text: COM(2023) 367 final. COM(2023) 366 final. 1

text: OJ L 295, 21.11.2018, p. 39. 4 COM(2023) 367 final. COM(2023) 366 final. 6

text: Directive (EU) 2015/2366

text: of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives

text: and

text: and

text: Regulation (EU) No 1093/2010

text: , and repealing Directive

text: , OJ L 337, 23.12.2015, p. 35. 7 COM(2023) 367 final, page 5-6. 4

text: COM(2023) 360 final. 9 COM(2023) 367 final, page 4. 10 Articles 4-26 of the PSR Proposal. 11 Articles 35-38 of the PSR Proposal. 12 Article 43 of the PSR Proposal. 13 Article 80 of the PSR Proposal. 14 Articles 82-84 of the PSR Proposal. 15 Articles 85-86 of the PSR Proposal. 16 Chapter 8 of the PSR Proposal. 17 Chapter 9 of the PSR Proposal. 18 COM(2023) 367 final, page 7. 5

text: COM(2023) 367 final, page 8. 20

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1. 21 COM(2023) 367 final, page 8. 6

text: EDPB Guidelines in 2020 on the interplay of the Second Payment Services Directive and the GDPR, adopted on 15 December 2020, paragraph 44. 23 In the same vein, the EDPS and the EDPB have recommended to avoid any ambiguity between the term ‘permission’ within the meaning of the Data Governance Act (‘DGA’) and legal basis under

text: Article 6

text: GDPR. See EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a Regulation of the European Parliament and of the Council on European data governance (Data Governance Act), version 1.1, adopted on 9 June 2021, paragraphs 41, 45, 47, 48, 49, 50, 102; see in particular paragraph 50: “The EDPB and the EDPS also remark that in case of processing of personal data the “permission” referred to in the Proposal cannot replace the necessity of one appropriate legal ground under Article 6(1) of the GDPR for the lawful processing of personal data. In other words, according to the GDPR the processing of personal data shall be lawful only if and to the extent that at least one of the legal basis under Article 6(1) of the GDPR applies. The Proposal should clearly specify this aspect to avoid any ambiguity.” 24 Recital (10) of the FIDA Proposal states that “Where the processing of personal data is involved, a data user should have a valid lawful basis for processing under

text: Regulation (EU) 2016/679

text: ”. 25 See in the same vein also Recital 48 of the FIDA Proposal “The granting of permission by a customer is without prejudice to the obligations of data users under

text: Article 6 of Regulation (EU) 2016/679

text: . Personal data that are made available and shared with a data user should only be processed for services provided by a data user where there is a valid legal basis under

text: Article 6(1) of Regulation (EU) 2016/679

text: and, when applicable, where the requirements of Article 9 of that Regulation on the processing of special categories of data are met.” 7

text: EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR, 7 July 2021, p. 45 (paragraph 167 and footnote 76). 27 ECB Final Recommendations for the security of payment account access services following public consultation, May 2014, page 5. 28 Draft BSG response to EBA/DP/2015/03 on future draft regulatory technical standards on strong customer authentication and secure communication under the revised payment services directive (psd2), page 2. 29 Under Article 3(38) of the PSR Proposal, “‘sensitive payment data’ means data which can be used to carry out fraud, including personalised security credentials.” 30 Storing the PSU’s credentials in multiple storage location would increase the attack surface and therefore the risk of unauthorised access (e.g. due to a data breach). Moreover, access to PSU’s credentials would increase the risk of unauthorised data processing, since the credentials could be used by AISPs or PISPs to bypass the allowed use of the dedicated data access interface (e.g. an AISP connecting to the web interface of the ASPSP). In addition, allowing the PSU to share with third parties the credentials they use to authenticate with the ASPSP would be in breach of best practices and standards on security. For example, ISO 27002:2022 lists among the user responsibilities to requirement to keep confidential “secret authentication information such as passwords”, while also stating, “Personal secret authentication information is not to be shared with anyone.” 8

text: Article 89(1)

text: (a) and (c) of the PSR Proposal;

text: Article 89(2)

text: (b) of the PSR Proposal provides that, when developing the regulatory technical standards, the EBA shall take into account “the need to ensure the safety of payment service users’ funds and personal data”. 32 See EDPB Guidelines on the interplay of the PSD2 with the GDPR, adopted on 15 December 2020, paragraph 52. See also judgment of the Court of Justice of 1 August 2022, OT v Vyriausioji tarnybinės etikos komisija,

text: , ECLI:EU:C:2022:601, paragraphs 117- 128 and judgment of the Court of Justice of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C- 252/21, ECLI:EU:C:2023:537, paragraphs 69-73. 33 See judgment of the Court of Justice of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C- 252/21, ECLI:EU:C:2023:537, paragraph 93 “[..] the justifications provided for in that latter provision, in so far as they allow the processing of personal data carried out in the absence of the data subject’s consent to be made lawful, must be interpreted restrictively (see, to that effect, judgment of 24 February 2022, Valsts ieņēmumu dienests (Processing of personal data for tax purposes),

text: , EU:C:2022:124, paragraph 73 and the case-law cited)” and paragraphs 133-134. 9

text: See also EDPS Opinion 33/2023 on the Proposal for a Regulation in matters relating to the protection of adults, issued on 18 July 2023, paragraphs 14-15. 35 Judgment of the Court of Justice of 22 June 2021, Latvijas Republikas Saeima (Penalty points),

text: , EU:C:2021:504, paragraph 105. 36 Although the types of services covered by the PSR Proposal seem to be substantially the same as the ones under the PSD2, Recital 26 also highlights that new open banking-based business model requires a modification of the definition of account information services to clarify that the information aggregated by the authorised account information service provider may be transmitted to a third party to enable that third party to provide another service to the end-user, with the end-user’s permission. 37 See also the EDPB Guidelines on the interplay of the PSD2 with the GDPR, adopted on 15 December 2020, paragraph 56 [emphasis added]: “Payments services may process special categories personal data for reasons of substantial public interest, but only when all the conditions of

text: Article 9(2)

text: (g) of the GDPR are met. This means that the processing of the special categories of personal data has to be addressed in a specific derogation to

text: article 9(1)

text: GDPR in Union or Member State law. This provision will have to address the proportionality in relation to the pursued aim of the processing and contain suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. Furthermore, this provision under Union or Member State law will have to respect the essence of the right to data protection. Finally, the processing of the special categories of data must also be demonstrated to be necessary for the reason of the substantial public interest, including interests of systemic importance. Only when all of these conditions are fully met, this derogation could be made applicable to designated types of payment services.” 10

text: Article 5(1)

text: (c) and

text: Article 25(1)

text: GDPR. 39 According to Article 43(2) of the PSR Proposal, the dashboard must provide the PSU with information on: (i) the name of the account information service provider or payment initiation service provider to which access has been granted; (ii) the customer account to which access has been granted; (iii) the purpose of the permission; (iv) the period of validity of the permission; (v) the categories of data being shared. See also Recital 65 of the PSR Proposal. 40

text: Article 43(2)

text: (v) of the PSR Proposal. 41 In line with

text: Article 8(2)

text: (a)(ii) of the FIDA Proposal. 42 See

text: Article 46(2)

text: (c) and 47(2)(b) of the PSR Proposal. 11

text: Article 43(2)

text: (a) of the PSR Proposal. 44 See also paragraphs 17 and 18 of this Opinion. 45 The Finance Innovation Lab, ‘Open Finance and Vulnerability - A Policy Discussion Paper’, July 2021, page 9: “Terms and conditions around data sharing are difficult to understand and time consuming to read. Researchers at the LSE have found that this makes determining ‘informed consent’ in financial services very difficult. Contracts often involve complex data chains, which cede control of data to many more firms than is at first apparent. This can result in data sharing impacting access to multiple services. There is therefore a real danger that people will fail to understand the full implications of allowing access to open finance data.”, see also at page 10: “There is a risk that data sharing becomes a prerequisite for accessing essential financial services.” 46

text: Article 83(1)

text: (c) of the PSR Proposal. 12

text: COM(2023) 367 final, page 13. 48 See reference to fraud prevention in Recital 47 GDPR as one of the possible legitimate interests protected by

text: Article 6(1)

text: (f) GDPR. 49 Fashion ID See Judgment of the Court of Justice of 29 July 2019, ,

text: , ECLI:EU:C:2019:629, paragraph 95. 13

text: See also Recital 102 of the PSR Proposal. 51 Article 83(4) of the PSR Proposal. 52 Article 83(6) of the PSR Proposal. 53

text: Article 89(1)

text: (g) and (2) of the PSR Proposal. 14

text: See also Recital 76 of the PSD3 Proposal: “Any personal data processing in the context of this Directive must comply with

text: Regulation (EU) 2016/679

text: and

text: Regulation (EU) 2018/1725

text: . Therefore, the supervisory authorities under

text: Regulation (EU) 2016/679

text: and

text: Regulation (EU) 2018/1725

text: are responsible for the supervision of processing of personal data carried out in the context of this Directive.” 55 Article 101(2) of the PSR Proposal. See also Recital 136 of the PSR Proposal. 56

text: Article 5(1)

text: (c) GDPR. 15

identifier: EDPS yttrande 39/2023

amnesord:
Finance
Internal Market

title: EDPS Opinion 39/2023 on the Proposal for a Regulation on payment services in the internal market and the Proposal for a Directive on payment services and electronic money services in the Internal Market

text: 22 August 2023

text: Opinion 39/2023

text: on the Proposal for a Regulation on payment services in the internal market and the Proposal for a Directive on payment services and electronic money services in the Internal Market

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’. This Opinion relates to the Proposal for a Regulation on payment services in the internal market and the Proposal for a Directive on payment services and electronic money services in the Internal Market . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 28 June 2023, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on payment services in the internal market and amending

text: Regulation (EU) No 1093/2010

text: (the ‘PSR Proposal’) and a Proposal for a Directive of the European Parliament and of the Council on payment services and electronic money services in the Internal Market amending Directive

text: , and repealing Directives

text: and

text: (the ‘PSD3 Proposal’), together ‘the Proposals’.

text: Payment services often involve processing of personal data which can reveal sensitive information about an individual data subject. The EDPS therefore welcomes the efforts made to ensure consistency with the General Data Protection Regulation (‘GDPR’). He also stresses the need to clearly differentiate the ‘permissions’ under Proposal from and the legal basis for processing of personal data under the GDPR.

text: One of the aims of the Proposal is to enable providers of payment systems and of payment services to process special categories of personal data in the public interest of the well-functioning of the internal market for payment services. As the processing of such data is liable to constitute a serious interference with the rights to respect for private life and to the protection of personal data, it is important that legislation be precise enough to show the objective connection between each category of data in a specific payment context and the public interest objective to be achieved.

text: The EDPS welcomes that the Proposal would require account servicing payment service providers (‘ASPSPs’) to provide the user with a dashboard to monitor and manage the permission she or he has granted. To further reduce the risk of unlawful sharing of personal data by ASPSPs, the EDPS recommends:

text: ◦ ensuring that the dashboard makes reference to the specific designated payment service(s) for which she or he granted her/his permission; ◦ ensuring that access requests remain limited to what is necessary to provide the requested service; ◦ ensuring clarity regarding the legal basis of access requests; ◦ allowing ASPSPs to verify the permission granted by the payment service user or to introduce appropriate alternative safeguards in the PSR Proposal.

text: Finally, the EDPS recommends ensuring close cooperation between competent authorities under the Proposal and data protection supervisory authorities to ensure consistency between the application and enforcement of the Proposal and EU data protection law. The EDPS therefore recommends expressly referring to supervisory authorities responsible for monitoring and enforcing data protection law in Article 93(3) of the PSR Proposal.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 28 June 2023, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on payment services in the internal market and amending

text: Regulation (EU) No 1093/2010

text: (the ‘Payment Services Regulation Proposal’ or ‘PSR Proposal’) and a Proposal for a Directive of the European Parliament and of the Council on payment services and electronic money services in the Internal Market amending Directive

text: , and repealing Directives

text: and

text: (the ‘Payment Services Directive 3 Proposal’ or ‘PSD3 Proposal’) , hereinafter referred together as ‘the Proposals’.

text: 2. Three Annexes accompany both the PSR Proposal and the PSD3 Proposal (six Annexes in total), outlining the types of payment services (Annex I), as well as the type of electronic money services (Annex II) falling under the scope of the draft Proposals. Finally, Annex III provides a correlation table on the provisions of Directives

text: and

text: with the provisions in the Proposals.

text: 3. The EDPS notes that the types of services covered by the Proposals seem to be essentially the same as the ones covered by

text: Directive (EU) 2015/2366

text: and

text: and

text: Regulation (EU) No 1093/2010

text: , and repealing Directive

text: (‘PSD2’) .

text: 4. The specific objectives of the PSR Proposal are to: a. strengthen user protection and confidence in payments, notably by: improving the application of Strong Customer Authentication (SCA); creating a legal basis for exchange of information on fraud; extending International Bank Account Number (‘IBAN’) verification to all credit transfers; and improving user rights and information; b. improve the competitiveness of open banking services by: (i) requiring account servicing payment service providers (‘ASPSPs’) to put in place a dedicated data access interface and “permissions dashboards” to allow users to manage their granted open banking access permissions; and (ii) setting out more detailed specifications of minimum requirements for open banking data interfaces; c. improve enforcement and implementation of the legal framework for payment services in Member States, notably by: replacing the PSD2 with a directly applicable Regulation (‘PSR Proposal’) clarifying aspects of the PSD2 which are unclear; and improving cooperation between competent authorities and other authorities; and d. improve (direct or indirect) access to payment systems and bank accounts for nonbank PSPs, including payment initiation service providers (PISPs) and account initiation service providers (AISPs).

text: 5. The Proposals are presented in conjunction with the Proposal for Regulation on Financial Information Data Access (‘the FIDA Proposal’) , covering among others access to financial data other than payment account data, which falls under the scope of the Proposals that form the subject matter of the present Opinion .

text: 6. In essence, the PSR Proposal would: a. establish requirements on transparency of conditions and information requirements for payment services ; b. establish rights and obligations in relation to the provision and use of payment services, including rules on data access interfaces for account information services and payment initiation services and on data access management by payment 12 13 service users ; on data protection ; on fraud reporting and transaction monitoring 14 15 mechanisms and fraud data sharing ; on SCA ; on enforcement procedures, competent authorities and penalties ; on intervention powers by the European Banking Authority (EBA) .

text: 7. The PSD3 Proposal is largely based on Title II of the current PSD2, regarding “Payment Service Providers”, which only applies to payment institutions. It updates and clarifies the provisions relating to payment institutions and integrates electronic money institutions as a sub-category of payment institutions. It also includes provisions concerning cash withdrawal services provided by retailers or independent ATM deployers .

text: 8. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 29 June 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 147 of the PSR Proposal and Recital 77 of the PSD3 Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted on the Proposals pursuant to Recital (60) of the EUDPR.

text: 2. General remarks

text: 9. The EDPS recognises the importance of strengthening user protection and confidence in payments. He also supports the aim of improving the enforcement and implementation of the regulatory framework applicable to payment services in Member States, as well as the aim of improving the competitiveness of open banking services.

text: 10. The Explanatory Memorandum to the PSR Proposal notes that the fundamental right to data protection is particularly concerned by this Proposal . It also underlines that the processing of personal data must be in line with the General Data Protection Regulation (‘GDPR’) , which applies directly to all of the payment services concerned by the PSR Proposal.

text: 11. The EDPS welcomes Recital 97 of the PSR Proposal, stating in particular that where personal data are processed, the processing should comply with the GDPR, including the principles of purpose limitation, data minimisation and storage limitation. He also welcomes the explicit confirmation that the supervisory authorities under the GDPR and the EUDPR should be responsible for the supervision of processing of personal data carried out in the context of the PSR Proposal. The EDPS also welcomes Recital 99 of the PSR proposal, specifying that the provision of information to individuals about the processing of personal data should be carried out in accordance with the GDPR and the EUDPR.

text: 12. The EDPS notes that PSR Proposal seeks to ensure coherence with the FIDA Proposal. In this regard, the EDPS refers to the recommendations made in his Opinion on the FIDA Proposal, in particular in relation the term ‘permission’, which is referred to both in the PSR Proposal and in the FIDA Proposal.

text: 3. The role of ‘permissions’

text: 13. The EDPS welcomes that the PSR Proposal aims at addressing some of the interactions between the PSD2 and the EU data protection framework. One such interaction, also mentioned in the Guidelines issued by the EDPB on the matter , concerns the distinction between ‘explicit consent’ under the PSD2, on the one hand, and ‘consent’ and ‘explicit ‘consent’ under the GDPR, on the other hand.

text: 14. The EDPS remarks that Recital 69 of the PSR Proposal specifies that “(..) permission should not be construed exclusively as ‘consent’ or ‘explicit consent’ as defined in

text: Regulation (EU) 2016/679

text: ”. The EDPS considers that the term ‘exclusively’ introduces a degree of uncertainty and does not allow to differentiate clearly between ‘permission’ (referring to the acceptance of the commercial service by the consumer), on the one hand, and ‘consent’ (under

text: Article 6(1)

text: (a) GDPR) or ‘explicit consent’ (under

text: Article 9(2)

text: (a) GDPR), on the other hand. Recital (69) should therefore be amended to clarify that “permission should not be construed as ‘consent’ or ‘explicit consent’ or ‘necessity for the performance of a contract’ as defined in

text: Regulation (EU) 2016/679

text: 15. The EDPS also recommends specifying - similarly to recital 10 of the FIDA Proposal - the need for payment initiation service providers (PISPs) and account information service providers (AISPs) to secure a lawful ground under the GDPR to process personal data . Likewise, the EDPS recommends clarifying that the granting of permission by a payment service user is without prejudice in particular to the obligations of data users under

text: Article 6

text: and Article 9 of the GDPR .

text: 4. Verification of the permission by the ASPSP

text: 16. The EDPS notes that

text: Article 43(4)

text: (b) of the PSR Proposal would require payment initiation service providers (PISPs) and account information service providers (AISPs) to inform account servicing payment service providers (‘ASPSPs’) in real time of a new permission granted by a payment service user.

text: 17. The EDPS is concerned, however, that

text: Article 44(1)

text: (c) and Article 49(4) of the PSR Proposal would prevent ASPSPs from verifying the permission given by the payment service user to PISPs and AISPs to access their payment account information. Although the term ‘permission’ should not be construed as ‘consent’ or ‘explicit consent’ within the meaning of the GDPR, a prohibition to verify the permission given by the user may lead ASPSPs to share personal data with third parties that have not secured an appropriate lawful ground under the GDPR (or to share more personal data than intended by the user).

text: 18. Each controller has the duty to ensure that personal data are not further processed in a manner that is incompatible with the purposes for which they were originally collected. Each disclosure by a controller requires a lawful basis and assessment of compatibility, regardless of whether the recipient is a separate controller or a joint controller . Therefore, the EDPS invites the colegislator to reconsider the prohibition applicable to ASPSPs to verify the permission under

text: Article 44(1)

text: (c) and Article 49(4) of the PSR Proposal. In particular, the EDPS recommends to either (i) delete the prohibition applicable to ASPSPs to verify the data access permission under

text: Article 44(1)

text: (c) and 49(4) of the PSR Proposal; or (ii) to introduce appropriate safeguards to protect payment service users against the risk of potential unlawful sharing of personal data by ASPSPs that this prohibition may entail.

text: 5. Strong customer authentication procedures and use of personalised security credentials

text: 19. In 2014, the European Central Bank (‘the ECB’) recommended that “There should be no sharing of credentials between the TPPs [Third Party Providers] and the account-servicing PSP; the TPP should either redirect the payer in a secure manner to its account servicing payment service provider or issue its own credentials. Both options should form part of a standardised European interface for payment account access that needs to be developed.” In 2016, the EBA Banking Shareholder Group also stated: “In order to protect the consumers, reduce risk and avoid fraud, we recommend that PSC [Personalised Security Credentials] should not be accessed directly by TPP [Third Party Providers]” .

text: 20. The EDPS notes that Article 86(2) of the PSR Proposal would allow PISPs and AISPs to ‘rely on’ the authentication procedures provided by the ASPSP to the payment service user. At the same time, PISPs would be prevented from ‘storing’ (

text: Articles 46(2)

text: (a)) and AISPs would be prevented from ‘requesting’ (

text: Article 47(2)

text: (a)) ‘sensitive payment data’, which includes ‘personalised security credentials’ .

text: 21. The EDPS considers that any possible sharing with PISPs and AISPs of the credentials that the payment service user uses to authenticate with the ASPSP would create unnecessary risks and should therefore be excluded. To avoid any possible ambiguity, the EDPS recommends amending

text: Articles 46(2)

text: (a) and 47(2)(a) of the PSR Proposal to state that PISPs and AISPs shall not access (and not merely ‘not store’ or ‘not request’) personalised security credentials provided by the ASPSP.

text: Article 89(1)

text: would require the EBA to develop draft regulatory technical standards to specify the requirements of strong customer authentication (SCA). The EBA would also be required to specify the requirements with which security measures have to comply to protect the confidentiality and the integrity of the payment service users’ personalised security credentials . The Commission would be delegated the power to adopt the standards developed by the EBA in accordance with

text: Articles 10

text: to 14 of

text: Regulation (EU) No 1093/2010

text: . In this regard, the EDPS reminds the Commission of its obligation to consult the EDPS when preparing delegated or implementing acts that would impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data pursuant to Article 42(1) of the EUDPR.

text: 23. Finally, the EDPS also recommends clarifying the definition of ‘sensitive payment data’ under Article 3(38) of the PSR Proposal (referred to, in broad way, as “data which can be used to carry out fraud, including personalised security credentials.”) by further specifying the categories of personal data falling under this definition.

text: 6. Special categories of personal data

text: 24. Financial transactions can reveal sensitive information about an individual data subject, including those related to special categories of personal data . Article 80 of the PSR Proposal, read in the light of Recital 98 of the PSR Proposal, states that payment systems and payment service providers must be allowed to process special categories of personal data as referred to in

text: Article 9(1)

text: GDPR and

text: Article 10(1)

text: EUDPR to the extent necessary for the provision of payment services and for compliance with obligations under this Regulation in the public interest of the well-functioning of the internal market for payment services, subject to appropriate safeguards for the fundamental rights and freedoms of natural persons.

text: Article 80

text: also provides a (non-exhaustive) list of such safeguards.

text: Article 9(2)

text: (g) GDPR, which allows for an exception to the prohibition to process special categories of personal data under

text: Article 9(1)

text: GDPR for reasons of substantial public interest, is qualified by a number of conditions and should be interpreted restrictively . These conditions are: (i) the processing of personal data must be necessary for the stated purpose; (ii) it must be based on a Union or Member State law; and (iii) the Union or Member State law itself must be proportionate to the specific objective pursued, respect the essence of the fundamental rights to privacy and to the protection of personal data; and provide for suitable and specific measures to safeguard the fundamental rights and the interests of individuals concerned .

text: 26. The EDPS considers that Article 80 of the PSR Proposal does not satisfy the requirements of necessity and proportionality. Under the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others. They must apply only in so far as is strictly necessary and the legislation which entails the interference must lay down clear and precise rules governing the scope and application of the measure in question . Strict compliance with the principles of necessity and proportionality is particularly important where processing of special categories of personal data are concerned, as the processing of such data is liable to constitute a serious interference with the rights to respect for private life and to the protection of personal data. In light of the seriousness of the interference entailed by the processing of special categories of data, it is important that legislation be precise enough to show the objective connection between each category of data in a specific payment context and the public interest objective to be achieved.

text: 27. In order to satisfy the requirements of necessity and proportionality, the PSR Proposal should: a. further delineate the specific purposes of the processing, by specifying the type(s) of payment service(s) for which the payment systems and payment service providers would be entitled to process which special categories of personal data . The PSR Proposal should also provide justifications (in a recital) as to why the processing of the special categories of personal data for the designated service at stake is strictly necessary and cannot be avoided (i.e. it would not be possible to avoid processing of such data); and b. clearly indicate which special categories of personal data would be necessary to achieve the specific purpose and to whom (exactly which type of commercial operators) this legal basis would apply.

text: 28. The EDPS considers that in some cases, for instance with regard to the multi-factor authentication of the payment service user, where it is possible to use non-biometric means of authentication, (explicit) consent of the data subject may be a more appropriate ground for processing sensitive data in accordance with Article 6 and 9 of the GDPR.

text: 29. As regards the safeguards required under

text: Article 9(2)

text: (g) GDPR, the EDPS welcomes the non-exhaustive list of safeguards provided in Article 80 of the PSR Proposal. However, the EDPS recommends also including a reference to log in registration (to verify if undue access took place) requirements.

text: 7. Provision of dedicated access interfaces

text: 30. The EDPS notes that Article 35(6) of the PSR Proposal on the setting up of a testing facility by ASPSPs for their dedicated interface prohibits the sharing of “sensitive payment data or any other personal data” through the facility. The EDPS welcomes this specification since personal data as a rule should also not be processed when testing a functionality, in line with the principles of data minimisation and of data protection by design and by default .

text: 8. Data access management

text: 31. The EDPS welcomes

text: Article 43

text: , requiring ASPSPs to provide the payment service user with a dashboard to monitor and manage the permission she or he has granted to AISPS or PISPs covering multiple and recurrent payments. With regard to the information which ASPSPs would be required to convey to payment service users via the dashboard , the EDPS welcomes in particular the reference to “the categories of data being shared” . This addition contributes ensuring effective overview and control of personal data flows by the payment service user that is a data subject under the GDPR. However, the EDPS recommends adding to

text: Article 43(2)

text: (a) a reference to the designated service(s) for which the permission is granted .

text: 32. Concerning the specific obligations of PISPS and AISPs, the EDPS welcomes in particular the limitation that PISPs and AISPs can process personal data only for the provision of the payment or account information service for which the payment service user has granted her or his permission . The EDPS notes, however, that the requirement under letter (b) of

text: Article 46(2)

text: , according to which PISPs can request from the payment service user only the data that are necessary to provide the (payment initiation) service, is not included mutatis mutandis in

text: Article 47(2)

text: , concerning the obligations of AISPs. He therefore recommends inserting an equivalent provision in Article 47(2) of the PSR Proposal.

text: 33. The EDPS also takes positive note of the requirement for ASPSPs to provide payment service users via the dashboard an overview of each ongoing permission given for the account information service(s) or payment initiation service(s), including: the name of the PISP or AISP to which access has been granted; the customer account to which access has been granted; the purpose of the permission; a description of the categories of data being shared; and the period of validity of the permission . To ensure that ASPSPs are able to convey all elements of information under Article 43(2) of the PSR Proposal to payment service users, the EDPS recommends that PISPs and AISPs are required under

text: Article 43(4)

text: (b) to also inform ASPSPs about the customer account to which access is being sought.

text: 34. Additionally, the EDPS recommends that

text: Article 43(4)

text: (b) of the PSR Proposal requires PISPs and AISPs to inform ASPSPs about the legal basis under

text: Article 6(1)

text: GDPR and (if applicable) the exception under

text: Article 9(2)

text: GDPR that they would rely on to access the (special categories of) personal data of the payment service user. This would help prevent ASPSPs from granting access to personal data in the absence of an appropriate GDPR legal basis .

text: 35. The EDPS welcomes the requirement under Article 43(3) of the PSR Proposal that the dashboard should be “easy to find in its user interface and that information displayed on the dashboard is clear, accurate and easily understandable for the payment service user”. Recital 65 of the PSR Proposal adds that the dashboard “should empower customers to manage their permissions in an informed and impartial manner and give customers a strong measure of control over how their personal and non-personal data is used.”

text: 36. Indeed, in a sensitive area such as payment services, consumers may be particularly unaware of the consequences of sharing their personal data with payment service providers . The EDPS therefore recommends that the PSR Proposal, notably

text: Article 43

text: (b), specifies that the dashboard should not be designed in a way that would unduly influence payment service users to grant or withdraw permissions.

text: 9. Transaction monitoring mechanisms and fraud data sharing

text: 37. Article 83 of the PSR Proposal would establish the obligation for payment service providers to have transaction monitoring mechanisms in place that, among others, enable payment service providers to prevent and detect potentially fraudulent payment transactions, including transactions involving PISPs .

text: 38. Article 83(2) of the PSR Proposal establishes that transaction monitoring mechanisms would be “based on the analysis of previous payment transactions and access to payment accounts online” and specifies the data required for this purpose, namely: (a) information on the payment service user, including the environmental and behavioural characteristics which are typical of the payment service user in the circumstances of a normal use of the personalised security credentials; (b) information on the payment account, including the payment transaction history; (c) transaction information, including the transaction amount and unique identifier of the payee; (d) session data, including the device internet protocol address-range from which the payment account has been accessed.

text: Article 83(3)

text: also specifies that transaction monitoring mechanisms should consider, at a minimum, the following risk factors: (a) lists of compromised or stolen authentication elements; (b) the amount of each payment transaction; (c) known fraud scenarios in the provision of payment services; (d) signs of malware infection in any sessions of the authentication procedure; (e) the abnormal use of the access device or the software (in case the access device or the software is provided by the payment service provider).

text: 40. The EDPS welcomes that the Proposal aims to set out, in an exhaustive manner, the categories of data that may be used for transaction monitoring mechanisms purposes. He notes, however, that certain categories of personal data remain considerably broad, taking into account that the Explanatory Memorandum mentions as “environmental and behavioural characteristics” the “location of the payment service user, time of transaction, device being used, spending habits, online store where the purchase is carried out.”

text: 41. The EDPS also notes that payment service providers already carry out data processing activities for fraud monitoring purposes on the basis of the

text: Article 6(1)

text: (f) GDPR (legitimate interests) . This legal basis requires controllers - such as payment service providers - to carry out a careful balancing test. In order to rely on

text: Article 6(1)

text: (f) GDPR, three cumulative conditions should be met, namely: (i) the pursuit of a legitimate interest by the data controller or by the third party or parties to whom the data are disclosed, (ii) the need to process personal data for the purposes of the legitimate interests pursued, and (iii) the condition that the fundamental rights and freedoms of the data subject whose data require protection do not take precedence .The new provisions in Article 83 of the PSR Proposal would, however, create a legal obligation for payment service providers to conduct such processing activities within the meaning of

text: Article 6(1)

text: (c) GDPR. While the processing should still be ‘limited’ to the categories of data listed, the Proposal does not require payment service providers to carry out a balancing exercise before processing personal data of PSUs for fraud monitoring purposes pursuant to the PSR Proposal.

text: 42. As the PSR Proposal would provide for a legal obligation to process personal data, it should clearly define the boundaries of such processing. This requires clearly determining the categories of personal data that payment service providers would be allowed to process in the context of transaction monitoring mechanisms. In this regard, the EDPS recommends to provide a clear and comprehensive definition of the “information on the payment service user” referred to in

text: Article 83(2)

text: (a) of the Proposal. In addition, the EDPS recommends explicitly stating that the processing of the data categories listed in paragraph 2 may only be performed ‘insofar as necessary’ to achieve the purposes referred to in Article 83(1) of the PSR Proposal. Finally, he recommends defining appropriate maximum data storage periods for the personal data collected under

text: Article 83

text: 43. The EDPS welcomes that the information sharing arrangements between payment service providers must be preceded by a data protection impact assessment (DPIA) within the meaning of

text: Article 35

text: GDPR, to be conducted jointly by the payment service providers participating in the arrangement , as well as to prior consultation when applicable under

text: Article 36

text: GDPR. At the same time, the EDPS notes that the term “information sharing agreement” is not defined in the PSR Proposal and recommends including a definition in Article 3 of the PSR Proposal.

text: 44. The EDPS welcomes that the processing of personal data in accordance with the information sharing arrangement cannot lead to termination of customer relationship with the payment service provider or affect his or her future on-boarding by another payment service provider . This is an important safeguard with regard to the possible impact on the person concerned by the processing of personal data in the context of transaction monitoring mechanisms. However, the EDPS recommends expressly providing in the PSR Proposal - more broadly - that any processing of personal data for the purpose of complying with the fraud prevention legal obligations under

text: Article 83

text: (not only pursuant to

text: Article 83(4)

text: ) can only occur for the specific purpose of fraud prevention and cannot lead to termination of customer relationship with the payment service provider or affect the onboarding of the payment service user with another payment service provider.

text: 45. The EDPS notes that the technical requirements for transaction monitoring mechanisms would be specified in draft regulatory technical standards developed by the EBA and adopted by the Commission via an implementing act . In this regard, the EDPS reminds the Commission of its obligation to consult the EDPS when preparing implementing acts that would impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data pursuant to Article 42(1) of the EUDPR.

text: 10. Competent authorities

text: 46. According to Article 91(2) of the PSR Proposal, Member States must designate competent authorities to ensure and monitor effective compliance with the PSR Proposal. These authorities would be either (a) public authorities or (b) bodies recognised by national law or by public authorities expressly empowered for that purpose by national law, including national central banks.

text: Article 93(3)

text: provides that in the exercise of their investigatory and sanctioning powers, including in cross-border cases, competent authorities must cooperate with each other and ensure mutual assistance to the other authorities concerned.

text: 47. Recital 130 of the PSR Proposal rightly stresses that the effectiveness of the legal framework for payment services depends on cooperation between competent authorities, including national authorities responsible for data protection . The EDPS considers that such cooperation would contribute ensuring consistency between the application and enforcement of the PSR Proposal and EU data protection law.

text: 48. In order to ensure a clear legal basis for the exchange of relevant information, the EDPS recommends that supervisory authorities responsible for monitoring and enforcing data protection law be explicitly mentioned in Article 93(3) of the PSR Proposal.

text: 11. Publication of administrative sanctions and measures

text: 49. Article 101(1) of the PSR Proposal provides that in the context of the publication on their website of decisions imposing an administrative sanction or administrative measure on legal and natural persons for breaches of this regulation, and where applicable, settlement agreements, the identity of the natural person subject to the decision imposing an administrative sanction or administrative measure would not be published. Only by derogation from

text: Article 101(1)

text: , where the publication of the identity or other personal data of natural persons is deemed necessary by the competent authority, the national competent authority may publish also the identity of the person concerned .

text: 50. The EDPS considers that the publication of personal data with the decisions of competent authorities should indeed be the exception, to be decided following a case-by-case assessment. This would leave the option, following such assessment, to competent authorities to publish said personal data in cases of serious infringements and where strong dissuasive effects are needed. The EDPS notes that the publication of personal data of persons who have been sanctioned for an infringement of the Regulation should only occur in duly justified exceptional cases, as making such types of personal data available to the general public could be considered as a serious interference with their fundamental rights enshrined in Articles 7 and 8 of the Charter.

text: 51. Finally, the EDPS welcomes that Article 101(4) of the PSR Proposal states, in accordance with the principle of storage limitation , that personal data contained in the publication must be kept on the official website of the competent authority only if an annual review shows the continued need to publish that data to protect the stability of the financial markets or to ensure the effective enforcement of the PSR Proposal, and in any event for no longer than 5 years.

text: 12. Conclusions

text: 52. In light of the above, the EDPS makes the following recommendations: (1) to clearly differentiate between the term ‘permission’ and the legal basis for processing under the GDPR, by clarifying in Recital 62 of the PSR Proposal that ₙpermission should not be construed as ‘consent’ or ‘explicit consent’ or ‘necessity for the performance of a contract’ as defined in

text: Regulation (EU) 2016/679

text: ”; (2) to clarify, by way of a recital, that the granting of permission by the payment service user is without prejudice in particular to the obligations of payment initiation service providers and account information service providers under

text: Article 6

text: and

text: Article 9 of Regulation (EU) 2016/679

text: ; (3) to reconsider the prohibition applicable to ASPSPs to verify the permission under Article 49(4) of the PSR Proposal or to introduce appropriate alternative safeguards in the enacting terms of the PSR Proposal to protect payment service users against the risk of potential unlawful sharing of personal data by ASPSPs that this prohibition may entail; (4) to amend

text: Articles 46(2)

text: (a) and 47(2)(a) of the PSR Proposal to state that payment initiation service providers and account information service providers shall not access personalised security credentials; (5) to clarify the definition of ‘sensitive payment data’ under Article 3(38) of the PSR Proposal, notably specifying the types of personal data covered by this definition; (6) to specify in relation to which specific type(s) of designated payment service(s) the payment systems and the payment service provider would be entitled to process (which categories of) special categories of personal data in Article 80 of the PSR Proposal; (7) to provide justifications (in a recital) as to why the processing of the special categories of personal data for the designated payment service(s) in Article 80 of the PSR Proposal is necessary and proportionate and cannot be avoided via alternative technical means; (8) to include a reference to log in registration (to verify if undue access took place) among the data protection safeguards referred to in Article 80 of the PSR Proposal; (10) to add to

text: Article 47(2)

text: , concerning the obligations of account information service providers, the requirement under

text: Article 46(2)

text: (b), according to which payment service providers can request from the payment service user only the data that are necessary to provide the requested service; (11) to require payment service providers and account information service providers under

text: Article 43(4)

text: (b) to inform account servicing payment service providers about the customer account to which access is being sought and about the legal basis under

text: Article 6(1)

text: Article 9(2)

text: GDPR that they would rely on to access the personal data of the payment service user; (12) to specify in

text: Article 43

text: (b) that the dashboard should not be designed in a way that would encourage or unduly influence payment service users to grant or withdraw permissions; 16 (13) to clearly determine the categories of personal data that payment service providers would be allowed to process in the context of transaction monitoring mechanisms (notably, providing a definition of “information on the payment service user” referred to in

text: Article 83(2)

text: (a)); (14) to define appropriate data storage periods for the personal data collected under

text: Article 83

text: ; (15) to include a definition of “information sharing agreement” in Article 3 of the PSR Proposal; (16) to provide in the PSR Proposal that any processing of personal data for the purpose of complying with the fraud prevention legal obligations under

text: Article 83

text: can only occur for this specific purpose and cannot lead to termination of customer relationship with the payment service provider or affect the on-boarding of the payment service user with another payment service provider; (17) to explicitly mention supervisory authorities responsible for monitoring and enforcing data protection law in Article 93(3) of the PSR Proposal. Brussels, 22 August 2023 Wojciech Rafał WIEWIÓROWSKI p.o. Leonardo CERVERA NAVAS Secretary-General 17


text: COM(2023) 402 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 402 final. 4

text: Regulation (EC) No 223/2009

text: of the European Parliament and of the Council of 11 March 2009 on European statistics and repealing Regulation (EC, Euratom) No 1101/2008 of the European Parliament and of the Council on the transmission of data subject to statistical confidentiality to the Statistical Office of the European Communities,

text: Council Regulation (EC) No 322/97

text: on Community Statistics, and

text: Council Decision 89/382/EEC

text: , Euratom establishing a Committee on the Statistical Programme of the European Communities, OJ L 87, 31.3.2009, p. 164. 5 “[t]he European Statistical System (ESS) is the partnership between the Article 4 of the

text: Regulation (EC) No 223/2009

text: states that Community statistical authority, which is the Commission (Eurostat), and the national statistical institutes (NSIs) and other national authorities responsible in each Member State for the development, production and dissemination of European statistics.” 6 COM(2023) 402 final, p. 1. 4

text: See COM(2023) 402 final, p. 1-2. 8 See also EDPS Opinion 2/2017 on the proposed common framework for European statistics relating to persons and households, issued on 1 March 2017, p. 3 and EDPS Opinion on the Proposal for a Regulation on European statistics on population and housing, issued on 16 March 2023, paragraph 5. 9

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: , OJ L 119, 4.5.2016, p. 1–88. 10

text: Article 5(1)

text: (b) GDPR and

text: Article 4(1)

text: (b) EUDPR. 11 See

text: Article 89 (1)

text: GDPR and

text: Article 13

text: EUDPR, which state that: “Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.” 5

text: See

text: Article 17 of Regulation (EC) No 223/2009

text: on the Commission’s annual work programme. 13 Recital (7) of the Proposal. 14 Recital (8) of the Proposal. 15 See European Statistical System, Position paper on access to privately held data which are of public interest, issued in November 2017, p. 3; and Eurostat, Privately held data communication toolkit, Eurostat manuals and guidelines, edition 2022, p. 5. See also EDPS Opinion on the Proposal for a Regulation on European statistics on population and housing, issued on 16 March 2023, paragraph 15. 16 See EDPS Opinion on the Proposal for a Regulation on European statistics on population and housing, issued on 16 March 2023, paragraph 15. 6

text: Article 89 of the GDPR and Article 13 of the EUDPR. 18 Directive

text: of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), OJ L 201, 31.7.2002, p. 37–47. 19 See by analogy also EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act), issued on 4 May 2022, paragraph 79. 20

text: Article 5(1)

text: (c) GDPR and

text: Article 4(1)

text: (c) EUDPR. The EDPS observes and welcomes the reiteration of this principle in

text: Article 17

text: c(2)(a) of the Proposal in relation to requests to private data holders for data by the NSIs or the Commission (Eurostat). 7

text: Proposal for a Regulation of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act), COM/2022/68 final. 22 EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act), issued on 4 May 2022, paragraphs 73-78. 8

text: See Commission Delegated

text: Regulation (EU) 2021/2223 of 30 September 2021

text: supplementing

text: Regulation (EU) 2019/817

text: of the European Parliament and of the Council with detailed rules on the operation of the central repository for reporting and statistics OJ L 448, 15.12.2021, p. 7–13. See on this points also EDPS Opinion on the Proposal for a Regulation on European statistics on population and housing, issued on 16 March 2023, paragraph 20. 24 Formal comments of the EDPS on the draft Commission Delegated Regulations supplementing

text: Regulation (EU) 2019/817

text: and

text: Regulation (EU) 2019/818

text: of the European Parliament and of the Council with detailed rules on the operation of the central repository for reporting and statistics, issued on 17 June 2021. 9

text: Such as the principles of necessity and proportionality and the need to have an appropriate legal basis under

text: Article 6

text: GDPR and/or

text: Article 5

text: EUDPR. 26 See also EDPS Opinion on the Proposal for a Regulation on European statistics on population and housing, issued on 16 March 2023, section 2. 27

text: Article 17

text: f(4)(b) of the draft Proposal. 28 See also EDPS Opinion on the Proposal for a Regulation on European statistics on population and housing, issued on 16 March 2023, section 4.2 on its references to privacy enhancing technologies. 29 Article 23 of the GDPR. 10

text: See EDPS Opinion on the Proposal for a Regulation on European statistics on population and housing, issued on 16 March 2023, section 4.2 on its references to privacy enhancing technologies. 11

identifier: EDPS yttrande 40/2023

amnesord:
Rights of the Individual
Large-Scale IT Systems

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 40/2023 on the Proposal for a Regulation on European Statistics

serie: yttranden

text: 06 September 2023

type: rubrik

text: Opinion 40/2023

text: on the Proposal for a Regulation on European statistics

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal on the draft Proposal for a Regulation of the European Parliament and of the Council amending

text: Regulation (EC) No 223/2009

text: on European statistics . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 10 of July 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council amending

text: Regulation (EC) No 223/2009

text: on European statistics (‘the Proposal’). The Proposal aims at making the legal framework governing European statistics fit for the future and improving the responsiveness of the European Statistical System to data needs.

text: The EDPS welcomes the objective of the Proposal, namely to make the legal framework governing European statistics fit for the future. The EDPS also recognises that new innovative approaches can bring promises for statistics and research. However, the EDPS has serious concerns regarding the indication that information relating to specific persons might be obtained from any source, including digital traces relating to specific persons held by private data holders. The EDPS considers that collection of personal data from such sources may not be necessary and proportionate to the aims pursued, having regard to the potential risks for the rights and freedoms of data subjects. Therefore, the EDPS considers it is necessary to clarify in the Proposal that only non-personal (anonymised) data will be requested from the private data holders by national statistical institutes or the Commission (Eurostat).

text: Insofar as the Proposal seeks to provide a legal basis to request personal data from private data holders, it should provide a clear and comprehensive overview of the categories of personal data concerned, taking into account the requirements of necessity and proportionality. Moreover, the sources from which those categories of personal data may be obtained should be clearly set out in the Proposal itself or in sectorial legislation. Further, the EDPS recommends that such sharing of personal data by private data holders shall make use of privacy-enhancing technologies and shall take place using a secure infrastructure.

text: As regards the collection of statistics from the Large-Scale IT systems (‘LSITs’) in the area of freedom, security and justice, the EDPS considers that the Proposal should be amended. In particular, the Proposal should clarify that LSITs statistics in the area of freedom, security and justice shall be gathered exclusively from the central repository for reporting and statistics (‘CRRS’). If necessary, the co-legislators could foresee in specific transitional measures until the CRRS is fully operational.

text: The EDPS welcomes that with regard to the sharing of data within the European Statistical System, the Proposal envisages the use of privacy-enhancing technologies. At the same time, the EDPS recalls that any sharing of personal data must in any event comply with all relevant provisions of the GDPR and EUDPR, including

text: Article 89(1)

text: GDPR and

text: Article 13

text: EUDPR. The EDPS recommends introducing the use of pilot studies to test and assess the fitness of relevant privacy enhancing technologies.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 10 of July 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council amending

text: Regulation (EC) No 223/2009

text: on European statistics (‘the Proposal’) .

text: 2. Regulation No 223/2009 establishes the legal framework at Union level for the development, production and dissemination of European statistics.

text: 3. The general objective of the Proposal is to make the legal framework governing European statistics fit for the future and to improve the responsiveness of the European Statistical System (‘ESS’) to data needs. The Proposal also seeks to provide a mechanism and tools for the ESS to react swiftly and in a collective and coordinated manner, to urgent data demands in times of crises .

text: 4. More specifically, the Proposal seeks to allow statistical authorities to tap the full potential of digital data sources and technologies by enabling their reuse for European statistics. The Proposal would help make the ESS more efficient and effective by promoting data sharing and strengthening its coordination. The Proposal would also: (a) strictly preserve statistical confidentiality and data privacy; (b) update the tasks of ESS partners; (c) outline possible roles for using opportunities offered by digital transformation for more cost-efficient and less burdensome statistical production; and (d) specify new functions that statistical authorities could perform .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 10 July 2023, pursuant to Article 42(1) of the EUDPR. The EDPS welcomes the reference to this consultation in recital (24) of the Proposal.

text: 2. General remarks

text: 6. The EDPS welcomes the objective of the Proposal, namely to make the legal framework governing European statistics fit for the future. New innovative approaches can bring promises for statistics and research, but will also pose risks and raise challenges, thus requiring the co-legislators to ensure that any potential benefits never come at the expense of individuals’ rights. To provide effective protection for the right of privacy and the right to the protection of personal data, the co-legislators should anticipate the potential risks and challenges that these promising approaches may bring and provide for appropriate safeguards .

text: 7. The EDPS welcomes recitals (14) and (15) of the Proposal, which emphasise that the EUDPR and the GDPR apply to the processing of personal data carried out as part of the activities under the Proposal. The EDPS recalls that personal data must be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes . Under the GDPR and the EUDPR, further processing of personal data for statistical purposes is not considered to be incompatible with the original processing purposes, provided the conditions in Article 89(1) of the GDPR and Article 13 of the EUDPR are satisfied. In particular, these provisions stipulate that when personal data are (further) processed for statistical purposes, those data shall in principle be rendered anonymous (or alternatively pseudonymous), provided that the statistical purpose be fulfilled in this manner .

text: 8. Against this background, the EDPS welcomes the clarification in recital (14) of the Proposal that the data provided under the Proposal should normally be aggregated to such a degree that individuals cannot be identified. For the sake of legal certainty, the EDPS recommends making specific reference to compliance with the safeguards relating to processing of personal data for statistical purposes under Article 89 of the GDPR and Article 13 of the EUDPR, in particular that the data should in principle be rendered anonymous.

text: 3. New data sources and privately held data

text: Article 17

text: b of the Proposal would allow national statistical institutes (‘NSIs’) or the Commission (Eurostat) to request a private data holder to make data and the relevant metadata available for developing and producing European statistics.

text: Article 17

text: b and recital (9) of the Proposal specify that the possibility to request access to privately held data should be limited to the NSIs and the Commission (Eurostat) only. Further, it should be restricted to cases where the annual work programme has established the following conditions: (a) the data requested is necessary for the development and production of European statistics; and (b) the data cannot be readily obtained otherwise, or their reuse would result in a considerable reduction in the response burden on data holders and other businesses.

text: 11. The EDPS notes that the concept of “privately held data” is not defined in the Proposal. Recital (7) indicates, however, that ‘accessing and re-using new data sources, which emerge as byproducts of digital services and the Internet of Things (IoT), is becoming vital for producing timely, suitably frequent and sufficiently detailed European statistics in a more efficient and less costly way’ . Furthermore, access to new data sources, including particularly to privately held data, has been a longstanding request by the ESS .

text: 12. The EDPS understands that privately held data have the potential to help producers of official statistics to provide more accurate statistics that reflect topics of interest to users at a faster pace. However, he also points out that privately held data can be diverse, as it is understood to encompass a vast amount of data held by businesses, including transaction data from mobile telecom operators, sensor data from personal communication devices or from smart electricity consumption meters, road traffic loops, data obtained from the internet such as social media or web-scraped data from job vacancies' or real estate agencies' websites, scanner data, electronic reservation systems data, electronic data on credit card transactions , but also through IoT and provision of digital services.

text: 13. The EDPS considers that collection of personal data from such sources may not be necessary and proportionate to the aims pursued, having regard to the potential risks for the rights and freedoms of data subjects. The EDPS underlines that further to offering a rich profile on individuals’ behaviour, such information could concern special categories of personal data and other sensitive data that would enable to draw even more intimate inferences on the data subjects’ life and could thus represent a significant risk for the rights and freedoms of data subjects .

text: 14. In this regard, the EDPS welcomes

text: Article 17

text: c(2) of the Proposal, which provides that the requests for data by the NSIs and the Commission (Eurostat) shall follow the principle of data minimisation, be proportionate to the statistical need and concern, insofar as possible, non-personal data. However, the EDPS considers that only anonymised data should be requested and used for statistical purposes where privately held data are concerned . Therefore, the EDPS recommends deleting the wording "insofar as possible" from

text: Article 17

text: c(2) to ensure that only non-personal (anonymised) data will be requested from private data holders.

text: 15. In addition, the EDPS recalls that data concerning the use of publicly available electronic communications services and public electronic communications networks, as well as the accessing or storing of information in the end-user’s terminal equipment, is subject to specific rules under the ePrivacy Directive . Such data and information may encompass both personal and non-personal data. The EDPS recalls that the ePrivacy Directive imposes specific limits on the processing of the data and information in scope of the Directive. Therefore, the EDPS considers it necessary to clarify that any processing of data pursuant a request for data under

text: Article 17

text: c shall be without prejudice to the ePrivacy Directive.

text: 16. To be clear, the EDPS does not suggest that privately held personal data can never be used for the purpose of creating official statistics. However, the EDPS recalls that the mere reduction of the response burden for private data holders (by not requiring them to anonymize the data) cannot outweigh the potential impact on the fundamental rights and freedoms of the persons concerned . Moreover, due regard must be had to the sensitivity of the data at issue, taking into account the principles of necessity and proportionality. In case of processing of special categories of data, regard must also be had to the general prohibition included in

text: Article 9

text: GDPR and

text: Article 10

text: EUDPR.

text: 17. To allow NSIs or the Commission (Eurostat) to request personal data from private data holders in specific circumstances, several amendments would be necessary. In particular, the Proposal should provide a clear and comprehensive overview of the categories of personal data that may be accessed and used or otherwise processed by the NSIs and the Commission (Eurostat). Moreover, the types of sources from which those categories of data may be obtained should be clearly set out. The specification of the categories of personal data and sources could be provided in the Proposal itself, or the Proposal could provide that this shall be done in sectoral statistical legislation.

text: 18. When specifying the categories of data in the Proposal, the EDPS recalls first and foremost compliance with the data minimisation principle , which provide that personal data must be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed". As previously indicated, the processing of personal data, and in particular the processing of special categories of personal data or otherwise sensitive data that would enable drawing intimate inferences on the data subject’s life, may not be necessary and proportionate to the aims pursued.

text: 19. Finally, the EDPS recommends adding in

text: Article 17

text: c that the sharing of personal data by private data holders with NSIs or the Commission (Eurostat) pursuant a request in accordance with

text: Article 17

text: b and 17c shall: (a) be based on technologies that are specifically designed to comply with Regulations

text: (EU) 2016/679

text: and

text: (EU) 2018/1725

text: , particular regard to purpose limitation, data minimisation, storage limitation, integrity and confidentiality (similarly to what is provided in

text: Article 17

text: f(4) of the Proposal); and (b) take place using a secure infrastructure, to be set up by the requesting body, i.e., an NSI or the Commission (Eurostat) (similarly to what is provided in

text: Article 17

text: f(3) of the Proposal).

text: 20. For completeness, the proposed requirement under point (b) under paragraph 19 of this Opinion should be accompanied by a provision requiring the NSIs and Commission (Eurostat) to set up a secure infrastructure to facilitate any sharing of personal data between them and private data holders.

text: 4. Exceptional need to use the data

text: Article 17

text: b and recital (6) of the Proposal indicate that data holders may also be obliged to make data available to an NSI or the Commission (Eurostat) based on an exceptional need, in accordance with the rules laid down in the Proposal for a Regulation on harmonised rules on fair access to and use of data (‘Data Act’) .

text: 22. In this regard, the EDPS would like to reiterate the concerns expressed in the Joint Opinion of the EDPB and EDPS on the Data Act . The EDPB and EDPS expressed serious concerns on the lawfulness, necessity and proportionality of the obligation to make data available to public sector bodies and Union institutions, agencies or bodies in case of “exceptional need”. Any limitation on the right to personal data must be based on a legal basis that is adequately accessible and foreseeable and formulated with sufficient precision to enable individuals to understand its scope. In accordance with the principles of necessity and proportionality, the legal basis must also define the scope and manner of the exercise of their powers by the competent authorities and be accompanied by sufficient safeguards to protect individuals against arbitrary interference. In addition, the EDPB and the EDPS observed that the circumstances justifying the access are not narrowly specified and considered it necessary for the co-legislators to define much more stringently the hypotheses of emergency or exceptional need.

text: 5. Collection of statistics from the Large-Scale IT systems (LSITs) in the Area of Freedom, Security and Justice

text: Article 17

text: a(2a) would allow the Commission (Eurostat) to access, reuse and integrate relevant data and metadata from databases and interoperability systems maintained by Union bodies and agencies.

text: 24. The EDPS recalls that as regards the soon to be interoperable Large Scale IT Systems (LSITs) in the area of freedom, security and justice, a repository for reporting and statistics (‘CRRS’) is to be established . It shall generate cross-system statistical data and analytical reporting for policy, operational and data quality purposes in accordance with the applicable legal instruments. This CRRS stores anonymised data extracted from the underlying EU information systems, the shared biometric matching service, the common identity repository and the multi-identity detector, in order to provide cross-system statistical reporting for policy, operational and data quality purposes. The EDPS recalls his formal comments, with several recommendations, on the CRRS .

text: 25. The goal underpinning the establishment of the CRRS was to create a single point for retrieval of statistical information, leveraging the new possibilities of interoperability to avoid needing to retrieve statistics from the individual systems. It also plays an important role as a gateway and a filter to transform data which is stored for operational purposes (which is gathered and further processed by operational actors such as border guards and police officers), to statistical data that can be further used for general policymaking. Therefore, allowing parallel retrieval of data from any underlying system should not be pursued for the aim of (further) processing statistics – doing so would clearly undermine also the reason for existence of the CRRS in the first place.

text: 26. With this in mind, the EDPS considers that

text: Article 17

text: a(2a) of the Proposal should be amended. In case the Commission (Eurostat) aims to collect LSITs statistics in the area of freedom, security and justice, the wording of

text: Article 17

text: a(2a) should be made more precise and clarify that for those systems statistics shall be gathered exclusively from the CRRS. The EDPS recommends that in case the co-legislators would like to provide for transitional measures until the CRRS is operational, they introduce a specific provision to this end.

text: 6. Data sharing in the ESS

text: 6.1. Privacy enhancing technologies

text: Article 17

text: f of the Proposal provides that data shall be shared between NSIs and between NSIs and the Commission (Eurostat) exclusively for statistical purposes and for improving the quality of European statistics.

text: 28. The EDPS welcomes recital (15) of the Proposal, which states that when data sharing entails processing of personal data according to the GDPR, the principles of purpose limitation, data minimisation, storage limitation and integrity and confidentiality should be applied. At the same time, the EDPS recalls that any sharing of personal data must in any event comply with all provisions of the GDPR and EUDPR , including among others also the principles of lawfulness, fairness, transparency, and accuracy. Further, the EDPS would like to specifically point out

text: Article 89(1)

text: GDPR and

text: Article 13

text: EUDPR, which provide that when personal data are (further) processed for statistical purposes, those data shall in principle be rendered anonymous (or alternatively pseudonymous), provided that the statistical purpose be fulfilled in this manner, based on the data minimisation principle (necessity and proportionality) .

text: Article 17

text: f(4) of the Proposal provides that the sharing of personal data shall be allowed and may take place on a voluntary basis provided, among others, it is based on privacy enhancing technologies that are specifically designed to comply with the GDPR and the EUDPR, with particular regard to purpose limitation, data minimisation, storage limitation, integrity and confidentiality .

text: 30. The EDPS welcomes that, in order to enable effective data sharing in line with the GDPR, the Proposal sets as a condition the use of privacy-enhancing technologies. Privacyenhancing technologies are linked to the principle of data protection by design and by default . They are relevant in relation to the application of appropriate technical and organisational measures, among others to mitigate the data protection risks identified in the mandatory assessment by the controller. These measures shall be designed to implement the data protection principles effectively and integrate necessary safeguards into the data processing. Privacy-enhancing technologies address different privacy concerns, have different degrees of maturity, capacities and limitations. Therefore, the EDPS considers that controllers sharing data in this context should assess the maturity, suitability, cost and effectiveness in terms of possible impact on individuals’ fundamental rights.

text: 31. In his Opinion on the proposal for a Regulation on European Statistics on population and housing, the EDPS welcomed that this proposal would oblige the Commission (Eurostat), in cooperation with the Member States, to: 1) evaluate the results of the pilot and feasibility studies on the uses of privacy enhancing technologies carried out; and 2) prepare reports on the findings of those studies . The EDPS believes that the use of pilot studies to test and assess the fitness of relevant privacy enhancing technologies is an approach with great potential and that its extension should be considered to all use cases of data sharing for European statistics. He therefore recommends introducing a similar obligation in the Proposal. He observes that the proposal for a Regulation on European Statistics on population and housing also provides the possibility for the Commission to adopt implementing acts laying down technical specifications for the data sharing and measures for the confidentiality and security of information, where pilot studies identify effective and secure data sharing solutions. He suggests the co-legislators to consider such option for the current Proposal as well.

text: 6.2. Infrastructure to facilitate data sharing

text: Article 17

text: b(4) of the Proposal provides, with regard to privately held data accessed in accordance with

text: Article 17

text: b(2), that “the Commission (Eurostat) may, in agreement with the NSIs, set up a secure infrastructure to facilitate the further sharing with the NSIs(...)”. Furthermore,

text: Article 17

text: f(3) of the Proposal provides that “[t]he Commission (Eurostat) shall set up a secure infrastructure to facilitate data sharing” and that the NSIs, and when relevant other national authorities (‘ONAs’), may use that secure data sharing infrastructure.

text: 33. The EDPS welcomes the references to secure infrastructures in

text: Article 17

text: b(4) and

text: Article 17

text: f(3) of the Proposal. For completeness, the EDPS recalls that the use of a secure infrastructure is always an obligation when sharing personal data, in accordance with the requirements concerning security, confidentiality and integrity and data protection by design and by default as contained in the GDPR and EUDPR.

text: 34. The EDPS notes that the Proposal does not specify the roles and responsibilities in setting up, operating and maintaining the secure infrastructure within the meaning of data protection law of the Commission (Eurostat), the NSIs and ONAs, when personal data is processed. The EDPS considers it necessary that the roles of the various actors involved as controller, joint controller or processor be clearly specified in the enacting terms of the Proposal.

text: 6.3. Implementing acts

text: 35. The EDPS notes that according to

text: Article 17

text: c(10) of the Proposal the Commission would be empowered to adopt implementing acts to supplement the Proposal by specifying the general technical arrangements for making data available for development and production of European statistics under this Article.

text: 36. Furthermore, the Commission would be empowered to adopt the implementing acts that would set out the technical aspects of data sharing between the statistical authorities referred to in this

text: Article 17

text: f of the Proposal.

text: 37. In this regard, the EDPS recalls that, when a proposal for legislation has a possible impact on the protection of personal data, the European Commission has to submit it to the EDPS for consultation.

text: Conclusions

text: In light of the above, the EDPS recommends the co-legislators to:

text: (1) make reference, in a recital, to compliance with the safeguards relating to processing of personal data for statistical purposes under Article 89 of the GDPR and Article 13 of the EUDPR and in particular that the data should in principle be rendered anonymous;

text: (2) clarify in

text: Article 17

text: a(2) of the Proposal that LSITs statistics in the area of freedom, security and justice shall be gathered exclusively from the CRRS. Insofar relevant, the co-legislators could provide for transitional measures until the CRRS is fully operational;

text: (3) clarify in

text: Article 17

text: c(2) of the Proposal that only non-personal (anonymised) data will be requested from private data holders, in particular by deleting the wording "insofar as possible" from

text: Article 17

text: (4) clarify that any processing of data pursuant a request for data under

text: Article 17

text: c shall be without prejudice to the ePrivacy Directive;

text: (5) if the co-legislators wish to provide a framework allowing NSIs and the Commission to request personal data from private data holders in specific circumstances, to provide for:

text: o a clear and comprehensive overview of the categories of personal data that may be requested and of the types of sources from which those categories of personal data may

text: be obtained; and

text: o specific safeguards by requiring that sharing of data by private data holders shall be based on technologies that are specifically designed to comply with Regulations

text: (EU) 2016/679

text: and

text: (EU) 2018/1725

text: and shall take place using a secure infrastructure;

text: (6) introduce an obligation for the Commission (Eurostat) and the Member States to test and assess by means of pilot studies the fitness of relevant privacy enhancing technologies for data sharing within the ESS;

text: (7) consider providing the option for the Commission to adopt implementing acts laying down technical specifications for the data sharing and measures for the confidentiality and security of information, where pilot studies identify effective and secure data sharing solutions;

text: (8) specify, in the context of the infrastructure to facilitate data sharing, the roles of the various actors involved as controller, joint controller or processor in the enacting terms of the Proposal.

text: Brussels, 06 September 2023

text: Wojciech Rafał WIEWIÓROWSKI

text: [e-signed]

type: vagledning

utgivare: edps