papers" confirmed that a lack of transparency on beneficial ownership can facilitate money-laundering, corruption and tax evasion. The responses to these problems should therefore be complementary and connected”.

text: Article 6(1)

text: (b) of the Data Protection Directive

text: Article 5(1)

text: (b) of the General Data Protection

text: Regulation (EU) 679/2016

text: ; see also Article 8(2) of the Charter of Fundamental Rights. On the application of such principle in the context of personal data processing for enforcement purposes, see the Art. 29 WP´s Statement of the WP29 on automatic inter-state exchanges of personal data for tax purposes (

text: WP 230

text: ) and its Opinion 03/2015 on the draft directive on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data (

text: WP 233

text: ). For example, a police department processes personal data of suspects in order to enforce crimes and a statistician, employed by the same department, has access to the same data to compile a statistic study on the effectiveness of criminal enforcement. The Explanatory Memorandum reads “this proposal seeks to prevent the large-scale concealment of funds which can hinder the effective fight against financial crime, and to ensure enhanced corporate transparency so that true beneficial owners of companies or other legal arrangements cannot hide behind undisclosed identities”. COM(2016) 450, final, recital (24). COM(2016) 450, final, recital (25). COM(2016) 450, final, recital (27). The confusion of purposes introduced by the Proposal is also confirmed by the wide array of personal data processing that may take place under the new provisions: customer due diligence (either “simple” or “enhanced”, in cases of high risk); set up of registries of payments; set up of registries of beneficiary ownership

text: information (concerning both corporations and trusts, regardless of their business nature); exchange of information between competent authorities; access by (and exchange between) FIUs to anti-money laundering information (payment records) and tax relevant information (beneficiary information, bank account ownership); access by NGOs, the press and the public at large to beneficiary ownership information. Council Position, recital (22a). Council Position, recital (35a). Article 52(1) of the Charter of Fundamental Rights of the EU provides that any limitation on the exercise of the rights and freedoms laid down by the Charter must be provided for by law, respect their essence and, subject to the principle of proportionality, limitations may be made to those rights and freedoms only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others. See endnote 8 above. Digital Rights Ireland, para 46. Ibidem, para 48. Ibidem, para 58. ECJ judgment of 20 May 2003, in Joined Cases Rechnungshof (

text: ) v Österreichischer Rundfunk and Others and Christa Neukomm (

text: ) and Joseph Lauermann (

text: ) v Österreichischer Rundfunk, para 88.

text: Article 29

text: WP, Opinion 1/2014 of 27 February 2014 on the application of necessity and proportionality concepts and data protection within the law enforcement sector, available at http://ec.europa.eu/justice/dataprotection/article-29/documentation/opinion-recommendation/files/2014/wp211_en.pdf For example, S & Marper v United Kingdom, Appl. No. 30562/04 and 30566/04 (ECtHR 04 December 2008) In this respect, the Art. 29 WP recommends a “holistic approach” whereby “in order to say whether a new legislative proposal is still proportionate, it is necessary to assess how the new measure would add to the existing ones and whether all of them taken together would still proportionately limit the fundamental rights of data protection and privacy.” Art. 29 WP Opinion, p. 10. The term safeguards in this context is also broad and may cover, for example, steps taken to limit the scope of a measure, or caveats placed upon when or how it can be exercised. Alternatively, it may involve requiring some other objective decision to be made prior to a measure being deployed in that case. Safeguards may also cover any rights of appeal afforded to individuals against a particular measure or its effects and the scope of those rights. COM(2016) 450, final, recital (19). COM(2016) 450, final, recital (14). COM(2016) 50, final, p. 7. “As currently discussed at international level, the FIUs may also need to evolve from a suspicions-based disclosure system to a more intelligence-based disclosure system”. Impact Assessment of Document COM(2016) 450 final, p. 16. We can consider tax evasion as included in the notion of “associated predicate offense”, of course. If we do so, however, the entire architecture of policy measures that justifies (invasive) personal data processing in order to tackle tax evasion as an autonomous policy purpose collapses and the ultimate policy goal to be used as a parameter for lawful data processing shall be countering anti-money laundering and terrorism financing. Paragraph 29, above. The idea of citizens acting as “private attorney general” seems not to be part of the European legal tradition, while it has been adopted in other legal systems. According the US Supreme Court, in fact, “by offering potential litigants the prospect of a recovery in three times the amount of their damages, Congress encouraged these persons to serve as ‘private attorneys general.’”. See Hawaii v. Standard Oil Co., 405 U.S. 251, 262 (1972). The proportionality assessment of policy measures designed to enhance transparency has been the subject of a Court ruling in the Schecke case, where the Court of Justice ruled that “...the institutions are obliged to balance, before disclosing information relating to a natural person, the European Union’s interest in guaranteeing the transparency of its actions and the infringement of the rights recognised by Articles 7 and 8 of the Charter. No automatic priority can be conferred on the objective of transparency over the right to protection of personal data (...), even if important economic interests are at stake”. See ECJ judgment of 9 November 2010, in Joined Cases

text: and

text: , Volker und Markus Schecke GbR, para 85. Paragraph 47, above.

identifier: EDPS yttrande 01/2017

amnesord:
Finance & Economy
Money laundering

publisher: Europeiska datatillsynsmannen

sprak: en

title: Anti-money laundering

serie: yttranden

text: Opinion 1/2017

type: rubrik

text: EDPS Opinion on a Commission Proposal amending

text: Directive (EU) 2015/849

text: and Directive

text: Access to beneficial ownership information and data protection implications

text: 2 February 2017 1 | P a g e The European Data Protection Supervisor (EDPS) is an independent institution of the EU. The Supervisor is responsible under Article 41.2 of Regulation 45/2001 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to privacy, are respected by the Community institutions and bodies”, and “…for advising Community institutions and bodies and data subjects on all matters concerning the processing of personal data’. The Supervisor and Assistant Supervisor were appointed in December 2014 with the specific remit of being more constructive and proactive, and they published in March 2015 a five-year strategy setting out how they intended to implement this remit, and to be accountable for doing so. 2 | P a g e

type: stycke

text: 3 | P a g e THE EUROPEAN DATA PROTECTION SUPERVISOR, Having regard to the Treaty of the Functioning of the European Union, and in particular its

text: Article 16

text: , Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles

text: and

text: thereof, Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, and in particular Articles

text: and

text: (d) thereof, HAS ADOPTED THE FOLLOWING OPINION:

text: 1 INTRODUCTION

text: 1.1 Background on the anti-money laundering Directive

text: 1. In May 2015 a new EU directive against anti-money laundering (“AML Directive”) was adopted. The stated objective of the new legislation is to improve the tools to counter money laundering, as flows of illicit money threaten to damage the integrity, stability and reputation of the financial sector, as well as the internal market of the Union and international development.

text: 2. The protection of the soundness, integrity and stability of credit institutions and financial institutions and the confidence in the financial system are not the only policy goals pursued by the AML Directive. Indeed, in June 2003, the Financial Action Task Force (FATF ) revised its Recommendations to cover terrorist financing, and provided more detailed requirements in relation to customer identification and verification. It pointed to the situations where a higher risk of money laundering or terrorist financing might justify enhanced policy measures and also to situations where a reduced risk might justify less rigorous controls.

text: 3. The AML Directive, as a consequence, provides an articulated set of rules designed to prevent both anti-money laundering and terrorism financing through illicit financial flows. It enacts a risk-based application of customer due diligence to suspicious transactions. It relies on the acquisition and analysis of beneficial ownership information and on the coordinated investigative activities of FIUs (Financial Intelligence Units) established in Member States.

text: 1.2 The Proposal: addressing tax evasion and terrorism financing

text: 4. On 2 February 2016, the European Commission published a Communication laying down an Action Plan for strengthening the fight against terrorism financing, including amendments to the AML Directive to target anti-money laundering through transfer platforms and virtual currencies and re-designing the role of FIUs .

text: 5 | P a g e 5. Also, financial scandals and an increased risk of tax evasion seem to have drawn the attention of the Commission to the need to re-calibrate the action of the AML Directive and aim it more directly towards tax evasion, which, under the current version of the Directive, is just seen as a source of illicit funds, but not directly targeted.

text: 6. On 5 July 2016, the Commission published a set of proposed amendments (the “Proposal”) to the AML Directive and to Directive

text: that, in the context of a coordinated action with the G20 and the OECD, aim at tackling directly and incisively tax evasion by both legal and natural persons with the purpose of establishing a fairer and more effective tax system . We note in this context that, contrary to recital (42), the EDPS was not consulted prior to the adoption of the Proposal .

text: 7. The Opinion of the EDPS was later solicited by the Council of the European Union, which, on 19 December adopted a compromise text on the Proposal (“Council Position” ). The Council Position aims at amending only the AML Directive (and not Directive

text: ) and focuses mainly on anti-money laundering and terrorism financing. While the purpose of fighting tax evasion is no longer explicitly mentioned, tools that, in the Proposal, were designed to achieve that purpose (e.g. public access to beneficial ownership information and access by tax authorities to anti-money laundering information) remain in place, although modified to a certain extent. 1.3 Scope of this Opinion

text: 8. This Opinion analyses the impact of the Proposal on the fundamental rights to privacy and data protection. We also give account on how such impact changes, following the adoption of the Council Position.

text: 9. The Opinion also assesses the necessity and proportionality of personal data processing taking place under the proposed amendments to the AML Directive in the light of the policy purposes identified by the law. When we refer to the Proposal, although it proposes amendments to two distinct directives, we treat it as a single, integrated policy tool.

text: 10. The interaction of public policy with fundamental rights has already come to the attention of the courts. In its Digital Rights Ireland case , the Court of Justice recognises that the fight against international terrorism and serious crime constitutes an objective of general interest . Since, however, the legal tools enacted to pursue that objective interfere with the fundamental rights to privacy and data protection, it is necessary, according to the Court, to assess the proportionality of such measures .

text: 11. The purpose of this Opinion, therefore, is not to express any merit judgment on the choice of the policy objectives the legislator decides to pursue. Our attention, instead, focuses, in the tools and modes of action that the law adopts. It is our purpose to ensure that legitimate policy goals are effectively and timely pursued, with the minimum interference with the exercise of fundamental rights and in full respect to the requirements of Art. 52(1) of the Charter of Fundamental Rights of the EU. 6 | P a g e

text: 2 THE DRAFT COMMISSION PROPOSAL

text: 2.1 The policy approach under the current version of the AML Directive

text: 12. The AML Directive aims at detecting illegal anti-money laundering, both in cases where the financial system is used to introduce in the legal economy resources originating from illegal activities and where such resources are destined to finance terrorist organisations. Tax crimes are relevant, but only to the extent that they are capable of generating illegal resources that later are injected in the legal economy .

text: 13. The approach to anti-money laundering is risk based: less risky situations justify less intrusive procedures . It is clear, therefore, that a risk-based approach is more in line with the essential principle of proportionality and tends to determine a positive outcome also in terms of personal data processing.

text: 14. The AML Directive provides for the processing of information concerning beneficiary information, in order to allow a more incisive action against anti-money laundering. Also, it provides that Member States should ensure that persons who are able to demonstrate a legitimate interest with respect to money laundering, terrorist financing, and the associated predicate offences, such as corruption, tax crimes and fraud, are granted access to beneficial ownership information, in accordance with data protection rules .

text: 15. The AML Directive, also recognises tax crimes - as defined by national legislation - as criminal activity capable of generating financial proceeds that enter the illegal circuit of money laundering. However, the Directive, as it currently stands, does not identify the fight against “tax evasion” as one of its public policy purposes. Indeed, other legislative instruments at EU level, such as Directive

text: , already perform this function.

text: 16. The AML Directive reserves the investigation and enforcement of criminal activities to the public competent authorities. In this respect, private parties active in the financial markets (whether financial institutions or trustees) are merely requested to provide information to the competent authorities in charge. Under no circumstance, a private subject or entity is, either formally or informally, directly or indirectly, entrusted with an enforcement role. 2.2 Proposed amendments to the AML Directive and Directive

text: with an impact on the right to data protection

text: 17. Observing that terrorism is able to receive financial support through multiple channels, including virtual currencies and money transfer platforms, the Commission has opted for revising the AML Directive, taking a stricter approach to due diligence. Also, prompted by the “Panama papers” scandal, the Commission proposed measures to increase the transparency of the financial system and made tax evasion a primary concern of the Directive (as opposed to being a mere predicated crime) .

text: 18. The Council Position does not explicitly refer to tax evasion as a purpose for the amendments to the AML Directive. Nonetheless, tax authorities are given extensive access to information collected for anti-money laundering purposes. Also, provisions on access to beneficial ownership information remain in the text, with modifications we will further discuss in the paragraphs below. 7 | P a g e

text: 19. Without questioning the merits of such policy choices, we need, at the same time, to look at the amendments from a data protection perspective and assess how the Proposal (and the Council Position) would affect, in particular, purpose limitation and proportionality.

text: 3 MAIN DATA PROTECTION IMPLICATIONS OF THE COMMISSION PROPOSAL

text: 3.1 Principle of purpose limitation

text: 20. According to the purpose limitation principle, personal data may only be collected for specified, explicit and legitimate purposes and not further processed in a manner which is incompatible with those purposes . We consider such provision particularly important for public policies interfering with personal data protection, because the proportionality of the processing will have to be measured against the policy purpose selected by the legislator .

text: 21. We consider, in that respect, that legislative instruments that allow multiple and/or simultaneous personal data processing by different data controllers and for incompatible purposes, without specifying the purpose each data processing is designed for, risk introducing significant confusion as to the implementation of the proportionality principle.

text: 22. Therefore, the respect of the principle of purpose limitation is essential, particularly in cases where the law allows two categories of data controllers to process data and they do not necessarily process data for the same purpose .

text: 23. In cases where the purposes for data processing are defined in broad or vague terms, where the data controllers have a completely different relation with the purpose pursued, both in terms of structure, resources and ability of each controller to comply with the rules in certain specific circumstances, the principle of purpose limitation is formally and substantially undermined, with the consequence that also the principle of proportionality will not be duly implemented. The principle of purpose limitation in the Proposal

text: 24. The draft Proposal clearly targets anti-money laundering, with a focus on new channels and modalities used to transfer illegal funds to the legal economy (e.g. virtual currencies, money exchange platforms, etc.). In general, it seems to take a stricter approach than before to the problem of effectively countering anti-money laundering and terrorism financing, but this does not affect our assessment on whether the amendments comply with the principle of purpose limitation.

text: 25. We are concerned, instead, with the fact that the Proposal introduces other policy purposes -other than countering anti-money laundering and terrorism financing- that do not seem clearly identified and, therefore, raises questions as to why certain forms of invasive personal data processing, acceptable in relation to anti-money laundering and fight against terrorism, are necessary out of those contexts and on whether they are proportionate.

text: 26. We refer, in particular, to the fight against tax evasion as a specific goal of the new legislation (in the original AML Directive, tax crimes were relevant merely as source of illicit funds, but not directly targeted and enforced). 8 | P a g e

text: 27. The Proposal also generically mentions the “fight against financial crime” and “enhanced corporate transparency” as policy goals . With respect to the latter, public access to beneficiary information is foreseen, in order to protect minority shareholders and third parties .

text: 28. We observe, in this respect, that, as the description of the purpose for processing personal data progressively departs from the original anti-money laundering objective, it also becomes less determinate. At one point, for example, the Proposal indicates that “the disclosure of beneficial ownership information should be designed to give governments and regulators the opportunity to respond quickly to alternative investment techniques, such as cash-settled equity derivatives” .

text: 29. If we observe, at this point, the composite scenario designed by the Proposal, we notice that under the new provisions, personal data would be processed for a number of purposes: countering anti-money laundering and terrorism financing; countering tax evasion (and elusion); preventing financial crimes and/or abuses of the financial markets; enhancing corporate transparency (necessary, in turn, to protect minority shareholders of corporations as well as any third party doing business with such corporations); give governments and regulators the opportunity to respond quickly to alternative investment techniques; allow public scrutiny on the functioning of financial markets, on investors and on tax evaders.

text: 30. Processing personal data collected for one purpose for another, completely unrelated purpose infringes the data protection principle of purpose limitation and threatens the implementation of the principle of proportionality.

text: 31. In addition, in relation to the purposes mentioned above, we observe that various controllers are foreseen to process personal data: competent authorities in charge of investigating anti-money laundering; obliged entities under the AML Directive (e.g. banks, financial institutions, virtual currency providers, etc.); competent authorities investigating terrorism; FIUs (whatever their legal form and status under national law); competent authorities in charge of tax evasion; NGOs carrying out investigative activities in relation to the functioning of financial markets and tax evasion; the press and the public at large. In this respect, the problem is that these controllers significantly differ from each other. If they act for different purposes, these, as seen, do not appear sufficiently specified. If, on the contrary, they pursue the same purpose, they might do so according to different “standards”, in terms of ability to comply with data protection rules, or may carry out data processing which is not proportional to the purpose sought.

text: 32. In relation to the preceding paragraphs, we note that, in expanding the purpose of data processing beyond the initial anti-money laundering purpose, the Proposal introduces a significant degree of uncertainty as to the purposes pursued and on the controllers entrusted with them . This uncertainty reduces data protection safeguards, such as the proportionality between personal data processing and the purpose that processing serves. As mentioned, we do not express any merit judgment on the policy purposes identified by the legislator, nor on the legislative tools designed to pursue such goals. What we are concerned about is that any processing of personal data shall serve a legitimate, specific and well identified purpose and be linked to it by necessity and proportionality. The data controller performing personal data processing shall be identified and accountable for the compliance with data protection rules. 9 | P a g e The compromise solution in the Council Position

text: 33. The Council Position, probably as a consequence of the debate stirred by the Proposal, seems to define purpose with slightly more clarity, shift the focus from the fight to tax evasion back to anti-money laundering.

text: 34. We also note, however, that certain data processing operations remain in the law, which cannot be precisely linked to a specific purpose. We refer, in particular, to access to beneficial ownership information.

text: 35. In fact, the Council Position provides, in the recitals, that information on beneficial ownership of trusts and similar legal arrangements should be made available to any person demonstrating a legitimate interest. Such information is also expected to contribute to “increased trust in the integrity of the financial system by enabling those who are in a position to demonstrate legitimate interest to become aware of the identity of the beneficial owners”. In addition, access to this information would help investigations on money laundering, associated predicate offences and terrorist financing .

text: 36. Member States are entrusted with the task to define the concept of legitimate interest. In addition, “with a view to further enhance transparency of business transactions and financial system”, Member States may grant wider public access in their national legislation to information on beneficial ownership. If they do so, they shall have due regard to the right balance between the public interest to combat the money laundering and terrorist financing and the protection of fundamental rights of individuals in particular the right to privacy and protection of personal data .

text: 37. We observe that this new approach materialises in the amendment of Articles 30 and 31 of the AML Directive. The former confirms the (already existing) right of any person with legitimate interest to access beneficial information of corporations and

text: Article 31

text: introduces such right in relation to trusts. Both articles leave to Member States the possibility to grant even wider access (to entities without legitimate interest, perhaps?). Both provisions mandate cooperation with the Commission (and

text: Article 30

text: also between Member States) to implement this kind of access.

text: 38. The Council Position also makes an effort to link access to beneficial ownership information to the purpose of fighting money laundering. In recital (35), in fact, it is stated that “the need for accurate and up-to-date information on the beneficial owner is a key factor in tracing criminals who might otherwise be able to hide their identity behind a corporate structure”. If such a statement clarifies the purpose of personal data processing by competent authorities, it does not say much as to the purpose for “access by any person with legitimate interest” and possible “wider access” granted to Member States and, even considering as valid the transparency purposes stated in other recitals (see above), serious doubts arise in connection to the proportionality of such access provisions.

text: 39. If we look at the compromise solution emerging from the Council discussions, we do not see substantial changes compared to the Commission Proposal. The Council Position does not mention the fight to tax evasion as a purpose any more. Nonetheless, access to beneficial ownership information is confirmed (for purposes such as fighting anti-money laundering and increasing transparency of financial markets), giving to Member States the power to define the notion of legitimate interest and to grant even wider access. 10 | P a g e

text: 40. We welcome reiterated references, in the Council Position, to the need to respect data protection rules in implementing such access, but we are concerned that these statements do not translate into facts.

text: 41. The wording of the amendment cited above, in fact, signals that Member States will enjoy quite a large discretion in granting access, in setting the requirements and, particularly, the purpose thereof. They will also be responsible for balancing the access to beneficial ownership information with the respect of personal data protection. The practical result of such provisions is that a Member State willing to preserve confidentiality on trusts in its jurisdiction and a Member State that, to the contrary, wants to use “public scrutiny” against tax evaders are equally entitled to do so based on the same provision of the AML Directive. The function of data protection rules is not to tip the balance in favour of one or the other policy solution, but this is exactly the route the Council seems to have taken, when deferring to Member State discretion without providing any guidance on the application of data protection safeguards and leaving them up for interpretation. 3.2 Proportionality

text: 42. The principle of proportionality is enshrined in Article 52(1) of the Charter of Fundamental Rights of the EU. It provides that any limitation on the exercise of the rights and freedoms laid down by the Charter must be provided for by law, respect their essence and, subject to the principle of proportionality, limitations may be made to those rights and freedoms only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others.

text: 43. In spite of the amendments that the Council Position has introduced to the Commission Proposal, we still consider that the implementation of the fundamental principle of proportionality remains unclear .

text: 44. The European Court of Justice addressed the issue of proportionality in the Digital Rights Ireland case . In particular, the Court states that “according the settled case-law of the Court, the principle of proportionality requires that acts of the EU institutions be appropriate for attaining the legitimate objectives pursued by the legislation at issue and do not exceed the limits of what is appropriate and necessary in order to achieve those objectives” .

text: 45. In its reasoning leading to the annulment of Directive 2006/24, the Court also indicates that, in the light of the important role played by personal data protection and of the serious interference caused by the Directive “the EU legislature’s discretion is reduced, with the result that review of that discretion should be strict” .

text: 46. The Court also annuls the Directive on the ground that “it (...) applies even to persons for whom there is no evidence capable of suggesting that their conduct might have a link, even an indirect or remote one, with serious crime.” , thus emphasising the fact that a link should exist between measures interfering with personal data protection and a risk to society.

text: 47. In other cases, concerning the publication of financial information concerning individuals, the European Court of Justice indicated the need to “ascertain whether such publicity is both necessary and proportionate to the aim (…), and in particular to examine whether 11 | P a g e such an objective could not have been attained equally effectively by transmitting the information as to names to the monitoring bodies alone” .

text: 48. The

text: Article 29

text: Working Party has analysed the principle of proportionality in one of its Opinions . In particular, reviewing the jurisprudence of the European Court of Human Rights , the

text: Article 29

text: Working Party came to the conclusion that the proportionality requirement is not met in cases where, among other things, the proposed legislative measure, although fulfilling a legitimate purpose, sets forth a “blanket measure”; fails to assess the effectiveness of existing measures ; or fails to provide adequate safeguards for the individual . The principle of proportionality in the Proposal

text: 49. The presence, in the Proposal, of heterogeneous policy purposes, intertwined to the main purposes of fighting anti-money laundering and terrorism financing, complicates the implementation of the principle of proportionality. In particular, the Commission seems to have foregone a proper proportionality assessment and have opted for “blanket measures”. In the paragraphs below, we identify legislative amendments which call into question the proper implementation of the principle of proportionality by the Commission. a. Departure from a risk-based approach

text: 50. In fact, the Proposal departs from the risk-based approach adopted by the current version of the AML Directive, on the basis that the higher risk for anti-money laundering, terrorism financing and associated predicate offences would not allow its timely detection and assessment. It is important, as a consequence, “to ensure that certain clearly specified categories of already existing customers are also monitored on a methodical basis” . It is not clear on the basis of which criteria, if not risk, such categories of customers will be identified.

text: 51. With respect to the departure from a risk-based approach, we note that the timely detection and assessment of risk is a crucial factor only in the context of terrorism financing, while being much less relevant in the context of the fight to tax evasion. This consideration emphasises further the need to run a proper assessment of proportionality of policy measures against the purposes sought, as emergency-based measures that are acceptable to tackle the risk of terrorist attacks might result excessive when applied to prevent the risk of tax evasion. b. Broader powers to FIUs

text: 52. The Proposal also removes existing safeguards that would have granted a certain degree of proportionality. For example, in setting the conditions for access to information on financial transactions by FIUs, the Proposal provides that, for the future, FIUs’ need to obtain additional information may no longer and not only be triggered by suspicious transactions (as is the case now), but also by FIUs’ own analysis and intelligence, even without a prior reporting of suspicious transactions . The role of FIUs, therefore, is shifting from being “investigation based” to being “intelligence based” . The latter approach is similar to data mining than to a targeted investigation, with obvious consequences in terms of personal data protection. 12 | P a g e c. Wider access to beneficial ownership information

text: 53. In addition, with respect to proportionality, it must be noted that the Proposal introduces more stringent rules also with respect to beneficiary information concerning trusts and similar non-corporate arrangements, increasing transparency with respect to “all trusts” regardless of an effective risk they represent.

text: 54. The AML Directive, in its current version, gives competent authorities (and FIUs) access in a timely manner to beneficial ownership of trusts and other legal arrangements. In addition, current rules require that, where a trust generates tax consequences, a Member State must have in place a register containing the beneficial ownership information.

text: 55. The Proposal broadens the scope of application of the rule, by extending access to beneficiary information concerning these structures from competent authorities to the public, on the rationale that they are often involved in commercial or business-like activities and third parties dealing with them would be more protected in their transactions knowing the actual beneficiaries of such trusts.

text: 56. The Proposal also expands the scope of this rule by providing for public access to beneficiary information concerning non business-type trusts, on condition that those requesting access hold a legitimate interest.

text: 57. The rationale for granting public access to beneficiary information concerning corporate arrangements is that “public access also allows greater scrutiny of information by civil 38 rationale applies when public access is granted to non-business-type trusts. In the latter case, however, the requirement of holding legitimate interest functions as a proportionality requirement, possibly restricting the number of those entitled to access information. We shall thus consider how the Proposal defines legitimate interest.

text: 58. In this respect, recital (35) of the Proposal clarifies that “the legitimate interest with respect to money laundering, terrorist financing and the associated predicate offences should be justified by readily available means, such as statutes or mission statement of nongovernmental organisations, or on the basis of demonstrated previous activities relevant to the fight against money laundering and terrorist financing or associated predicate offences, or a proven track record of surveys or actions in that field”.

text: 59. The definition appears broad in scope and raises several questions. A practical one is: how to avoid opportunistic behaviour? Beneficiary information is, in fact, valuable information that can be used in many ways and defining the concept of legitimate interest in such broad fashion would provide an incentive to those who want to access it for merely opportunistic reasons.

text: 60. Other questions also raise concerns. In the first place, legitimate interest is defined with respect to anti-money laundering, terrorist financing and associated predicate offences. The Proposal, therefore, does not define legitimate interest in relation to access to beneficiary information in order to uncover tax evasion and to pursue all the other purposes mentioned in the proposed legislation . This gap is even more striking, considering that the choice to increase transparency stems out of the “Panama papers” scandal, as a measure to prevent tax evasion. 13 | P a g e

text: 61. A second question concerns the role of the public and civil society in enhancing transparency. As seen in the introduction to this Opinion, the AML Directive reserves the investigation and enforcement of criminal activities to the public competent authorities. In this respect, private parties active in the financial markets are merely requested to provide information to the competent authorities in charge. Under no circumstance, a private subject or entity is, either formally or informally, directly or indirectly, entrusted with an enforcement role .

text: 62. It can be acknowledged that NGOs working on financial crimes and abuses, the press and investigative journalism de facto contribute to drawing attention of the authorities to phenomena that may be relevant for criminal enforcement. If this is the case, however, the legislator should conceive the access to beneficiary information as a component of the right to obtain and to provide information, by citizens and the press respectively. This would assign a new purpose to public access, with the consequence that the proportionality of such rule would be assessed against that right and not against policy purposes (e.g. fight against terrorism or tax evasion) that cannot be associated to private action .

text: 63. We also recall, to conclude on this point, the jurisprudence of the Court of Justice in the case Österreichischer Rundfunk , where the Court held that it was necessary to examine whether the policy objective served by publicity “could not have been attained equally effectively by transmitting the information as to names to the monitoring bodies alone”. This question should be carefully considered when assessing the proportionality of measures consisting of public access to personal information.

text: 64. A comparison of the Proposal with the Council Position allows us to better appreciate how the latter has not led to substantial improvements in terms of proportionality. The Council Position no longer refers to tax evasion, but maintains the provision of a wide access to beneficial ownership information (even wider, if Member States so decide) by entities other than those entrusted with law enforcement. How can access by these entities be reconciled with the fight to anti-money laundering and terrorism financing?

text: 4 CONCLUSION

text: 65. The Commission is proposing new amendments to the AML Directive, in order to put it up to speed with technical and financial innovation and new means to perform money laundering and terrorism financing. At the same time, the Proposal aims at improving the transparency of the financial markets for a number of purposes that we identify, among others, in the fight to tax evasion, protection of investors and fight against abuses of the financial system.

text: 66. We have reviewed the Proposal and we consider that it should have:  Ensured that any processing of personal data serve a legitimate, specific and well identified purpose and be linked to it by necessity and proportionality. The data controller performing personal data processing shall be identified and accountable for the compliance with data protection rules.  Ensured that any limitation on the exercise of the fundamental rights to privacy and data protection be provided for by law, respect their essence and, subject to the principle of 14 | P a g e proportionality, enacted only if necessary to achieve objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others.  Ensured a proper assessment of the proportionality of the policy measures proposed in relation to the purposes sought, as emergency-based measures that are acceptable to tackle the risk of terrorist attacks might result excessive when applied to prevent the risk of tax evasion.  Maintained into place safeguards that would have granted a certain degree of proportionality (for example, in setting the conditions for access to information on financial transactions by FIUs).  Designed access to beneficial ownership information in compliance with the principle of proportionality, inter alia, ensuring access only to entities who are in charge of enforcing the law. Brussels, 2 February 2017 Wojciech Rafał WIEWIÓROWSKI European Data Protection Supervisor 15 | P a g e

text: Notes

text: 16 | P a g e

text: 17 | P a g e

type: vagledning

utgivare: edps


text: OJ L 281, 23.11.1995, p. 31. 2 OJ L 119, 4.5.2016, p. 1. 3 OJ L 8, 12.1.2001, p. 1. 4 OJ L 350, 30.12.2008, p. 60. 5 OJ L 119, 4.5.2016, p. 89. 6 To those Member States which joined the Union after that date, the Regulation applies from the beginning of their membership. 7 Denmark does not participate in the Regulation and is therefore neither bound by it nor subject to its application. 8 COM(2014) 225 final. 9 A procedure whereby a foreign judgment needs to be formally recognised by the Member State of enforcement. 10

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural person with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: . 11 See also Article 60 of the Proposal: “Where a communication is sent to a Central Authority without jurisdiction, the latter shall be responsible for forwarding it to the Central Authority with jurisdiction and informing the sender accordingly.” 12 Recital 39 of the GDPR. 13 Recital 38 of the GDPR.

identifier: EDPS yttrande 01/2018

title: Proposal for a recast of Brussels IIa Regulation

text: Opinion 01/2018

text: EDPS Opinion on the proposal for a recast of Brussels IIa Regulation

text: (Council Regulation on jurisdiction, the recognition and enforcement of decisions in matrimonial matters and the matters of parental responsibility, and on international child abduction)

text: 15 February 2018 1 | P a g e

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 41(2) of Regulation 45/2001 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to privacy, are respected by the Community institutions and bodies’, and ‘…for advising Community institutions and bodies and data subjects on all matters concerning the processing of personal data’. Under Article 28(2) of Regulation 45/2001, the Commission is required, ‘when adopting a legislative Proposal relating to the protection of individuals’ rights and freedoms with regard to the processing of personal data...’, to consult the EDPS.

text: He was appointed in December 2014 together with the Assistant Supervisor with the specific remit of being constructive and proactive. The EDPS published in March 2015 a five-year strategy setting out how he intends to implement this remit, and to be accountable for doing so.

text: This Opinion responds to a formal consultation by the Council of the European Union pursuant to Articles 41(2)(2) and 46(d) of Regulation 45/2001 and provides recommendations on how to better safeguard the right to privacy and the protection of personal data in the proposed recast of the Brussels IIa Regulation.

text: 2 | P a g e

text: Executive Summary

text: The Brussels IIa Regulation is the cornerstone of judicial cooperation in family matters in the European Union. It establishes uniform jurisdiction rules for divorce, separation and annulment of marriage as well as for disputes about parental responsibility in cross-border situations. The overall objective of the recast of the Brussels IIa Regulation is to remove the remaining obstacles to the free movement of judicial decisions in line with the principle of mutual recognition and to better protect the best interest of the child by simplifying the procedures and enhancing their efficiency.

text: The new proposed rules aim to promote better cooperation between Central Authorities, which exchange information within and across Member States, without involving the creation of any IT system. The EDPS had not been consulted on the proposal by the Commission. Given that concerns regarding the relationship between the proposed recast and the Union law on protection of personal data were raised during the discussions within the Council Working Party on Civil Law Matters, the Council formally requested an opinion of the EDPS. The EDPS welcomes this request for consultation from the Council.

text: The Opinion focuses on specific recommendations to strengthen the lawfulness of the processing provided for under Articles 63 and 64 of the Proposal. Additionally, the EDPS provides recommendations for suitable and specific safeguards to protect the fundamental

text: rights and interests of the data subjects.

text: In the light of Articles 6(3) and 9(2)(g) of the GDPR and in consideration of the context, the aim of the Proposal and the fact that children are among the data subjects affected by the Proposal, the EDPS recommends including in the Regulation specific clauses in relation to the purpose of processing and the types of data subject to the processing. In particular, the EDPS

text: abduction as well. Thus, considering that Chapter V appears to include both areas of cooperation, and in order to provide more legal certainty and to satisfy the requirements of the purpose limitation principle, the EDPS considers that Article 63(3) could be modified to narrow the purposes to “cooperation in specific cases relating to parental responsibility and international child abduction”. In addition, the EDPS would welcome an explicit reference

text: to the principles of data quality and minimisation in the Regulation.

text: the obligation, as a principle, to notify the data subject about the transmission of information. This obligation may be postponed, as an exception, until the request has

text: been carried out. This limitation, which aims to ensure a fair balance between the rights of the data subjects to be informed about the transmission and the interests of the Member States to exchange information, in itself does not appear to raise fundamental questions from the point of view of the general principles of lawfulness, fairness and transparency. However, the EDPS considers that the reference to the “national law of the requested Member State” may be subject to confusion in that it seems to allow the introduction of national restrictions to the duty to inform. The EDPS recommends specifying that the reference to the national law of the

text: requested Member State under Article 63(4) does not allow further limitations on the right to information to be introduced at national level, so that the specific measure envisaged to ensure fairness of the processing enshrined in this provision be consistently applied across the Union.

text: 3 | P a g e

text: In addition, the EDPS recommends establishing in the Regulation, as a principle, the right

text: of access of data subjects to the information transmitted to the requesting authority of a Member State. The EDPS further recommends, to the extent restrictions to the rights of access and rectification are considered necessary in the particular context of the Proposal, supplementing the Proposal with a clear and specific provision laying down “the scope of the restrictions”, in accordance with Article 23(2)(c) of the GDPR.

text: 4 | P a g e

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty of the Functioning of the European Union, and in particular Article 16 thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof, Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data , and to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) , Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular Articles

text: and

text: (d) thereof, Having regard to Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters , and to

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA ,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION AND BACKGROUND

text: 1. On 30 June 2016, the Commission submitted to the Council a Proposal for a Council Regulation on jurisdiction, the recognition and enforcement of decisions in matrimonial matters and the matters of parental responsibility, and on international child abduction (recast). The Proposal is a recast of

text: Council Regulation (EC) No 2201/2003 of 27 November 2003

text: , repealing

text: Regulation (EC) No 1347/2000

text: (the so-called Brussels IIa Regulation, hereinafter the “Proposal”).

text: 2. The Brussels IIa Regulation is the cornerstone of judicial cooperation in family matters in the European Union. It establishes uniform jurisdiction rules for divorce, separation and annulment of marriage as well as for disputes about parental responsibility in crossborder situations. It facilitates the free circulation of judgements, authentic instruments and agreements in the Union by laying down provisions on their recognition and enforcement in other Member States. It applies since 1 March 2005 to all Member 6 7 States except Denmark .

text: 3. The Commission has assessed the operation of the Regulation in practice and considered necessary to amend the instrument in its application report adopted in April 2014 . The evaluation showed that between the two major areas covered by the 6 | P a g e Regulation, matrimonial and parental responsibility matters, the latter was identified to have caused acute problems. In addition, the European Court of Justice (CJEU) has so far rendered 24 judgments concerning the interpretation of the Regulation, which were taken into account.

text: 4. The overall objective of the Proposal is to further develop the European area of Justice and Fundamental Rights based on mutual trust by removing the remaining obstacles to the free movement of judicial decisions in line with the principle of mutual recognition and to better protect the best interest of the child by simplifying the procedures and enhancing their efficiency.

text: 5. In particular, the Proposal abolishes the procedure of exequatur for all decisions covered by the Regulation’s scope, introducing, instead, automatic recognition of all judgments from other EU Member States. The Proposal also clarifies a number of issues concerning cross-border child abduction, with the aim of improving the efficiency of the return of an abducted child.

text: 6. The new rules aim to promote better cooperation between Central Authorities, which exchange information within and across Member States, without involving the creation of any IT system. The Council Working Party on Civil Law Matters has nevertheless raised concerns during the discussions about the relationship between the proposed recast and the Union law on protection of personal data.

text: 7. On 11 January 2018, the Council submitted to the EDPS a formal request for an opinion, in particular on Articles 63(3) and 63(4) of the Proposal, concerning rules on how information collected by Central Authorities dealing with cross border cases may further be used and how notification to data subjects should be done.

text: 8. The EDPS welcomes that he has been consulted by the Council. The focus of this Opinion, is to provide specific recommendations to strengthen the lawfulness of the processing provided for under Articles 63 and 64 of the Proposal (Section 2). Additionally, the EDPS provides recommendations for suitable and specific safeguards to protect the fundamental rights and interests of the data subjects (Section 3).

text: 2. LAWFULNESS OF THE PROCESSING (Articles 63 and 64 of the Proposal)

text: 9. As a preliminary remark, the EDPS welcomes that the applicability of

text: Regulation (EU) No 2016/679

text: (“the GDPR”) is highlighted in recital 43, which provides that “

text: Regulation (EU) No 2016/679

text: applies to the processing of personal data by the Member States carried out in application of this Regulation”.

text: 10. The Proposal provides, in particular under Articles

text: and

text: , the legal basis for the processing and exchange of personal data in the context of cross-border cooperation in matters of parental responsibility and international child abduction. From the point of view of EU data protection rules, the legal bases for the envisaged processing and exchange of personal data can be found in

text: Article 6(1)

text: (c) and 6(1)(e) of the GDPR: “processing is necessary for compliance with a legal obligation to which the controller 7 | P a g e is subject” and/or “for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. According to Article 6(3) of the GDPR, when the basis of the processing is a legal obligation or a public interest, envisaged by Union law or national law, to which the controller is subject, “that legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing [...]” (emphasis added).

text: 11. In addition, the Proposal provides for the processing and exchange of information that may involve, in many situations, the processing of special categories of data such as data concerning the health of the child and/or of the parents (e.g. information regarding “the situation of the child” under

text: Article 64(1)

text: (a) of the Proposal). Whenever data that belong to such special category are processed,

text: Article 9(2)

text: (f) and 9(2)(g) will become applicable: “processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity” and “processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject” (emphasis added).

text: 12. In light of Articles

text: and

text: (g) of the GDPR and considering the context, the aim of the Proposal and the fact that children are among the data subjects affected by the Proposal, the EDPS recommends including in the Regulation specific clauses in relation to:  the purpose of processing; and  the types of data which are subject to the processing in the light of the principles of data quality and minimisation.

text: 13. The proposed suitable and specific measures to ensure fair processing and the protection of the data subjects’ rights of access and rectification are discussed in Section 3. 3.1. Purpose of the processing “The Central Authorities shall, within their Member States, transmit the information referred to in Articles

text: and

text: to the competent authorities, including the authorities competent for service of documents and for enforcement of a decision, as the case may be. Any authority to which information has been transmitted pursuant to Articles

text: and

text: may use it for the purposes of this Regulation” (emphasis added).

text: 15. Articles

text: and

text: are included in Chapter V of the Proposal, entitled “Cooperation between central authorities in matters of parental responsibility”. The scope of the 8 | P a g e cooperation covered under this Chapter is however not sufficiently clear, since it does not appear limited to “parental responsibility matters”, but instead appears under

text: Article 63(1)

text: (g) to include cooperation in cases of “international child abduction”, which is dealt with extensively under Chapter III of the Proposal.

text: 16. The EDPS emphasises that, given that the Proposal aims to provide the legal ground for the envisaged personal data processing by the competent authorities, the definition of the purpose(s) for which personal data are to be processed (including disclosure) must be sufficiently specified and explicit (see

text: Article 5(1)

text: (b) of the GDPR).

text: 17. The EDPS understands that the objective of the Proposal is to enhance cooperation in parental responsibility matters and in cases of international child abduction. Therefore, the EDPS recommends clarifying the Proposal so as to ensure consistency between the titles of the Chapters and their content. In particular, the EDPS recommends clarifying whether the cooperation framework set up under Chapter V of the Proposal covers parental responsibility matters only or includes international child abduction as well. Alternatively, the Proposal may set up two distinct cooperation frameworks, one for each area.

text: 18. In addition, the EDPS considers that the definition of the purposes of cross-border transmission of information and further use by the receiving authorities under

text: Article 63(3)

text: are provided in broad and not sufficiently specific terms (“for the purposes of this Regulation”). This could be interpreted to include matrimonial matters as well, and should be explicitly narrowed down.

text: 19. Specific and explicit determination of the purpose(s) of the processing and exchange of information is also necessary to ensure that the “authorities” entitled to process personal data under the Proposal are clearly defined. The EDPS notes that under Article 2(1) of the Proposal, an “authority” means “any judicial or administrative authority in the Member States with jurisdiction in the matters falling within the scope of this Regulation”. It follows that the various authorities referred to in the Proposal, and in particular under Article

text: and

text: , such as “Central authorities”, “Competent authorities” (including authorities competent for service of documents and for enforcement of a decision); “Authorities or other bodies” or “Any authority” shall be interpreted in the light of the definition of

text: Article 2(1)

text: . As far as Chapter V of the Proposal is concerned, the EDPS understands that authorities who do not have specific jurisdiction in the matters of parental responsibility or international child abduction should not be the requester or recipient of any information processed on the basis of the Regulation .

text: 20. Considering that Chapter V appears to include both areas of cooperation, and in order to provide more legal certainty and to satisfy the requirements of the purpose limitation principle, the EDPS considers that

text: Article 63(3)

text: could be modified to narrow the purposes to “cooperation in specific cases relating to parental responsibility and international child abduction”, thus excluding “matrimonial matters”, which is the other major area covered by the Regulation. The definitions of “competent authority” etc. should be adapted accordingly. 9 | P a g e 3.2. Categories of data processed and principles of data quality and minimisation

text: 21. Article 64(1) of the Proposal provides that “[u]pon a request made with supporting reasons by the Central Authority or an authority of a Member State with which the child has a substantial connection, the Central Authority of the Member State where the child is habitually resident and present may, directly or through authorities or other bodies: (a) provide a report: (i) on the situation of the child; (ii) on any procedures under way concerning the child; or (iii) on decisions taken concerning the child”.

text: 22. Paragraph 2 futher stipulates that “[w]here a decision in matters of parental responsibility is contemplated, an authority of a Member State, if the situation of the child so requires, may request any authority of another Member State which has information relevant to the protection of the child to communicate such information”.

text: 23. Pursuant to

text: Article 5(1)

text: (c) of the GDPR, personal data must be adequate, relevant and limited to what is necessary for the purposes for which they are processed (data quality and data minimisation principles). This principle of EU data protection rules remains fully applicable also in the context of the Proposal. Compliance with the data minimisation principle becomes all the more critical given the processing under the Proposal is likely to regularly involve sensitive data of children, particularly vulnerable members of society who deserve specific protection.

text: 24. The EDPS understands that parental responsibility matters routinely require complex and thorough analysis in order to evaluate and protect the best interests of the child. This may often involve the processing of a wide range of personal data, depending on the circumstances and context of each specific case. The EDPS would nevertheless welcome an explicit reference to the principles of data quality and minimisation in the Regulation. The EDPS recommends adding a paragraph as follows: “Any information collected and exchanged between Central Authorities or other authorities of Member States shall be adequate, relevant and limited to what is necessary, depending on the circumstances of each case, for the purposes of cooperation in parental responsibility matters and international child abduction”.  As required under

text: Article 9(2)

text: (g) of the GDPR, when the processing of special categories of data is carried out on the basis of “reasons of substantial public interest, on the basis of Union or Member State law”, such law “shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject”. In the context of the current Proposal, the EDPS considers of particular importance to address specific measures to ensure a fair processing (3.1) and recommends to include specific measures to ensure access and rectification rights (3.2). 10 | P a g e 3.1 Specific measures to ensure fair processing 

text: Article 5(1)

text: (a) of the GDPR requires that personal data should be processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”). The data subject should be informed of the existence of the processing operation and its purposes, and any further necessary information taking into account the specific circumstances and the context . Articles 13 and 14 of the GDPR further provide for specific obligations of information to be provided to the data subject where personal data are collected from the data subject or obtained from other sources.  Article 63(4) of the Proposal introduces the duty to inform the data subjects about the transmission of all or part of the information relating to them and the possibility to restrict this information as follows: “Notification of the data subject of the transmission of all or part of the information collected shall take place in accordance with the national law of the requested Member States. Where there is a risk that it may prejudice the effective carrying out of the request under this Regulation, for which the information was transmitted, such notification may be deferred until the request has been carried out”.  The EDPS wishes to recall that any restriction to the right of information of the data subjects under Articles 13 and 14 of the GDPR shall comply with the standard established under Article 23 of the GDPR. Pursuant to this Article, Union or Member State law to which the data controller is subject may restrict by way of a legislative measure the scope of the obligations of information when such a restriction respects the essence of the fundamental rights and freedoms and is necessary and proportionate measure in a democratic society to safeguard one of the objective of public interests listed. In this particular case, the restriction introduced by Article 63(4) of the Proposal could be based on “the enforcement of civil law claims” (

text: Article 23(1)

text: (j)), the “protection of the data subject or the rights and freedoms of others” (23(1)(i)) or “the protection of judicial independence and judicial proceedings” (23(1)(f)).

text: Article 23(2)

text: (c) of the GDPR requires that such a legislative measure contain specific provisions regarding “the scope of the restrictions introduced”.  The EDPS notes that the Proposal provides for the obligation, as a principle, to notify the data subject about the transmission of the information. This obligation may be postponed, as an exception, until the request has been carried out, in the mentioned circumstance of risks. This limitation, which aims to ensure a fair balance between the rights of the data subjects to be informed about the transmission and the interests of the Member States to exchange information, in itself does not appear to raise fundamental questions from the point of view of the general principles of lawfulness, fairness and transparency.  However, the EDPS considers that the reference to the “national law of the requested Member State” may be confusing in that it seems to allow the introduction of national restrictions to the duty to inform. The EDPS is concerned that, if his interpretation is correct, the application of this provision in practice could hinder the harmonized application of the balance of interests achieved by the Proposal. The EDPS therefore 11 | P a g e recommends specifying that the reference to the national law of the requested Member State under

text: Article 63(4)

text: does not allow further limitations on the right to information to be introduced at national level, so that the specific measure envisaged to ensure fairness of the processing enshrined in this provision be consistently applied across the Union.  In addition, the EDPS recalls that, considering that the data subjects most likely to be affected by the Proposal are children (thus being less aware of the risks involved), the GDPR provides that children merit specific protection with regard to their personal data . With this in mind, the EDPS invites Member States authorities to consider appropriate measures (to the extent children or minors would be recipients of that information) to communicate in a concise, transparent, intelligible and easily accessible form, by using clear and plain language. 3.2 Access and rectification rights  In addition to his recommendations set out above, aiming at ensuring fairness of the processing, the EDPS considers that the Proposal would benefit from further strengthening of the protection for the fundamental rights and interests of the data subjects (including children). This would best be achieved by supplementing the Proposal with specific provisions to safeguard the rights of access and rectification of data subjects.  The EDPS points out that Article 8(2) of the Charter specifically stipulates that “everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified”. Consequently, the rights of access and rectification may be considered as essential components of the right to the protection of personal data. The right of access is of particular importance as it enables the data subjects to exercise the other rights provided for by data protection legislation, in particular, the individuals may become aware of any inaccuracies in their data and would be able to rectify these. These rights are further detailed under Articles 15 and 16 of the GDPR.  As explained above, Union or Member States law may provide restrictions to these rights within the limits established under Article 23 of the GDPR.

text: Article 23(2)

text: (c) of the GDPR requires that such a legislative measure contain specific provisions regarding “the scope of the restrictions introduced”.  In the absence of such restrictions under national law, the rights of access and rectification under Articles 15 and 16 of the GDPR will be directly applicable (from 25 May 2018). Conversely, if certain or all Member States choose to introduce restrictions to these rights applicable in the context of the Proposal, this would inevitably lead to divergence of standards and practices across Member States, resulting in inconsistent consideration and handling of access requests.  The EDPS has not performed a full assessment of the existence and extent of derogations provided under national law to the rights of access and rectification in the specific context of judicial or administrative proceedings in parental responsibility matters. Nevertheless, as the stated objective of the Proposal is to harmonise and 12 | P a g e enhance the effectiveness of such procedures in cases of cross-border cooperation, the EDPS considers relevant including in the Proposal itself a specific provision (cf.

text: Article 23(2)

text: (c) of the GDPR) to ensure the consistent application across the Union of the rights of access and rectification. This would help ensure that both parents and children (through their legal representative or as from the age of their majority) could invoke a right of access to the information exchanged in the context of the Proposal. It should be kept in mind that information exchanged in cases of parental responsibility is usually of sensitive nature and contributes to decisions that have important and often dramatic impact on the lives of individuals. Thus, it is important to consider the overall framework not only from the point of view of strict compliance with the right to personal data protection, but also with regard to the right to private and family life of the individuals concerned. For these reasons, the EDPS recommends that the EU legislator considers providing specific guarantees in this respect.  The EDPS recommends establishing in the Regulation, as a principle, the right of access of data subjects to the information transmitted to the requesting authority of a Member State. The EDPS further recommends, to the extent restrictions to the rights of access and rectification are considered necessary in the particular context of the Proposal, supplementing the Proposal with a clear and specific provision laying down “the scope of the restrictions”, in accordance with

text: Article 23(2)

text: (c) of the GDPR. The possibility to deny access temporarily, depending for instance on the timing of the procedure, the protection of the data subject (e.g. the best interests of the child) or of the rights and freedoms of others should be defined in the Proposal.

text: 4. CONCLUSION

text: Lawfulness of the processing

text: 38. As a main recommendation and in order to strengthen the lawfulness of the processing envisaged (under Articles

text: and

text: (g) of the GDPR) and considering the context and aim of the Proposal, the EDPS recommends clarifying the scope and purpose(s) of the cooperation established under Chapter V of the Proposal:  The EDPS recommends clarifying whether the cooperation framework set up under Chapter V of the Proposal covers parental responsibility matters only or includes international child abduction as well. Considering that Chapter V includes both areas of cooperation, and in order to provide more legal certainty and to satisfy the requirements of the purpose limitation principle, the EDPS considers that

text: Article 63(3)

text: should be modified to narrow the purposes to “cooperation in specific cases relating to parental responsibility and international child abduction”, thus excluding “matrimonial matters”, which is the other major area covered by the Regulation. The definitions of “competent authority” etc. should be adapted accordingly.

text: 39. As an additional recommendation to strengthen the lawfulness of the processing:  The EDPS would welcome an explicit reference to the principles of data quality and data minimisation under Article 64(1) of the Proposal. 13 | P a g e Suitable and specific measures to safeguard the fundamental rights and interests of the data subject

text: 40. As a main recommendation:  The EDPS recommends specifying that the reference to the national law of the requested Member State under

text: Article 63(4)

text: 41. As an additional recommendation, the EDPS suggests supplementing the Proposal with specific measures to safeguard the rights access and rectification of data subjects:  The EDPS recommends establishing in the Regulation, as a principle, the right of access of data subjects to the information transmitted to the requesting authority of a Member State. The EDPS further recommends, to the extent restrictions to the rights of access and rectification are considered necessary in the particular context of the Proposal, supplementing the Proposal with a clear and specific provision laying down “the scope of the restrictions”, in accordance with

text: Article 23(2)

text: (c) of the GDPR. Brussels, 15 February 2018 (signed) Giovanni BUTTARELLI European Data Protection Supervisor 14 | P a g e

text: Notes

text: 15 | P a g e