text: COM(2026) 16 final.

text: OJ L 295, 21.11.2018, p. 39.

text: Regulation (EU) 2015/2120

text: of the European Parliament and of the Council of 25 November 2015 laying down measures concerning open internet access and amending Directive

text: on universal service and users’ rights relating to electronic communications networks and services and

text: Regulation (EU) No 531/2012

text: on roaming on public mobile communications networks within the Union, OJ L 310, 26.11.2015, p. 1 (“OIR”). Directive

text: of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), OJ L 201, 31.7.2002, p. 37. Decision No

text: of the European Parliament and of the Council of 7 March 2002 on a regulatory framework for radio spectrum policy in the European Community (Radio Spectrum Decision), OJ L 108, 24.4.2002, p. 1, ELI: http://data.europa.eu/eli/reco/1999/519/oj.

text: Regulation (EU) 2018/1971

text: of the European Parliament and of the Council of 11 December 2018 establishing the Body of European Regulators for Electronic Communications (BEREC) and the Agency for Support for BEREC (BEREC Office), amending

text: Regulation (EU) 2015/2120

text: and repealing

text: Regulation (EC) No 1211/2009

text: , OJ L 321, 17.12.2018, p. 1.

text: Directive (EU) 2018/1972

text: of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code, OJ L 321, 17.12.2018, p. 36. Decision No

text: of the European Parliament and of the Council of 14 March 2012 establishing a multiannual radio spectrum policy programme, OJ L 81, 21.3.2012, p. 7 ELI: http://data.europa.eu/eli/dec/2012/243(2)/oj. COM(2026) 16 final.

text: Legislative financial and digital statement, Section 2.2.1.

text: Directive (EU) 2018/1972

text: of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code, OJ L 321, 17.12.2018, p. 36.

text: Regulation (EU) 2018/1971

text: Regulation (EU) 2015/2120

text: and repealing

text: Regulation (EC) No 1211/2009

text: , OJ L 321, 17.12.2018, p. 1. Decision No

text: of the European Parliament and of the Council of 14 March 2012 establishing a multiannual radio spectrum policy programme, OJ L 81, 21.3.2012, p. 7.

text: Regulation (EU) 2015/2120

text: Regulation (EU) No 531/2012

text: on roaming on public mobile communications networks within the Union, OJ L 310, 26.11.2015, p. 1. Directive

text: of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), OJ L 201, 31.7.2002, p. 37. COM(2026) 16 final, p. 2. The Proposal is accompanied by six annexes, each of them specifying certain areas such as the conditions for access to digital television and radio services broadcast to viewers and listeners in the Union, the criteria for the determination of wholesale voice termination rates, the information to be provided in accordance with

text: Article 95

text: (information requirements for contracts), the information to be published in accordance with

text: Article 96

text: (transparency), the interoperability of car radio receivers and consumer digital television equipment referred to in

text: Article 112

text: , the granting of Union authorization based on a selection procedure. COM(2026) 16 final, p. 5.

text: See recital 11 (processing of personal data in the context of the supply of electronic communications services), recital 258 (information requirements for contracts covering internet access services and interpersonal communications services), recital 284 (measures to be adopted by the Member States and to be implemented by interpersonal services), recital 293 (reception and use of caller location information), recital 305 (on the calling line/originating identification of the users), recital 307 (on publicly available directories), recital 377 (on exchange of information), and recital 388 (data processing to perform regulatory tasks). 19 On the applicability of the EUDPR, see for instance the reference to the EUDPR in Article 167(3) of the Proposal. 20 Directive

text: of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), OJ L 201, 31.7.2002, pp. 37–47. 21 Recital 11 of the Proposal, which replaces recital 16 of the EECC. 22 See also Judgment of the Court of Justice of 15 September 2016,

text: , Tobias vs. Sony Music, at para 41 and 42.

text: Article 7(4)

text: GDPR. See EDPS Opinion on the Proposal for a Regulation on Privacy and Electronic Communications (ePrivacy Regulation), issued on 24 April 2017, at page 25; see EDPS Opinion on the Proposal for a Directive on certain aspects concerning contracts for the supply of digital content, issued on 14 March 2017, page 7, paragraphs 15-17. See also the EDPB Statement 05/2021 on the Data Governance Act in light of the legislative developments, adopted on 19 May 2021: “[..] considering that data protection is a fundamental right guaranteed by Article 8 of the Charter, and taking into account that one of the main purposes of the GDPR is to provide data subjects with control over personal data relating to them, the EDPB reiterates that personal data cannot be considered as a “tradeable commodity”. An important consequence of this is that, even if the data subject can agree to the processing of his or her personal data, he or she cannot waive his or her fundamental rights. As a further consequence, the controller to whom consent has been provided by the data subject to the processing of her or his personal data is not entitled to 'exchange' or 'trade' personal data (as a socalled 'commodity') in a way that would result as not being in accordance with all applicable data protection principles and rules.” See EDPB Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms, adopted on 17 April 2024, Section 4.2.1. Freely given consent. See Articles 5, 6 and 7 of the ePrivacy Directive. See EDPB Opinion Guidelines 05/2020 on consent under Regulation 2016/679, adopted 4 May 2020. 26 access, use, or otherwise processing of personal data in the In particular, the EDPS recommends removing the following wording “ context of the supply of electronic communications services should be treated in same manner as remuneration, where the provider of a service requests and the end-user knowingly provides personal data within the meaning of

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council directly or indirectly to the provider.” and “situations where the end-user allows access to information without actively supplying it, such as personal data, including the IP address, or other automatically generated information, such as information collected and transmitted by a cookie or similar technologies”. Recital (11) could for example be reworded as follows: ‘In order to fall within the scope of the definition of electronic communications service, a service normally needs to be provided in exchange for remuneration. In line with the case-law of the Court of Justice, remuneration of a service supplied by a service provider within the course of its economic activity does not require the service to be paid for by those for whom it is performed. The concept of normally provided for remuneration may also encompass situations in which the end-user is exposed to advertisements, while fully recognising that the protection of personal data is a fundamental right and that therefore personal data cannot be considered a commodity. Any processing of personal data in the context of providing an electronic communications service must take place in accordance with Directive

text: and Regulation 2016/679. Any use of information protected under Articles 5, 6 and 7 of the ePrivacy Directive for advertising purposes can only take place with the valid consent of the individual concerned within the meaning of Regulation 2016/679’.

text: Article 79 of the Proposal. 29 See EDPB Opinion 8/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms, adopted on 17 April 2024, Section 4.2.1.3, Imbalance of power. 30 EDPS Opinion on the Proposal for a Regulation on Privacy and Electronic Communications (ePrivacy Regulation), issued on 24 April 2017, page 6. 31 Article 93 of the Proposal replaces

text: Article 3

text: OIR with some modifications.

text: Article 93(3)

text: , second sub-paragraph. 33 The EDPS refers in this regard also the EDPB Response of 3 December 2019 to BEREC request for guidance on the revision of its guidelines on net neutrality rules, with the views of the EDPB on the compliance of certain measures with data protection law. 34 See in particular Recitals 9-16 of the OIR. 35 This is the case of the more detailed specifications on temporary congestion included in recital 15 of the OIR, which are not contained in Article 93 of the Proposal. 36

text: Regulation (EU) 2018/1971

text: Regulation (EU) 2015/2120

text: and repealing

text: Regulation (EC) No 1211/2009

text: (Text with EEA relevance), OJ L 321, 17.12.2018, pp. 1–35. 37 See also EDPB Response of 3 December 2019 to BEREC request for guidance on the revision of its guidelines on net neutrality rules, with the views of the EDPB on the compliance of certain measures with data protection law, p. 7. On transparency and related information requirements, see

text: Articles 5(1)

text: (a), 12, 13, 14 GDPR. 38 See EDPB Response of 3 December 2019 to BEREC request for guidance on the revision of its guidelines on net neutrality rules, with the views of the EDPB about how information to be provided under

text: Article 4

text: (a) of the OIR interacts with the obligation to

text: inform users under the GDPR (see question/answer d, How would the obligation to be transparent on traffic management measures relate to obligation to inform under EU privacy law?, page 7). 39 In the absence of a clear legal obligation to detect fraud or fraudulent activities, the processing of personal data entailed by fraud detection measures could not, for example, be based on

text: Article 6(1)

text: (c) GDPR, that allows the processing of personal data when necessary for the performance of a legal obligation. 40 See EDPS Guidance for co-legislators on key elements of legislative proposals, issued on 7 May 2025, parag. 7. See also Recital 41 of the GDPR and Recital of the 23 of the EUDPR. These provisions complement the requirements of Article 7 and 8 of the Charter, as interpreted by the CJEU, according to which any interference must be provided for by law which is clear, precise and foreseeable. 41 According to

text: Article 6(3)

text: GDPR, where Union or national law is the lawful basis for a processing of personal data, that legal basis should at least determine the purpose of the processing, or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

text: See EDPS Guidance for co-legislators on key elements of legislative proposals, issued on 7 May 2025, section 3. 43 Recital 284 of the Proposal provides examples of fraudulent activities, namely CLI spoofing, phishing, smishing, and vishing, and refers to “fraud schemes” against which several Member States have introduced national measures. 44 Without clarity on the scope and specific purposes of the measures to be adopted, it will in any event be difficult to assess the necessity and proportionality of the measures under data protection law. Moreover, depending on their implementation, fraud detection measures may also entail a risk of generalised and indiscriminate monitoring of communications, which would constitute a particularly serious interference. 45 These guidelines would be issued by BEREC, after consulting the European Data Protection Board and ENISA.

text: Article 207 of the Proposal. 47 See EDPS Opinion on the Proposal for a Regulation on Privacy and Electronic Communications (ePrivacy Regulation), issued on 24 April 2017, Section 2, Need for a dedicated legal instrument for ePrivacy. 48 As further noted by recital 307, the application of Directive

text: showed divergent practices across Member States as regards the exercise of the choice of end-users that are natural persons for inclusion of their personal data in a directory. Sometimes, Member States provide that end-users have the right to object the inclusion of their personal data in their national laws or the withdrawal of consent of a natural person is not shared with third parties processing personal data from the directories, which may not only lower the level of protection throughout the Union, but also expose end-users to fraudulent practices by malicious actors.. 49 Recital 307 of the Proposal specify that “publicly available directories consist of any directory or service containing information of end-users, such as phone numbers (including mobile phone numbers), email address, contact details and includes inquiry services.” However, a definition of ‘publicly available directories’ is not provided in Article 2 of the Proposal.

text: These are: the right to information, provided in

text: Article 12(1)

text: ; the right to determine whether and which of the personal data related to them are to be included in the public directory, provided in

text: Article 12(2)

text: and specified in recital 38; the requirement of renewed consent to use data for an additional purpose under

text: Article 12(3)

text: , as specified in recital 39 of the ePrivacy Directive. See in this regard also recitals 38 and 39 of the ePrivacy Directive. 51 See in this regard, EDPB Statement on the ePrivacy Regulation and the future role of Supervisory Authorities and the EDPB, adopted on 19 November 2020, p. 2 (‘many provisions of the future ePrivacy Regulation concern processing of personal data. For these processing activities, Article 8(3) of the Charter of Fundamental Rights of the European Union requires oversight by an independent authority); see also EDPB Statement 03/2021 on the ePrivacy Regulation, adopted on 9 March 2021, p. 4-5 (‘Provisions of the future ePrivacy Regulation related to the protection of privacy should not be applied in isolation, since they are intertwined with personal data processing and the GDPR).

text: Regulation (EC) No 223/2009

text: of the European Parliament and of the Council of 11 March 2009 on European statistics and repealing Regulation (EC, Euratom) No 1101/2008 of the European Parliament and of the Council on the transmission of data subject to statistical confidentiality to the Statistical Office of the European Communities,

text: Council Regulation (EC) No 322/97

text: on Community Statistics, and

text: Council Decision 89/382/EEC

text: , Euratom establishing a Committee on the Statistical Programmes of the European Communities, OJ L 87, 31.3.2009, pp. 164–173. 53 See EDPS Guidance for co-legislators on key elements of legislative proposals, issued on 7 May 2025. 54

text: Regulation (EC) No 223/2009

text: Council Regulation (EC) No 322/97

text: on Community Statistics, and

text: Council Decision 89/382/EEC

text: , Euratom establishing a Committee on the Statistical Programmes of the European Communities, OJ L 87, 31.3.2009, pp. 164–173. 55

text: Regulation (EU) 2024/3018

text: of the European Parliament and of the Council of 27 November 2024 amending

text: Regulation (EC) No 223/2009

text: on European statistics, ELI: http://data.europa.eu/eli/reg/2024/3018/oj. 56

text: Regulation (EU) 2025/2458

text: of the European Parliament and of the Council of 26 November 2025 on European statistics on population and housing, amending

text: Regulation (EC) No 862/2007

text: and repealing Regulations

text: (EC) No 763/2008

text: and

text: (EU) No 1260/2013

text: , OJ L, 2025/2458, 12.12.2025, ELI: http://data.europa.eu/eli/reg/2025/2458/oj. 57 The ODN would be established under Article 144 of the Proposal and replace the Agency for Support of BEREC (‘BEREC Office’).

identifier: EDPS yttrande 08/2026

title: EDPS Opinion 8/2026 on the Proposal for a Regulation on digital networks (Digital Networks Act)

text: Opinion 8/2026

text: on the Proposal for a Regulation on digital networks (Digital Networks Act)

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council establishing a framework of measures to facilitate the transport of military equipment, goods and personnel across the Union. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 21 January 2026, the European Commission adopted the Proposal for a Regulation of the European Parliament and of the Council on digital networks, amending

text: Regulation (EU) 2015/2120

text: , Directive

text: and Decision No

text: and repealing

text: Regulation (EU) 2018/1971

text: Directive (EU) 2018/1972

text: and Decision No

text: (Digital Networks Act).

text: The Proposal would establish a framework for harmonised rules governing the provision of electronic communications networks and services in the internal market, while supporting the Union’s policy objectives of consumer welfare, industrial competitiveness, security and resilience, and sustainability. In doing so, the Proposal would replace certain existing EU legislative instruments that govern the connectivity ecosystem, namely the European Electronic Communications Code (EECC), the Body of European Regulators for Electronic Communications (BEREC) Regulation, the Radio Spectrum Policy Programme (RSPP), and replace and amend parts of the Open Internet Regulation (OIR) and parts of the Directive

text: (ePrivacy Directive).

text: The EDPS welcomes the aim of the Proposal, fostering a single market for digital networks. To ensure a high level of protection of privacy and of personal data, as well as legal certainty, the EDPS recommends introducing a number of clarifications and changes. In particular, the EDPS recommends: - clarifying that processing of personal data of the end-user in the context of electronic communications services should not be seen as remuneration provided by the data subject for the provision of the electronic communication services; - further detailing possible measures to protect end-users against fraudulent activities; - ensuring that end-users are asked for consent before they are included in a printed or electronic public directory.

text: In terms of governance, the EDPS recommends designating supervisory authorities pursuant to the GDPR as competent for the supervision and enforcement of the provisions of the ePrivacy Directive inserted in the Proposal. In addition, the Proposal should explicitly enable the exchange of relevant information among national competent authorities and data protection authorities where it is necessary for the performance of their tasks.

text: Finally, the EDPS notes that the recitals to the Proposal envisage the possibility of processing of geospatial network data in combination with granular socio-economic and physical micro-data at the level of individual address points for the performance of regulatory tasks. In this regard, the EDPS recommends to further assess whether processing of data referring to household composition, age structure, and disposable income is truly necessary. If this is the case, the Proposal should clearly specify the relevant categories of data in the enacting terms of the Proposal and provide for appropriate data protection safeguards.

text: Having regard to

text: Regulation (EU) 2018/1725

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 21 January 2026, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on digital networks, amending

text: Regulation (EU) 2015/2120

text: , Directive

text: and Decision No

text: and repealing

text: Regulation (EU) 2018/1971

text: Directive (EU) 2018/1972

text: and Decision No

text: (Digital Networks Act) (‘the Proposal’).

text: 2. The Proposal aims to simplify and improve coordination of the regulatory framework, enabling providers to operate and innovate more effectively in the single market. The Proposal establishes a new policy framework for harmonised rules governing the provision of electronic communications networks and services in the internal market, while supporting 4 the Union’s policy objectives of consumer welfare, industrial competitiveness, security and resilience, and sustainability .

text: 3. The Proposal would replace certain existing EU legislative instruments that govern the connectivity ecosystem: the European Electronic Communications Code (EECC) , the Body of European Regulators for Electronic Communications (BEREC) Regulation , the Radio Spectrum Policy Programme (RSPP) , parts of the Open Internet Regulation (OIR) and Directive

text: (ePrivacy Directive) . The aim of merging these instruments into a Digital Networks Act in the form of a Regulation is to simplify and better coordinate the rules, thus fostering the single market .

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 21 January 2026, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to the present consultation in recital 415 of the Proposal.

text: 2. General remarks

text: 5. The EDPS welcomes the objectives of the Proposal, particularly the objective to promote access to fast, secure and resilient digital infrastructure across the EU .

text: 6. This Opinion focus on the privacy and data protection aspects of the Proposal, but does not address other aspects of the Proposal, such as those concerning competition aspects or ‘net neutrality’.

text: 7. The Proposal does not contain a general recital on the applicability of EU data protection law, but only refers to the protection of personal data and the GDPR in certain recitals 5 referring to specific provisions of the Proposal . As the provision of electronic communications will by nature entail the processing of personal data, the EDPS recommends inserting a general recital recalling the applicability of the GDPR and of the EUDPR , as well as of Directive

text: (‘ePrivacy Directive’) to any processing of personal data conducted in relation with the activities covered by the Proposal.

text: 8. The EDPS also recommends recalling in the same recital that any measure adopted to implement the Proposal must comply with the conditions and limits related to the protection of the fundamental right to privacy and to the protection of personal data, enshrined, respectively, in

text: Article 7

text: and Article 8 of the Charter of fundamental rights of the European Union.

text: 3. Remuneration for the provision of electronic communication services

text: 9. The EDPS welcomes that the Proposal recalls that the protection of personal data is a fundamental right and that therefore personal data cannot be considered a commodity . However, the same recital of the Proposal specifies that ‘access, use, or otherwise processing of personal data in the context of the supply of electronic communications services should be treated in the same manner as remuneration, where the provider of a service requests and the end-user knowingly provides personal data within the meaning of

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council directly or indirectly to the provider’.

text: 10. The EDPS understands that, in line with the case law of the CJEU, remuneration also exists if the service provider is paid by a third party and not by the service recipient, as the concept of remuneration of a service supplied by a service provider within the course of its economic activity does not require the service to be paid for by those for whom it is performed .

text: 11. However, the statement that processing of personal data should be treated ‘in the same manner as remuneration’ may be misunderstood as suggesting that the processing of endusers’ personal data may be considered as ‘counter-performance’ provided by end-users in the context of the supply of electronic communications services. Considering personal data as ‘counter-performance’ in this context is however not consistent and not compatible with 6 the notion of consent under the GDPR and would undermine the current legal grounds for lawful processing as set out in Article 6 of the GDPR .

text: 12. Recital 11 goes on to state that the processing of personal data should also be treated in the same manner as remuneration in ‘situations where the end-user allows access to information without actively supplying it, such as personal data, including the IP address, or other automatically generated information, such as information collected and transmitted by a cookie or similar technologies’. In this regard, the EDPS notes that whether the data are provided ‘actively’ or not does not change the conclusion that the processing of personal data should not be considered as remuneration or counter-performance provided by endusers.

text: 13. In addition, the EDPS recalls that the use of communication, traffic and location data is strictly regulated by the ePrivacy Directive, which lists the purposes for which such data may be processed . Advertisement is not one of the purposes listed under these provisions and may therefore only be delivered with the consent of the users .

text: 14. Against this background, the EDPS recommends deleting from Recital 11 the wording suggesting that processing of personal data amounts to remuneration provided by endusers and to recall that any use of data protected under Articles 5, 6 and 7 of the ePrivacy Directive for advertising purposes would require valid consent of the individual concerned .

text: 15. Furthermore, the EDPS remarks that the Proposal provides rules on contract duration and termination. Recital 270 of the Proposal refers to changes to “the contractual conditions [..] 7 in relation to [..] the processing of personal data on lawful grounds pursuant to Union Data protection law other than consent". The EDPS recalls that information about the processing of personal data should be provided in compliance with the EU data protection laws in the data protection notice, instead of being a matter of contractual specification.

text: 16. Moreover, the EDPS considers that revenue generated through the processing of personal data -if fully compliant with data protection law- should be taken into account when assessing the appropriateness and level of price control obligations by national regulatory authorities .

text: 17. Finally, the EDPS recommends clarifying that the provision of ‘universal services’ pursuant to Article 87 of the Proposal must not be made conditional on consent of the data subject to the processing of personal data that is not necessary for the provision of the internet access service (e.g., processing of personal data for the purpose of targeted advertising). Indeed, in such cases, user’s consent would not be valid under

text: Article 7

text: GDPR, considering the possible lack of alternatives for the user, as well as the imbalance of power between the user and the provider.

text: 4. Traffic management measures implemented by the providers of internet access services

text: 18. As preliminary consideration, the EDPS recalls that Article 7 of the Charter of Fundamental Rights of the European Union protects the right to confidentiality of communications . Any interference with this right, including for traffic management purposes, is only permissible insofar as necessary and proportionate to the specific objective pursued.

text: 19. Pursuant to Article 93(3) of the Proposal , providers of internet access services must treat all traffic equally, without discrimination, restriction or interference, and regardless of the sender or the receiver, the content accessed or distributed, the applications or services used or provided, or the terminal equipment used. The second sub-paragraph of this article specifies that this does not prevent providers of internet access services from implementing reasonable traffic management measures. The Proposal specifies that traffic management measures must be transparent, non-discriminatory and proportionate, not based on commercial considerations, but on objectively different technical quality of service requirements. The EDPS welcomes that

text: Article 93(3)

text: specifies that these measures must not 8 monitor the specific content of the traffic and must not be maintained for longer than necessary .

text: 20. The EDPS further welcomes that Article 93(4) of the Proposal explicitly states that any traffic management measure may entail processing of personal data only if such processing is necessary and proportionate to achieve the objectives set out in

text: Article 93(3)

text: and complies with the GDPR as well as the ePrivacy Directive .

text: 21. The EDPS notes that the current Open Internet Regulation (OIR) provides, in its recitals, useful guidance on what constitutes a reasonable traffic management measure . The EDPS welcomes that most of the specifications in recitals 9-16 of the OIR are now introduced in Article 93 of the Proposal, as these specifications provide useful guidance about whether certain measures may be considered proportionate. The EDPS recommends adding to the recitals of the Proposal those parts of the recitals 9-16 of the OIR that are not fully reflected in Article 93 of the Proposal .

text: 22. Article 93(6) of the Proposal would empower the Commission to adopt implementing acts detailing the conditions referred to in

text: Article 93

text: . The EDPS recommends adding, to the last sentence in

text: Article 93(6)

text: , ‘after having consulted BEREC, in accordance with

text: Article 4(1)

text: (b) of

text: Regulation (EU) 2018/1971

text: ’. The EDPS also recalls that, given the impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data, such implementing acts fall within the scope of Article 42 of the EUDPR.

text: 23. Recital 263 of the Proposal specifies that "[p]roviders of internet access services should inform consumers in a clear manner how traffic management practices deployed might have an impact on the quality of internet access services, consumers’ privacy and the protection of personal data, as well as about the possible impact of services other than internet access services to which they subscribe, on the quality and availability of their respective internet access services". Considering the impact that the traffic management measures may have on privacy and data protection, the EDPS in principle welcomes this specification. At the same time, the EDPS recalls that providers of internet access services should in any case inform data subjects about the processing of personal data entailed by their traffic management measures in accordance with the GDPR . The EDPS therefore recommends clarifying what information - in addition to information to be provided under the GDPR - should be provided on the potential impact on consumer’s privacy and the protection of personal data . 9

text: 5. Measures protecting end-users against fraudulent activities

text: 24. Article 103 of the Proposal, on the protection of end-users against fraudulent activities, requires providers of internet access services and of publicly available interpersonal communication services to cooperate with national competent authorities to identify effective measures to prevent fraudulent activities, while ensuring full compliance with Union legislation on personal data protection.

text: 25. The EDPS welcomes the reference to Union legislation on personal data protection, since these measures will more than likely entail the processing of personal data. Such processing must therefore fully comply with the GDPR and the ePrivacy Directive.

text: 26. The EDPS notes that, as per Article 103(1) of the Proposal, the relevant measures would be ‘identified’ in the context of a cooperation between the national competent authorities and the providers. This provision however does not specify whether the identified measure is ultimately imposed by the national competent authority or simply chosen by the providers following their cooperation with the competent authority. On the other hand, Article 103(4) of the Proposal provides that the measures will be ‘adopted’ by the competent national authorities taking into account the guidelines adopted by BEREC under paragraph 3 of this provision.

text: 27. In the interest of legal certainty, the EDPS recommends clarifying whether measures identified or adopted by the national competent authorities under

text: Article 103(1)

text: and Article 103(4) of the Proposal are binding upon providers. This is also important from the perspective of compliance with the GDPR, which requires that any processing of personal data occurs with a lawful legal basis . 5.1. Definition of fraud and scope of the measures to prevent fraudulent activities

text: 28. Any legislative or other act that entails processing of personal data must be clear and precise and its application must be foreseeable to persons subject to it . To this end, the objective(s) and purpose(s) of the processing that would result from a legislative or other act should be clearly specified .

text: 29. A clear identification of purpose is a necessary precondition to determine whether data processing complies with data protection law. The purpose must be detailed enough to (1) determine what kind of processing would (or would not) result from the legislative measure 10 and (2) enable an assessment of whether the envisaged processing is necessary to achieve the objectives pursued .

text: 30. In this context, the EDPS welcomes that recital 284 of the Proposal provides examples of fraudulent activities. However, the EDPS considers that the Proposal should further delineate, in the enacting terms, the purpose(s) and scope of the measures that may be adopted or identified pursuant to Article 103 of the Proposal. Further clarity could be provided by defining the notion of “fraud”, “fraudulent activities” or “prevention of fraud” specific to the context of the Proposal in its

text: Article 2

text: . In the absence of clearly circumscribed criteria, there is a risk that fraud detection measures may lead to disproportionate restrictions affecting lawful communications . 5.2. Guidelines and delegated acts on measures to prevent fraud

text: 31. Article 103(3) of the Proposal tasks BEREC to issue, following consultation of the European Data Protection Board (EDPB) and ENISA, guidelines on technical and legal measures protecting end-users against fraudulent activities, including measures by national regulatory authorities or competent authorities to block numbers and services pursuant to Article 52(2) of the Proposal to prevent fraud.

text: 32. Article 103(5) of the Proposal empowers the Commission to adopt delegated acts concerning the measures necessary to ensure the effectiveness, coordination and complementarity of fraud preventing measures within the Union ‘supplementing paragraph 3 of this Article’.

text: 33. The EDPS considers that the relationship between the guidelines and the delegated acts is unclear, which could give rise to overlap or inconsistency between the guidelines adopted by BEREC and the measures adopted by the national regulatory authorities under Article 103(4) of the Proposal. Therefore, the EDPS recommends clarifying the relationship between the guidelines mentioned in

text: Article 103(3)

text: , on the one hand, and the delegated acts referred to in

text: Article 103(5)

text: , on the other hand. The EDPS also recalls that, in case of impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data, the EDPS must be consulted by the Commission on these delegated acts pursuant to Article 42 of the EUDPR. 5.3. Fundamental rights’ safeguards

text: 34. Finally, the EDPS notes that

text: Article 100

text: (‘fundamental rights’ safeguard) of the current European Electronic Communications Code (EECC) is not retained in the Proposal. Given 11 the relevance of the provisions of this Article, including as regards fraud prevention measures, the EDPS recommends reinstating the content of

text: Article 100

text: EECC in the Proposal.

text: 6. Modifications to the ePrivacy Directive

text: 35. The Proposal deletes

text: Articles 7

text: (itemised billing), 8 (presentation and restriction of calling and connected line identification), 10 (exceptions regarding calling line identification), 11 (automatic call forwarding) and 12 (directories of subscribers) of the ePrivacy Directive . The EDPS notes that Article 7 of the ePrivacy Directive is replaced by

text: Article 95(6)

text: , last paragraph, of the Proposal; Article 8 of the ePrivacy Directive is replaced by Article 108 of the Proposal;

text: Article 10

text: is replaced by Article 109 of the Proposal;

text: Article 11

text: is replaced by Article 110 of the Proposal.

text: 36. The EDPS regrets that the Commission proposes to remove certain provisions from the ePrivacy Directive instead of modernising the ePrivacy Directive and replacing it by a single regulation laying down clear and specific legal rules concerning the processing of personal data and the protection of privacy in the electronic communications sector .

text: 37. The EDPS notes that Article 12 of the ePrivacy Directive (on directories of subscribers) is deleted and not replaced by an article in the Proposal. The deletion of this provision without equivalent in the Proposal would leave the processing of personal data of users in a directory without the protection of the current Article 12 of the ePrivacy Directive, without any justification. The EDPS considers that the Proposal should maintain a specific provision on the processing of personal data of users in public directories.

text: 38. As noted by recital 307 of the Proposal, it is appropriate for ensuring a high level of protection of the right to privacy and to protection of the personal data that end-users who are natural persons are asked for consent before their personal data are included in a directory. Since the current text of Article 12(2) of the ePrivacy Directive has led to different interpretations and implementations , the EDPS recommends inserting a clear provision in the enacting terms ensuring that natural persons are asked for consent before their personal data are included in a directory. In the interest of legal certainty, the EDPS also recommends providing a definition of ‘public directory of end-users’ in the enacting terms of the Proposal . 12

text: 39. Furthermore, the EDPS recommends reinserting the additional requirements provided under Article 12 of the ePrivacy Directive in the enacting terms of the Proposal and amending recital 307 of the Proposal so as to take into account the changes in the enacting terms.

text: 40. The EDPS understands that the national regulatory authorities mentioned in Article 115 of the Proposal would also be the competent authorities for the provisions of the Proposal that would replace Articles 7-12 of the ePrivacy Directive. Provisions related to the protection of privacy should not be applied in isolation, since they are intertwined with personal data processing and the GDPR. In the interest of simplification and to ensure a high level of protection of personal data, national authorities responsible for enforcement of the GDPR should be entrusted with the oversight of these provisions of the Proposal related to the processing of personal data .

text: 41. The EDPS notes that the Proposal does not provide for a general right to lodge a complaint or judicial redress by the person concerned. Therefore, the EDPS recommends adding to the Proposal specific provisions on administrative and judicial redress for individuals, and to amend

text: Article 197

text: to explicitly provide individuals with a right to appeal decisions of national competent authorities.

text: 7. Data processing for the performance of regulatory tasks

text: 42. Article 183 of the Proposal, replacing with modifications

text: Article 22

text: EECC, requires national regulatory authorities or other competent authorities to conduct geographical surveys of network deployments. Recital 388 of the Proposal provides that national regulatory authorities may require the processing of geospatial network data in combination with granular socio-economic and physical micro-data at the level of individual address points. The same recital also specifies that, where processing of personal data is necessary to pursue those tasks, such processing is carried out pursuant to

text: Article 6(1)

text: (e) and Article 6(3) of the GDPR. Moreover, recital 386 specifies that “data concerning household composition, age structure, and disposable income could be relevant for assessing demand elasticity and potential barriers to the adoption of broadband services.”

text: 43. The EDPS notes that the processing of personal data at the individual address level, and notably the types of data specified in recital 386 of the Proposal, may entail a significant interference with the fundamental rights to privacy and to the protection of personal data. 13

text: 44. The EDPS welcomes that Recital 388 of the Proposal refers to the promotion of the use of a "Secure Processing Environment" (SPE) to aggregate data before any public reporting to ensure full compliance with the principles of statistical confidentiality laid down in

text: Regulation (EC) No 223/2009

text: 45. However, the EDPS notes that

text: Article 183

text: does not make any reference to data referring to household composition, age structure, and disposable income, nor does it provide for any specific safeguards for the processing of personal data.

text: 46. Against this background, the EDPS recommends : (i) reassessing whether data referring to household composition, age structure, and disposable income are necessary for the purposes of Article 183 of the Proposal; (ii) if this is the case, to include further justifications in the recitals to the Proposal and to specify the relevant categories of data in the enacting terms of the Proposal; (iii) specifying that any data processing for the purposes specified in Article 183 of the Proposal must occur only for these purposes and with anonymised data or, if personal data is necessary for these purposes, with pseudonymised data; (iv) specifying in Article 183 of the Proposal data protection safeguards that are in line with 54 55

text: Regulation (EC) 223/2009

text: as amended by

text: Regulation (EU) 2024/3018

text: , as well as with

text: Regulation (EU) 2025/2458

text: 8. Governance

text: 47. The EDPS welcomes that Article 167(3) of the Proposal recalls that the EUDPR applies to the processing of personal data by the Office for Digital Networks (ODN) . A similar provision is recommended having regard to the Radio Spectrum Policy Body (‘RSPB’), established under Article 131 of the Proposal. 14

text: 48. The EDPS welcomes that Article 122(11) of the Proposal provides that BEREC must, where appropriate, consult and cooperate with relevant national authorities, including those competent for data protection. The sharing of information with data protection authorities may be relevant, for example, in the context of enforcement of the provisions of the Proposal related to traffic management measures or to measures against fraudulent activities. Therefore, the EDPS recommends making specific reference in Article 171 of the Proposal to data protection authorities among the authorities with whom the exchange of information may occur.

text: 9. Conclusion

text: 49. In light of the above, the EDPS makes the following recommendations: (1) to add a recital to the Proposal recalling the applicability of the GDPR and of the EUDPR, as well as of the ePrivacy Directive; (2) to amend the wording in recital 11 of the Proposal as specified in Section 3 of this Opinion; (3) to clarify in recital 263 of the Proposal what information should be provided on the potential impact on consumer’s privacy and the protection of personal data; (4) adding to the recitals of the Proposal those parts of the recitals 9-16 of the OIR that are not fully reflected in Article 93 of the Proposal; (5) to add, to the last sentence in Article 93(6) of the Proposal, “after having consulted BEREC, in accordance with

text: Article 4(1)

text: (b) of

text: Regulation (EU) 2018/1971

text: ₚ; (6) to clarify the legal nature of the measures identified or adopted by the national competent authorities under

text: Article 103(1)

text: and Article 103(4) of the Proposal; (7) to further delineate, in the enacting terms, the purpose(s) and scope of the measures that may be adopted or identified pursuant to Article 103 of the Proposal, for example by defining the notion of “fraud”, “fraudulent activities” or “prevention of fraud” ; (8) to clarify the relationship between the guidelines mentioned in

text: Article 103(3)

text: and the delegated acts referred to in Article 103(5) of the Proposal; (9) to reinstate the content of Article 100 of the European Electronic Communications Code (EECC) in the Proposal; (10) to insert a clear provision in the enacting terms of the Proposal ensuring that natural persons are asked for consent before their personal data are included in a directory and to provide for a definition of ‘public directory of end-users’ ; (11) to render supervisory authorities designated pursuant to the GDPR competent for the supervision and enforcement of the provisions of the ePrivacy Directive inserted in the Proposal related to the processing of personal data; 15 (12) add to the Proposal specific provisions on administrative and judicial redress for individuals, and to amend

text: Article 197

text: to explicitly provide individuals with a right to appeal decisions of national competent authorities; (13) having regard to data processing for the performance of regulatory tasks: (i) to assess whether data referring to household composition, age structure, and disposable income are necessary for the purposes of Article 183 of the Proposal; (ii) if this is the case: to include further justifications in the recitals to the Proposal and to specify the relevant categories of data in the enacting terms of the Proposal; (iii) specifying that any data processing for the purposes specified in Article 183 of the Proposal must occur only for these purposes and with anonymised data or, if personal data is necessary for these purposes, with pseudonymised data; (iv) specifying in Article 183 of the Proposal data protection safeguards that are in line with

text: Regulation (EC) 223/2009

text: as amended by

text: Regulation (EU) 2024/3018

text: , as well as with

text: Regulation (EU) 2025/2458

text: ; (14) to recall the applicability of the EUDPR in Article 131 of the Proposal, concerning the processing of personal data by the Radio Spectrum Policy Body (‘RSPB’); (15) to make specific reference in Article 171 of the Proposal to data protection authorities among the authorities with whom the exchange of information may occur. Brussels, 18 March 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 16


text: Communication COM(2014)442 on a thriving data-driven economy: https://ec.europa.eu/digital-singlemarket/en/news/communication-data-driven-economy. EDPS Opinion 7/2015: https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/201 5/15-11-19_Big_Data_EN.pdf . See more specifically Section 3.

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation); Official Journal of the European Union, L 119, Vol. 59, 4 May 2016, available at: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L:2016:119:FULL. See inter alia

text: Articles 6(1)

text: (a), 7 and 8 and recitals 42-43 GDPR.

text: Article 25

text: GDPR.

text: Article 20

text: GDPR. Related concepts include ‘personal data stores’, ‘personal data spaces’ or ‘personal data vaults.’ We will use the term ‘PIMS’ in this Opinion, as it appears to best describe the concept in a general and easily understandable way. As used in this Opinion, the abbreviation ‘PIMS’ may refer to either the singular or the plural form: personal information management system or personal information management systems. See recital 7 GDPR: ‘Natural persons should have control of their own personal data’. See also, for example, Doc Searls, The Intention Economy: When Customers Take Charge (Boston: Harvard Business Review Press, 2012). See, e.g. Ira S. Rubinstein, Big Data: The End of Privacy or a New Beginning? International Data Privacy Law, 2013, Vol 3, No 2. See, for example, the report on Personal Data Stores drafted by the University of Cambridge for the European Commission: https://ec.europa.eu/digital-single-market/en/news/study-personal-data-storesconducted-cambridge-university-judge-business-school. See inter alia: Kai Rannenberg, Jan Camenisch, Ahmad Sabouri (eds.), Attribute-based credentials for trust, (Cham: Springer International Publishing, 2015). For more detail on the concept of anonymisation and its effectiveness see also

text: Article 29

text: Working Party Opinion 05/2014 on Anonymisation Techniques: http://ec.europa.eu/justice/data-protection/article- 29/documentation/opinion-recommendation/files/2014/wp216_en.pdf. See for example the openPDS project: http://openpds.media.mit.edu/. For example see the Qiy Foundation (https://www.qiyfoundation.org/) and the Respect Network (https://www.respectnetwork.com/ and http://oixnet.org/registry/respect-network/). See EDPS preliminary Opinion on 'Privacy and competitiveness in the age of big data': https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/201 4/14-03-26_competitition_law_big_data_EN.pdf. In particular, see Section 4.2.2: 'Powerful or dominant undertakings are able to exploit "economies of aggregation" and create barriers to entry through their control of huge personal datasets alongside proprietary software which organises the data'. A well-known effort was the P3P W3C project and the relevant preferences exchange language, APPEL. See, for example, the Kantara initiative (https://kantarainitiative.org/) under which umbrella many projects are carried out fostering 'privacy-respecting, secure access to trusted online services'.

text: Article 4(11)

text: GDPR. See Article 20 of the GDPR.

text: Article 5(1)

text: (d) GDPR.

text: Article 5(1)

text: (e) GDPR. A noticeable example is the use of the XDI protocol suite proposed by the XDI Public Trust Organisation (http://xdi.org/), allowing trusted and secure data exchange based on defined criteria (e.g. privacy preferences). Examples of these solutions are 'smart contracts' aiming at providing automated contract enforcement and negotiation. The concept dates back to when it was defined in the 1990’s by cryptographer Nick Szabo (http://szabo.best.vwh.net/smart_contracts_idea.html). This concept has recently gained research momentum due to developments in cryptography. This usually happens also thanks to the involvement of identity/authentication providers, mutually trusted by all parties involved, which guarantee the authenticity of the data 'attributes' (privacy preferences or other pieces of information) and of the purposes/data uses advertised by online services as well as the identity of those

text: services. Furthermore, action can be performed upon certain events like successful or unsuccessful decryption such as notifications of the event to the PIMS, which enables control.

text: Article 6(1)

text: (c) and (e) GDPR. See also

text: Article 82

text: GDPR. This refers to the principle that citizens should be requested by government to submit any given information or document only once in a setting where governmental authorities are then requested to share the information or document. It may appear desirable to foresee the storage of such information in a PIMS platform, to increase transparency and enable individuals to have better control over their data. Communication: Digitising European Industry - Reaping the full benefits of a Digital Single Market http://europa.eu/rapid/press-release_MEMO-16-1409_en.htm. EDPS Opinion 7/2015, cited above.

identifier: EDPS yttrande 09/2016

amnesord:
Rights of the Individual
Privacy by Design
Personal Information Management System
Technologies

publisher: Europeiska datatillsynsmannen

sprak: en

title: Personal Information Management Systems

serie: yttranden

text: Towards more user empowerment in managing and processing personal data

type: rubrik

text: 20 October 2016 1 | P a g e The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 41(2) of Regulation 45/2001 ‘with respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to privacy, are respected by the Community institutions and bodies’, and ‘… for advising Community institutions and bodies and data subjects on all matters concerning the processing of personal data’. Under Article 28(2) of Regulation 45/2001, the Commission is required, 'when adopting a legislative proposal relating to the protection of individuals' rights and freedoms with regard to the processing of personal data...', to consult the EDPS. He was appointed in December 2014 together with the Assistant Supervisor with the specific remit of being constructive and proactive. The EDPS published in March 2015 a five-year strategy setting out how he intends to implement this remit, and to be accountable for doing so. This Opinion relates to the EDPS' mission to advise the EU institutions on the data protection implications of their policies and foster accountable policymaking - in line with Action 9 of the EDPS Strategy: 'Facilitating responsible and informed policymaking'. The EDPS considers that the emerging landscape of Personal Information Management Systems (PIMS), aiming at putting back individuals and consumers in control of their personal data, deserves consideration with a view to contributing to a sustainable and ethical use of big data and to the effective implementation of the principles of the recently adopted General Data Protection Regulation (GDPR). 2 | P a g e Executive Summary This Opinion explores the concept of technologies and ecosystems aiming at empowering individuals to control the sharing of their personal data (‘personal information management systems’ or ‘PIMS’ for short). Our vision is to create a new reality where individuals manage and control their online identity. Our aim to transform the current provider centric system into a human centric system where individuals are protected against unlawful processing of their data and against intrusive tracking and profiling techniques that aim at circumventing key data protection principles. This new reality will be facilitated by the modernised EU regulatory framework and the possibilities offered by vigorous joined-up enforcement by all relevant supervisory and regulatory authorities. The recently adopted General Data Protection Regulation (GDPR) strengthens and modernises the regulatory framework so that it remains effective in the era of big data by strengthening individuals’ trust and confidence online and in the Digital Single Market. The new rules, including those on increased transparency and powerful rights of access and data portability, serve to allow users more control over their data, and may also help contribute to more efficient markets for personal data, to the benefit of consumers and businesses. Most recently we have issued an Opinion on effective enforcement of fundamental rights in the age of big data. This highlights current market conditions and business practices that create obstacles for effective exercise of individuals’ rights to the protection of their personal data and other fundamental rights, and calls for stepping up concerted and consistent enforcement of competition, consumer protection and data protection laws. We hope that this increased enforcement will serve to create market conditions in which privacy-friendly services can thrive. The approach in this Opinion aims at strengthening fundamental rights in our digital world at the same time as opening new opportunities for businesses to develop innovative personal data based services built on mutual trust. PIMS promise to offer not only a new technical architecture and organisation for data management, but also trust frameworks and, as a result, alternative business models for collecting and processing personal data in the era of big data, in a manner more respectful of European data protection law. In this Opinion, we briefly describe what PIMS are, what problems they are intended to solve, and how. We then analyse how they can contribute to a better protection of personal data and what challenges they face. Finally, we identify ways forward to build upon the opportunities they offer. For new data protection business models to thrive, additional incentives for the service providers offering them may be necessary. It should be explored, in particular, which policy initiatives could motivate data controllers to accept this way of data provision. Furthermore, an initiative by public services to accept PIMS as a data source instead of direct data collection could add critical mass to the acceptance of PIMS. The emerging landscape of PIMS, aiming at putting individuals and consumers back in control of their personal data, deserves consideration, support and further research with a view to contributing to a sustainable and ethical use of big data and to the effective implementation of the principles of the recently adopted GDPR. 3 | P a g e

type: stycke

text: 1. PIMS: SHARING DATA, SHARING BENEFITS?

text: 1 Current conditions for the processing of personal data are often unfair to the individuals whose data are processed. Legal conditions and technical tools make it difficult for individuals to exercise their rights and allow controllers to limit their liability. Data brokers, advertising networks, social network providers and other corporate actors have ever more complete files on individuals participating in today’s digital society, and individuals are losing control over the digital footprints they leave behind. Targeted, profiled and assessed by actors often beyond their control or even knowledge, individuals may feel helpless and need to be empowered to take control of their identity. Even where formally having been given some form of a ‘notice’ and opportunity to ‘consent’ to general terms and conditions, individuals often find themselves inside a system designed to maximise the monetisation of personal data, which leaves no real choice or control to individuals. 2 The European Commission’s communication on big data sets out a plan of actions jointly aiming at personal data and consumer protection. This specifically encourages the use of 'personal data spaces' as user-centric, safe and secure places to store and possibly allow others to access personal data. We share the view that innovative digital tools and business models based on the empowerment of individuals should be encouraged. These may allow individuals to benefit from such data-sharing, that is to participate in the use and distribution of their personal information. 3 In our Opinion on ‘Meeting the challenges of big data' we argued that we should complement the legal obligation of effective consent with real, practical control over personal information. We argued that 'instead of an administrative burden, providing access rights may become a feature of the service provided to the customers', and that organisations based on exploiting 'big data' should 'be prepared to share the wealth created by the processing of personal data with those individuals whose data they process'. In that context we noted that 'personal data stores could help address some of the concerns over the loss of individual control over personal data'. The recently adopted General Data 3 4 Protection Regulation (GDPR) has strengthened the legal requirements for consent and has introduced effective, modern principles of data protection by design and by default , as well as a new right to data portability . In order for the new framework for data protection to deliver its promise we need practical tools to enable individuals to exercise their rights in a convenient, user-friendly way. 4 This Opinion explores new technologies and ecosystems which aim to empower individuals to control the collection and sharing of their personal data. We will refer to this concept as ‘personal information management system’ (‘PIMS’) . The PIMS concept offers a new approach by which individuals are the holders of their own personal information. It may create a paradigm shift in personal data management and processing, with social and economic consequences. In contrast, the current landscape of online services is characterised by a small number of service providers that dominate the market by monetising users’ personal data in exchange for 'free' services. This is often accompanied by an imbalance of power, where the customer is left with a 'take it or leave it' approach, and by information asymmetry between service providers and users, with little or no transparency for the individuals on what is going on with their personal data.

text: 5 The core idea behind the PIMS concept is to transform the current provider centric system into a system centred on individuals able to manage and control their online identity . In principle, individuals should be able to decide whether and with whom to share their personal information, for what purposes, for how long, and to keep track of them and decide

text: 5 | P a g e

text: to take them back when so wished. It is worth exploring how PIMS could help address some of the concerns over the loss of individual control over personal data that have been highlighted as one of the key concerns about big data .

text: 6 This approach aims at strengthening fundamental rights in our digital world at the same time as opening new opportunities for businesses to develop innovative personal data based services built on mutual trust. PIMS promise to offer a new technical architecture and organisation for data management which build trust frameworks. They hope to enable alternative business models for collecting and processing personal data in the era of big data, which do so in a manner more respectful of European data protection law.

text: 7 In this Opinion, we briefly describe what PIMS are, what problems they are intended to solve and how . We analyse how they can contribute to a better protection of personal data and what challenges they face. Finally, we identify ways forward to build upon the opportunities they offer.

text: 2. MODELS AND FEATURES OF EMERGING PIMS

text: 2.1. Architecture and technology

text: 8 PIMS are at an early stage of development. The way they are designed and the underlying business models differ widely. There is little experience of their practical use and impact on the processing of personal information. This Section explains some of the models and features of emerging PIMS.

text: Where are the data?

text: 9 A main distinction between the various types of emerging PIMS can be made on their technical architecture, whether based on local storage or cloud-based storage. In the local storage model, personal data are kept in user devices such as a laptops, smartphones, tablets etc. In the cloud-based model, users’ data are mainly kept by service providers (social networks, online office suites, healthcare providers etc.) as well as by specialised cloudbased PIMS providers.

text: 10 In the cloud-based configuration, there are two kinds of basic approaches which can also co-exist with each other. Some PIMS are designed to keep the users' data in a single place; others are creating a logical link among users' data, which may stay with various service providers.

text: How are data processed?

text: 11 Data either do not leave the PIMS (and in certain models algorithms are even imported and computed internally) or data are securely transferred to the service providers, where they may also be stored in an encrypted form for the processing operations. Data and their properties are kept in an interoperable machine-readable format enabling interactions without human intervention.

text: How are security and data protection implemented?

text: 12 Security and data protection are the main drivers of PIMS. Cryptography plays a fundamental role and is a necessary component for the security of the data and for mutual reliance on the authenticity and integrity of data and processing among all stakeholders in the data processing chain: a) encryption can ensure confidentiality of data at rest and in transit;

text: 6 | P a g e

text: b) cryptographic features may be used to verify the authenticity of data and to implement users’ privacy preferences such as authorised purposes and permitted retention periods against service providers and third parties.

text: 13 In some models, third parties (public or private entities) enter as new actors in the data management ecosystems as trust service providers. Their role is providing mutual trust mainly between users and service providers, by being identity providers and custodians, facilitating authorisation mechanisms and enabling the traceability of personal data and of operations performed on them.

text: 14 Data minimisation and anonymisation services are also provided. For example, it may be possible to make a transaction where the authorisation is not subject to a complete identity disclosure (e.g. the PIMS may confirm that a user meets age requirements, instead of 11 12 demanding the name and date of birth) . In other cases PIMS offer anonymity services vis-a-vis service providers and other parties using the data by e.g. aggregating data before they are transferred to those parties .

text: 2.2. Main features facilitating control of individuals over their personal data

text: 15 One of the main objectives of PIMS is to let users define at a sufficiently granular level how their personal information should be used and for what purposes, and enable them to keep track of the way this information is used so as to be sure that it is not processed in a way not permitted by them. It implies a comprehensive consent management functionality enabling users also to withdraw their consent when desired. Usually a user-friendly control dashboard is provided for this purpose. The other parties (other users and service providers) are usually able to access the data in an automated way according to the privacy preferences established.

text: 16 Beyond identification, authorisation and privacy preferences management, PIMS often provide additional value added services. Some PIMS offer the possibility to retrieve data about the user’s on-line presence (such as browsing history, bookmarks, address books, credentials, location data, financial data, social network activity), and organise it in the PIMS.

text: 17 An interesting development of PIMS is the possibility of including personal analytics features. This would support the new paradigm where users are in control of their data and what the data say about them. In a hypothetical world where all information relating to a user is available to him or her, the user could have a privacy-friendly personal assistant controlling how information from their personal 'big-data' repository is used. This could be done in a sector specific context (e.g. well-being and health data, personal mobility) or in a holistic perspective where data collected about an individual from different sources and in various contexts are aggregated. Users would control how their personal information and/or insights inferred from it are shared with external parties, according to their preferences and for mutual benefit.

text: 2.3. PIMS policy framework and business models

text: 18 PIMS require more than a new data management architecture based on adequate technology. In addition, a commonly agreed policy, trust in its implementation, and mechanisms to monitor and verify this trust and remediate when things go wrong, are also

text: 7 | P a g e

text: essential, to ensure effective security and data protection in a self-regulated environment building upon the legal framework.

text: 19 As a result, some organisations propose PIMS where the secure and privacy friendly management of personal data is ensured by the contribution of many actors, with different roles, under a policy to abide by and a governance scheme. The idea is to create new communities of trust based on transparency and fairness, where traditional online service providers, new economic operators (e.g. PIMS service providers and trust providers) and the individuals whose personal data are managed and processed, can each take a fair share of the benefits of big data.

text: 20 Current prevailing business models for PIMS providers (and other actors enabling the whole ecosystem) are based on online service providers and third parties paying fees or sharing revenues to use the PIMS schema/services. Individuals would in general enjoy free PIMS services, with some possible exceptions for extra services directly provided by the PIMS operator or their business partners.

text: 3. HOW PIMS CAN SUPPORT DATA PROTECTION PRINCIPLES

text: 21 PIMS face significant challenges to become mainstream for personal data management in a market dominated by a small number of operators that may often not be interested in creating synergies with them . None the less, PIMS deserve support and investment in so far as they may support many of the data protection principles, tools and safeguards that are at the core of the new GDPR.

text: 22 Support is essential to those PIMS that genuinely are striving to deploy solutions compliant with the EU data protection vision and legal framework. This would have to be hand-inhand with effective enforcement of the legal safeguards protecting users against unlawful processing of their data and intrusive tracking and profiling techniques that aim at circumventing key data protection principles.

text: 23 In the following Sections we examine these principles, tools and safeguards and consider the challenges to be addressed.

text: 24 Issues to be explored include: how data protection principles are actually implemented (e.g. data subjects' rights, mechanisms for valid consent, controllership and liability, data protection by design, security); interoperability and technical feasibility; business models and interests at stake in PIMS; and the ownership of personal data in the PIMS context.

text: 3.1 Effective consent management to ensure genuine user control and the use of automated mechanisms

text: 25 Consent management is the core function of PIMS, implementing an automated matching of user preferences with requests for personal data. It is essential that privacy preferences are expressed with sufficient granularity and take into consideration a complex context of possible options. Furthermore, especially where the nature of the data and the type of processing could entail high risks for the individuals, their contextual awareness should be raised and mechanisms to trigger human intervention should be available in the PIMS. It could be explored whether it can make sense, and under what safeguards and conditions, to express consent for broader, wider contexts such as medical research sectors. 8 | P a g e

text: 26 It is also important that these automated mechanisms should be periodically matched against the real current will of the individual through ad hoc reminders, to avoid risks arising due to the inability (whatever the reason) of individuals to change their preferences.

text: 27 The use of machine-readable forms of expression of privacy preferences, which either travel with the data (often called 'sticky policies') or logically link with the data, and of protocols enabling their exchange has not entered the market yet and needs further investments to break into real life applications. Several projects have focused on this in the 16 17 past , and other developments have followed that deserve attention and further analysis for possible support.

text: 28 In particular, valid consent needs to be informed . Trust frameworks regulating the use of PIMS by individuals and other stakeholders (see Section 2.3) mandate transparency and information. It is also to be noted that notwithstanding the research efforts relating to the use of machine readable privacy policies, in certain circumstances, individuals will need still to rely on their human assessment to verify the level and the adequacy of the information provided.

text: 3.2 Users in control, rights to access and rectification, right to data portability, data quality

text: 29 The main objective of PIMS is to put users in control of their personal information. In addition to serving as an effective and user-friendly mechanism to provide or withdraw consent, well-designed PIMS would also facilitate the users’ rights of access to their data and their right to keep it up-to-date and accurate, thus enhancing the quality of data. PIMS are among the most promising efforts to implement by design the right to access and rectification and the new right to data portability . They could also improve accuracy of the data and ensure use limited in time, thus facilitating compliance with the storage limitation principle .

text: 30 While most if not all existing PIMS share these objectives and have features to meet them, this does not necessarily mean that risks of loss of confidentiality and unfair use of the data completely disappear. Technical measures may help discover and provide proof of what went wrong, but if data leave a PIMS in unencrypted form, or even if data are lawfully obtained but subsequently decrypted by an organisation that does not comply with its obligations, there is a risk that data will be accessed and used differently from their permitted use configured in the PIMS. This calls for caution and verification of what the PIMS are advertised to do against the reality.

text: 31 The user-friendliness of PIMS and the ability of users to obtain the desired effects by using them is also of outstanding importance, in particular if confronted with the risks of exposing personal data, including sensitive data, to automated consumption by online services. PIMS services should be complemented by extensive educational material and step-by-step guidance and training, notwithstanding the intended ease of use. Providers and developers should consider prospective use by the general public, who are not necessarily equipped with technical and data protection skills and knowledge.

text: 3.3 Data protection by design and by default, interoperability

text: 32 Online service providers, acting as controllers when offering their services, could be supported in complying with the obligation of data protection by design and by default by enabling their services to interface with EU data protection compliant PIMS, and allowing 9 | P a g e that users’ personal data could easily and conveniently be exported to the individual’s PIMS. Collecting and managing the user’s consent, transparency and accountability, security when exchanging data, as well as authorisation mechanisms would need to rely on the features of the PIMS. This means that the responsibility of PIMS operators in designing them in compliance with the GDPR is a fundamental issue. Therefore, policy makers should support PIMS in designing their services specifically with the objective of facilitating compliance with the GDPR.

text: 33 Interoperability is a crucial requirement, which has to be addressed by PIMS . More standardisation efforts are needed by the emerging PIMS industry and these efforts should be facilitated by policy makers.

text: 3.4 Technical means to restrict further use of personal data

text: 34 The enforcement of consent and purpose specification/limitation and data retention to automate matching individual preferences with the online offer (Section 3.1) relies on mutual trust and a-posteriori verification if no adequate technical safeguards are in place. As already mentioned above, solutions have been found that make sure that those rules are automatically verified and enforced, preventing access to the data themselves if rules are not complied with. Cryptography supports the verification of the identity of the data consumer, the match against the permitted and the declared purposes, and guarantees the integrity of the data and of the parameters used to keep control. When, for example, an online service provider wants to use personal data, which are exchanged in an encrypted form, for purposes different from those authorised by the individual, the unavailability of the relevant decryption keys will prevent the access .

text: 35 Keeping control of personal data in the era of the Internet of Things and Big Data cannot succeed without an automated and reliable, yet controlled, enforcement of data protection rules. We believe this is one of the critical areas where research and investment effort should focus.

text: 3.5 Transparency and traceability

text: 36 Not all personal data processing is legally based on consent. For example, eGovernment applications are more likely to be based on specific EU or national legislation or on another legal basis such as necessity for carrying out a task in the public interest . Even in these cases PIMSs features to control how data can be very useful to enhance transparency and traceability. PIMS could indeed facilitate informing citizens about transfers in accordance with the applicable data protection legislation. For example, by looking at their dashboard in their PIMS citizens could know whether their personal data have been transferred between two different public administrations in cases where transfers are defined by law. Furthermore, even where data is processed for a specific purpose based on another legal basis, PIMS can help individuals to effectively manage their consent for possible further utilisation for other purposes. In such cases mechanisms informing and warning the individual of a possible change of purpose should be designed to facilitate compliance with data protection principles.

text: 3.6 Data security

text: 37 Identification and authorisation mechanisms in PIMS can benefit from research and developments in other contexts. Open and scalable identification, authentication and 10 | P a g e authorisation architectures and solutions are already in use and initiatives are on-going to improve the technology. Data minimisation can be based on the fact that authentication is different from identification: an individual does not necessarily need to identify himself or herself to be granted authorisation to access and use a resource; instead, it is sufficient to show a valid authorisation (whose 'validity' is e.g. mutually ensured by a mutually trusted third party).

text: 38 A high level of security is one of the features required by PIMS. As mentioned, here the architecture and the use of encryption make the difference. Strong, secure encryption should always be an essential component of PIMS to deliver on their promises. As to encryption, key management is one of the determining factors. Different models are proposed, ranging from keeping the encryption keys locally by an individual’s device, or by the PIMS provider or by a trusted third party. All of them have different risks and opportunities. In any case the physical separation of keys and data is highly recommended. Centralised storage of all or a very significant portion of a user's personal data might represent a high risk per se. As to key storage location, many security experts agree that it can be risky to store data locally in personal devices because they often feature a low level of protection. On the other hand, cloud-based services bear also their own specific security risks. In many circumstances, though, entrusting individuals' own data to a trustworthy PIMS operating in a secure and well-designed cloud-based environment could be a sustainable choice.

text: 39 PIMS should be clear towards customers on the benefits and risks that their architecture implies, also with respect to the nature of the data they are ready and accountable to manage so that users can make an informed choice.

text: 3.7 Transfers of personal data

text: 40 PIMS which follow the principles of data protection by design may help ensure that any transfer of personal data beyond the borders of the European Union will be done in compliance with the rules of the GDPR relating to international transfers.

text: 41 PIMS may also help empower users to decide for themselves how far they wish to share their data geographically. Depending on the specifications of the individuals concerned, as gatekeepers, PIMS may help ensure that data will travel only insofar as the individual wishes it to do so.

text: 42 Some individuals, for example, might not wish their health data to be transferred outside the European Union (or perhaps even to be shared beyond the borders of their own Member State). Some might opt for allowing transfers only to countries deemed to provide an adequate level of protection. Others may be more willing to take the risks of a broader data sharing. In this case, PIMS can also avail themselves of additional opportunities under the GDPR for the transfer of personal data. For example, they may enter into data transfer agreements with the recipients, which ensure that these recipients take upon themselves binding contractual obligations in compliance with the law.

text: 3.8 Controllership and liability

text: 43 PIMS can be considered intermediaries, or 'platforms' of a sort connecting two sides of the market: individuals offering their data for (re)use on the one hand, and organisations wishing to (re)use this data. Given this special situation, it is important for any PIMS to 11 | P a g e clearly specify their role and liability vis-a-vis the individuals who entrust their data to them.

text: 44 With respect to certain aspects of data processing, such as storage of data, there is usually no doubt that the PIMS will act as a controller, and therefore it is responsible for keeping the data secure. On this basis the PIMS will need to comply with all the provisions of the GDPR, for example those regulating security breaches.

text: 45 In other cases, the analysis may be more complex, and it will be essential to clarify roles, responsibilities and liability . For example, in case of a data breach or misuse of information by the customers of the PIMS (rather than the PIMS itself), to what extent: will the PIMS be liable? Will PIMS have any responsibility for screening and ensuring their customers are reliable?

text: 46 Further, it should be made equally clear whether the PIMS themselves are entitled to further process the data, and if so, for what purposes and subject to what other terms and conditions.

text: 47 In all aspects, whether with regard to its own data processing activities or those of its customers, it is also important to clarify whether, and to what extent PIMS may contractually limit their liability vis-a-vis the individuals' whose data they hold (it is to be noted, however, that in any event, as regards the liability of a PIMS as a controller, cocontroller or a processor, Article 82 of the GDPR will apply, in any event).

text: 3.9 Looking for a sustainable business model in the interest of the individuals

text: 48 The current revenue model on the internet is primarily based on ‘free’ services provided to individuals in exchange of their personal data, making it a challenge to persuade a sufficient number of individuals to pay for PIMS. At the same time, organisations that hold large amounts of data may have a vested interest in keeping that data for themselves and under their control (as a competitive advantage) rather than enabling user control, whether through PIMS or other means (here the new right to data portability under the GDPR may provide some counterbalance).

text: 49 PIMS can have clear advantages for online service providers. On the one hand, PIMS may facilitate compliance with the GDPR. On the other hand, they may provide a more complete, targeted and clean set of personal data from consumers. This would reduce the cost of accessing such data.

text: 50 Possible business models for PIMS that could be viable for the individuals and the PIMS themselves include so-called “freemium” models vis-à-vis individuals: free basic functionalities, with additional functionalities, e.g. individual analytics on top of data against payment. Offering analytics-as-a-service on top of the data and fund the platform partly on this basis could represent in itself a privacy-preserving design facilitating big data analytics on top of personal information. PIMS can also be offered as a service to companies or other organisations willing to improve their service offer to their clients through a privacy-friendly means of interaction. Revenue in this context would be generated by fees paid by the organisations using the data managed by the PIMS. Public sector bodies can likewise be clients when exploring personal information management in order to allow citizens to better manage access and use of their 12 | P a g e data in an ‘eGovernment’ context, e.g. in a setting where the ‘once-only’ principle is applied.

text: 51 Another consideration is that some of the effects of using personal information (unsolicited advertisement and similar, price discrimination in the context of sales over the internet, other forms of discrimination or refusal of service and similar) may be regarded as negative externalities. If so, then it is perhaps unfair to ask the user to pay for enhanced privacy. Privacy is a fundamental right and should not become a privilege which can only be afforded by the richer parts of the population.

text: 52 In any event, it is crucial to ensure the transparency of the business model vis-à-vis the individuals whose data are being processed so that they are aware of the interests at stake (of PIMS and other service providers) and can use PIMS in full awareness.

text: 3.10 ‘Authorising use of’ rather than ‘selling’ personal data

text: 53 The model of PIMS seems to invite a debate over who ‘owns’ our personal data. Individuals in the EU have a fundamental right to the protection of their personal data, based upon Article 8 of the EU Charter of Fundamental Rights. Detailed rights and obligations relating to the exercise of this right are regulated in further detail in the recently adopted GDPR. These issues are not specific to PIMS: personal data is often perceived as the ‘currency’ we pay for so-called ‘free’ services on the internet. This trend does not, however, mean that personal data of individuals can legally be considered as property which can be traded freely as any other property on the market. On the contrary, as a matter of principle PIMS will not be in a position to ‘sell’ personal data, but rather, their role will be to allow third parties to use personal data, for specific purposes, and specifics periods of time, subject to terms and conditions identified by the individuals themselves, and all other safeguards provided by applicable data protection law.

text: 4. CONCLUSIONS AND NEXT STEPS

text: 4.1. Towards full application of the GDPR - opportunities

text: 54 As noted above, the EU legislator recently adopted a data protection reform package that strengthens and modernises the regulatory framework so that it remains effective in the era of big data.

text: 55 The new GDPR, including rules on increased transparency, and powerful rights of access and data portability, should help give individuals more control over their data, and may also contribute to more efficient markets for personal data, to the benefit of consumers and businesses alike.

text: 56 Codes of conduct and certification schemes as provided for by the GDPR are privileged instruments to give specific visibility and role to technology and products that - like PIMS - may serve to more effectively implement data protection law at the practical level.

text: 57 However, PIMS face the overarching difficulty of penetrating a market dominated by online services based on business models and technical architectures where individuals are not in control of their data, as explained in Section 3.9. Shifting to a situation where individuals have the effective possibility to give a service provider access to some data in their PIMS instead of providing the data directly to the service provider will require 13 | P a g e additional incentives for the service providers. The Commission may use the initiatives it has announced on data flows and data ownership to explore which additional policy initiatives could motivate data controllers to accept this way of providing data. Furthermore, an initiative by public eGovernment services to accept PIMS as a data source instead of direct data collection could add critical mass to the acceptance of PIMS.

text: 58 This analysis could be complemented by measures aiming at laying the technical, societal and economic foundations, including standardisation efforts, economic incentives and fostering research and pilot projects.

text: 59 The European Union and Member States public administrations, and projects co-financed by them, are the first places where this change of perspective should be tested, fostered and hopefully realised.

text: 4.2. Supporting PIMS and underlying technology towards effective data protection

text: 60 Good regulation, while crucial, is not sufficient in itself. As we stated in our Opinion on ‘Meeting the challenges of big data' , companies and other organisations that invest a lot of effort into finding innovative ways to make use of personal data, should use the same innovative mind-set when implementing data protection principles.

text: 61 The contribution of technology in the PIMS model is fundamental. PIMS can serve to test data protection by design approaches and technologies supporting them. Relevant research topics, where adequate support and investments are needed, include: interoperable and privacy-friendly identity management; authorisation mechanisms; data interoperability; data security; and mechanisms for automatic enforcement of established 'contracts' between individuals and other parties. All this is leveraged by cryptography and encryption and boosted by the cheap availability of computing power. Decisive support by policy makers, such as the Commission, to basic and applied research in these technology domains is necessary in this initial phase so as not to lose current opportunities.

text: 62 In order to foster research and development and deployment to market in the area of PIMS, we recommend that the Commission plan for possible synergies with other areas of the Digital Single Market strategy, such as Cloud Computing and the Internet of Things. In this way, pilot projects could be carried out to design and test the interaction of cloud services and IoT with PIMS.

text: 4.3. How the EDPS will advance this debate

text: 63 The EDPS aims to contribute to fostering private and public efforts in the direction outlined above. We will continue to facilitate discussions, including via organisation of events/workshops, for example, with the view to identify, encourage and promote best practice to increase transparency and user control and explore the opportunities offered by PIMS. We will also continue to facilitate the work of the Internet Privacy Engineering Network (IPEN) as an interdisciplinary knowledge hub for engineers and privacy experts. In this context, we will continue to provide a platform for developers and promoters of PIMS to benefit from exchanges with specialists in other technologies and data protection. 14 | P a g e Marrakesh, 20 October 2016 (signed) Giovanni Buttarelli European Data Protection Supervisor 15 | P a g e

text: Notes

text: 16 | P a g e

text: 17 | P a g e

type: vagledning

utgivare: edps