text: COM(2023) 706 final. COM(2023) 705 final. 1

text: OJ L 295, 21.11.2018, p. 39. 4

text: Regulation (EU) 2018/1727

text: of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council Decision 2002/187/JHA (OJ L 295, 21.11.2018, p. 138).

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89). 6 At the moment, the only existing adequacy decision under the LED is on the United Kingdom, available at https://eurlex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D1773 7 COM(2020) 743 final. 8 EDPS Opinion 10/2020 on the negotiating mandate to conclude ten agreements allowing the exchange of data between Eurojust and the competent authorities for judicial cooperation in criminal matters in certain third countries. 4

text: Council Decision authorising the opening of negotiations for Agreements between the European Union and Algeria, Argentina, Armenia, Bosnia and Herzegovina, Brazil, Colombia, Egypt, Israel, Jordan, Lebanon, Morocco, Tunisia and Turkey on cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the competent authorities for judicial cooperation in criminal matters of those third States, see 6153/21 + ADD 1, Council Decision adopted by written procedure on 1 March 2021 (CM 1990/21). 10 See Explanatory Report, COM(2023) 706 final, p. 2. 11 COM(2023) 706 final. 12 COM(2023) 705 final. 13 See Article 1 of the Annexes to the Proposals. 14 See Explanatory Report, COM(2023) 706 final, p. 3. 5

text: See Explanatory Report, COM(2023) 706 final, p. 1. 16 For further details see the EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data, issued on 19 December 2019, https://edps.europa.eu/sites/edp/files/publication/19- 12- 19_edps_proportionality_guidelines_en.pdf. 17 See Judgments of the Court of Justice of 6 October 2020, La Quadrature du Net and others, joined cases

text: and 520/18, ECLI:EU:C:2020:791, paragraph 130, of 8 April 2014 in Joined Cases

text: and

text: , Digital Rights, EU:C:2014:238, paragraph 52; of 16 December 2008 in

text: Case C-73/07

text: Satakunnan Markkinapörssi and Satamedia, EU:C:2008:727, paragraph 56; of 9 November 2010 in Joined Cases

text: and

text: Volker und Markus Schecke and Eifert, EU:C:2010:662, paragraphs 77 and 86 and Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592, paragraph 140. 18 In accordance with Article 26 of the Eurojust Regulation,

text: Article 3

text: and Chapter IX of EUDPR apply to the processing of operational personal data by Eurojust. 6

text: See to that effect

text: Article 56

text: and recital 45 of the Eurojust Regulation. 20 Opinion 1/15, EU-Canada PNR Agreement, ECLI:EU:C:2017:592, par. 219. 7

identifier: EDPS yttrande 52/2023

title: EDPS Opinion 52/2023 on two Proposals for Council Decisions on the signing and conclusion of Agreement between the EU and Armenia on cooperation between Eurojust and the competent authorities for judicial cooperation in criminal matters of Armenia

text: 11 December 2023

text: Opinion 52/2023

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Council Decision on the signing, on behalf of the Union, of an Agreement between the European Union, of the one part, and the Republic of Armenia, of the other part, on cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the competent authorities for judicial cooperation in criminal matters of the Republic of Armenia , and the Proposal for a Council Decision on the conclusion of an Agreement between the European Union, of the one part, and the Republic of Armenia, of the other part, on cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the competent authorities for judicial cooperation in criminal matters of the Republic of Armenia .

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposals and the future Agreement that are relevant from a data protection perspective.

text: Executive Summary

text: On 14 November 2023, the European Commission issued two Proposals for Council Decisions, under

text: Article 16(2)

text: Article 85

text: and Article 218(5) of the Treaty on the Functioning of the European Union, one on the signing and other on the conclusion, on behalf of the Union, of an Agreement between the European Union, of the one part, and the Republic of Armenia, of the other part, on cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the competent authorities for judicial cooperation in criminal matters of the Republic of Armenia. The proposals are accompanied by an Annex containing the agreed text of the Agreement.

text: The objective of the future Agreement is to enhance judicial cooperation between Eurojust and the competent authorities of Armenia by allowing the transfer of personal data between Eurojust and the competent authorities of Armenia, in order to support and strengthen their cooperation in investigating and prosecuting serious crime, in particular organised crime and terrorism, while ensuring appropriate safeguards with respect to fundamental rights and freedoms of individuals, including privacy and the protection of personal data.

text: The EDPS has already had the opportunity to comment on the exchange of personal data between Eurojust and the competent authorities of Armenia in his Opinion 10/2020, where the EDPS provided several recommendations in order to clarify and, where necessary, further develop the safeguards and controls with respect to protection of personal data. The EDPS notes with satisfaction that his recommendations have been taken into account and that the provisions of the Agreement are consistent with the provisions of Chapter IX of EUDPR on the processing of operational personal data by union bodies, offices and agencies. As a result, it could be concluded that the presented Agreement between the EU and Armenia adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

text: At the same time, in this Opinion, the EDPS provides some recommendations, in particular with regards to onward transfers of personal data, right to erasure of personal data, and the review and evaluation of the future Agreement, aimed at facilitating the practical implementation of the future Agreement by Eurojust and the competent authorities of Armenia.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: Regulation (EU) 2018/1727

text: (‘Eurojust Regulation’) lays down specific rules regarding transfers of personal data by Eurojust to third countries and international organisations.

text: Article 56(2)

text: thereof lists a number of legal grounds, based on which Eurojust could lawfully transfer data to authorities of third countries, such as an adequacy decision of the Commission in accordance with

text: Article 36 of Directive (EU) 2016/680

text: finding that the third country ensures an adequate level of protection ; a cooperation agreement allowing for the exchange of operational personal data concluded before 12 December 2019 between Eurojust and the given third country or international organisation; or an international agreement between the Union and the third country or international organisation pursuant to

text: Article 218

text: TFEU that provides for adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

text: 2. On 19 November 2020, the Commission adopted a Recommendation for a Council Decision authorising the opening of negotiations for Agreements between the European Union (EU) and Algeria, Armenia, Bosnia and Herzegovina, Egypt, Israel, Jordan, Lebanon, Morocco, Tunisia and Turkey on cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the competent authorities for judicial cooperation in criminal matters of those third States .

text: 3. The European Data Protection Supervisor issued an Opinion regarding the Recommendation on 17 December 2020. The Council granted the authorisation for the opening of the negotiations on 1 March 2021, adding also Argentina, Brazil and Colombia to the list, and adopted a set of negotiating directives .

text: 4. The negotiations with Armenia began in April 2022 and a preliminary agreement was reached in October 2022 . Consequently, on 14 November 2023, the Commission issued the Proposal for a Council Decision on the signing, on behalf of the Union, of an Agreement between the European Union, of the one part, and the Republic of Armenia, of the other part, on cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the competent authorities for judicial cooperation in criminal matters of the Republic of Armenia and the Proposal for a Council Decision on the conclusion of an Agreement between the European Union, of the one part, and the Republic of Armenia, of the other part, on cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the competent authorities for judicial cooperation in criminal matters of the Republic of Armenia (‘the Proposals’), both accompanied by its respective Annexes containing the final negotiated text of the Agreement.

text: 5. The objective of the future Agreement is to enhance judicial cooperation between Eurojust and the competent authorities of Armenia by allowing the transfer of personal data between Eurojust and the competent authorities of Armenia, in order to support and strengthen the action by the competent authorities of the Member States of the Union and those of Armenia, as well as their cooperation in investigating and prosecuting serious crime, in particular organised crime and terrorism, while ensuring appropriate safeguards with respect to fundamental rights and freedoms of individuals, including privacy and the protection of personal data .

text: 6. The envisaged Agreement builds upon the EU-Armenia Comprehensive and Enhanced Partnership Agreement (CEPA), which entered into force on 31 March 2021. One of the objectives of CEPA is to enhance cooperation in the area of freedom, security and justice, with the aim of reinforcing the rule of law and respect for human rights and fundamental freedoms, including through closer cooperation between Eurojust and the competent authorities of the Republic of Armenia .

text: 7. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 14 November 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 9 of the Proposals.

text: 2. General remarks

text: 8. The EDPS does not dispute the need for cooperation between Eurojust and judicial authorities of third countries involved in the investigation and prosecution of serious crimes, which does not stop at Union borders. In this regard, Eurojust should be able to cooperate and exchange personal data with them to the extent necessary for the accomplishment of its tasks .

text: 9. However, it must be borne in mind that transfers of personal data gathered in the context of criminal investigations envisaged under the future Agreement are liable to have a significant impact on the lives of the individuals concerned, as they will be used in prosecution cases in the receiving country under its national law. Consequently, the necessity and proportionality of the envisaged processing need to be assessed in accordance with Article 52(1) of the Charter .

text: 10. In particular, transfers of personal data between Eurojust and the authorities competent for judicial cooperation in criminal matters of Armenia constitute an interference with individuals’ rights to privacy and data protection guaranteed by Articles 7 and 8 of the Charter. Therefore, the future Agreement must ensure that the derogations and limitations to rights to privacy and data protection, including in relation to fighting crime, apply only in so far as is strictly necessary . In that regard, the EDPS welcomes Article 10(5) of the future Agreement, obliging the Parties to comply with the safeguards provided for in the Agreement regardless of the nationality of the data subject concerned and without discrimination.

text: 11. As mentioned above, the EDPS has already had the opportunity to comment on the exchange of personal data between Eurojust and the competent authorities of Armenia in his Opinion 10/2020, where the EDPS provided several recommendations in order to clarify and, where necessary, further develop the safeguards and controls with respect to protection of personal data. The EDPS notes with satisfaction that his recommendations have been taken into account and that the future Agreement provides for similar data protection safeguards as provided for in Chapter IX of EUDPR with regard to processing of operational personal data by Union bodies, offices and agencies when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part three TFEU .

text: 12. As a result, it could be concluded that the presented Agreement between the Union and Armenia adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

text: 13. At the same time, the EDPS considers that certain safeguards with respect to the protection of personal data, while already provided for in the future Agreement, may still benefit from additional precision and clarity. In this regard, the subsequent comments by the EDPS aim at facilitating the practical implementation of the Agreement by Eurojust and the competent authorities of Armenia.

text: 3. Onward transfers of personal data received

text: 14. The EDPS recalls that, in accordance with

text: Article 56(6)

text: and recital 45 of the Eurojust Regulation, when personal data are transferred from Eurojust to a third country, the level of protection of natural persons ensured by the Eurojust Regulation and by Union law must not be undermined. This requirement is fully valid also in case of a potential onward transfer of personal data received from Eurojust by the competent authorities of Armenia to other Armenian authorities or to the authorities of a third country or to an international organisation .

text: 15. The EDPS therefore welcomes Article 13 of the future Agreement, which prohibits further transferring the personal data received from Eurojust to other Armenian authorities or to the authorities of a third country or to an international organisation, unless such onward transfer is carried out under certain strictly limited conditions.

text: 16. The EDPS welcomes paragraph 1(c) of

text: Article 13

text: , which lays down that the possible onward transfer to other Armenian authorities is subject to the same conditions and safeguards as those applying to the original transfer.

text: 17. In that regard, although this is not explicitly mentioned in paragraph 2 of the same Article, regulating onward transfers to the authorities of a third country or to an international organisation, the EDPS expects that, when giving its explicit prior authorisation pursuant to paragraph 2(b), Eurojust will assess and clearly indicate whether the conditions and safeguards applying to the original transfer should also apply to the onward transfer, similarly to the explicit obligation in paragraph 1(c) of

text: Article 13

text: 4. Right to access, rectification, erasure or restriction

text: 18. The EDPS recalls that the right of access and the right to rectification are essential elements of the right to data protection under Article 8(2) of the Charter. Furthermore, as regards Article 7 of the Charter, the European Court of Justice has held that “the fundamental right to respect for private life, enshrined in that article, means that the person concerned may be certain that his personal data are processed in a correct and lawful manner. In order to carry out the necessary checks, that person must have a right of access to the data relating to him which is being processed” .

text: 19. The EDPS therefore welcomes the inclusion, under Articles 14 and 15 of the future Agreement, of a right to access as well as rectification, erasure or restriction. With regards specifically to the right to erasure, the EDPS positively notes that paragraph 2 of

text: Article 15

text: prescribes that the Parties must provide for any data subject to have the right to obtain from the authorities processing personal data transferred under the Agreement the erasure of personal data concerning the data subject where the processing of the personal data infringes data protection principles (Article 10(1) of the Agreement) or rules on automated processing of personal data (

text: Article 12

text: thereof), or where the personal data must be erased in order to comply with a legal obligation to which the authorities are subject.

text: 20. The EDPS considers that even though the provision of

text: Article 15(2)

text: refers explicitly only to infringements of

text: Articles 10(1)

text: or Article 12 of the Agreement as grounds enabling the data subject to obtain erasure of personal data, this list is not exhaustive. In particular, it is the understanding of the EDPS that the infringement of

text: Article 10(1)

text: (a) - lawfulness of processing of personal data - should be interpreted broadly, thus covering possible infringements of other provisions of the future Agreement, such as

text: Article 10(6)

text: and

text: Article 11

text: 5. Review and evaluation of the Agreement

text: 21. The EDPS welcomes Article 31 of the future Agreement that provides for the regular review and evaluation of the Agreement and specifically envisages the participation of “relevant experts on data protection” in the respective review teams. To this context, the EDPS recommends the involvement in the review and evaluation of the Agreement of representatives of the independent data protection authorities of the EU and of Armenia.

text: 6. Conclusions

text: 22. In light of the above, the EDPS makes the following recommendations: (1) in case of onward transfers to the authorities of a third country or an international organisation, when giving its prior explicit authorisation, Eurojust to assess and clearly indicate whether the conditions and safeguards applying to the original transfer should also apply to the onward transfer, similarly to the explicit obligation from paragraph 1(c) of Article 13 of the future Agreement. (2) the infringement of

text: Article 10(1)

text: (a) - lawfulness of processing of personal data - to be interpreted broadly, thus providing the data subjects with the right to obtain from the authorities processing personal data transferred under the Agreement the erasure of their personal data in case of infringements of other provisions of the future Agreement as well, such as

text: Article 10(6)

text: and

text: Article 11

text: . (3) to involve the independent data protection authorities of the EU and of Armenia in the future reviews and evaluations of the Agreement. Brussels, 11 December 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8


text: COM(2023) 416 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 416 final. 4 See p. 4 of the Explanatory Memorandum of the Proposal. See p. 7 of the Explanatory Memorandum of the Proposal. 4

text: See

text: Article 5(1)

text: (c) GDPR and

text: Article 4(1)

text: (c) EUDPR. 7

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1). 5

identifier: EDPS yttrande 53/2023

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 53/2023 on the Proposal for a Directive on Soil Monitoring and Resilience (Soil Monitoring Law)

serie: yttranden

text: 11 December 2023

type: rubrik

text: Opinion 53/2023

text: on the Directive on Soil Monitoring and Resilience (Soil Monitoring Law)

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Directive of the European Parliament and of the Council on Soil Monitoring and Resilience (Soil Monitoring Law) .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 5 July 2023, the European Commission issued a Proposal for a Directive of the European Parliament and of the Council on Soil Monitoring and Resilience (Soil Monitoring Law).

text: The objective of the Proposal is to put in place a soil monitoring framework for all soils across the EU, which will address the current gap of knowledge on soils. It should be an integrated monitoring system based on EU level, Member State and private soil data.

text: The EDPS welcomes the objectives of the Proposal as well as the fact that they are meant to be achieved without (substantial) processing of personal data, which would be in line with the data minimisation principle.

text: However, the EDPS considers it necessary to clarify why exactly is EUDPR mentioned in Article 19(2) of the Proposal. If no personal data are meant to be processed, as it currently seems to stem from the Proposal, the reference to the EUDPR should be deleted from the Proposal. On the other hand, in case personal data are meant to be processed under the Proposal, it needs to be clarified in the Proposal which categories of personal data would be processed, by whom and for what purposes.

text: Contents

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 5 July 2023, the European Commission issued a Proposal for a Directive of the European Parliament and of the Council on Soil Monitoring and Resilience (Soil Monitoring Law) (‘the Proposal’).

text: 2. The objective of the Proposal is to put in place a solid and coherent soil monitoring framework for all soils across the EU, which will address the current gap of knowledge on soils. It should be an integrated monitoring system based on EU level, Member State and private data. This data will be based on a common definition of what constitutes a healthy soil and will underpin the sustainable management of soils, to maintain or enhance soil health, and thus to achieve healthy and resilient soils everywhere across the EU by 2050 .

text: 3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 25 October 2023, pursuant to Article 42(1) of EUDPR.

text: 2. General remarks

text: 4. The EDPS notes and welcomes the aim of the Proposal to put in place a soil monitoring framework for all soils across the EU and to continuously improve soil health in the Union with the view to achieve healthy soils by 2050 and maintain soils in healthy condition. As stated by the Commission, the Proposal is an important piece of the European Green Deal and an instrument to achieve EU policy objectives such as climate neutrality, resilient nature and biodiversity, zero pollution, sustainable food systems, human health and wellbeing .

text: 5. The EDPS also welcomes the fact that, when it comes to this specific Proposal, the objectives are meant to be achieved without (substantial) processing of personal data, which would be in line with the data minimisation principle .

text: 3. References to the data protection framework

text: 6. The EDPS notes that Article 19(2) of the Proposal provides that the Commission must ensure that soil health data made accessible through the digital soil health data portal referred to in Article 6 of the same Proposal is available to the public in accordance with the EUDPR. While the EDPS affirms that any processing of personal data must be in line with the EU data protection legislation, including the EUDPR, it is the EDPS’ opinion that the wording of

text: Article 6

text: and Article 19 of the Proposal does not in any way imply processing of personal data but only soil (health) data.

text: 7. In that regard, the EDPS considers it necessary to clarify why exactly EUDPR is mentioned in Article 19(2) of the Proposal. If any personal data would need to be processed under the Proposal, it must be explicitly determined which categories of personal data would be processed, by whom and for what purposes. In addition, any processing of personal data should be limited to what is necessary and proportionate in relation to the purpose for which they are processed. Personal data must be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes.

text: 8. Furthermore, the EDPS underlines that, in case there would be processing of personal data provided for under the Proposal, this processing must comply with the requirements of the

text: Regulation (EU) 2016/679

text: (in case of processing of personal data by Member States or by entities in the Member States) and/or the EUDPR (in case of processing of personal data by the Union institutions and bodies). In such a case, the EDPS advises to make an explicit reference to the applicability of the GDPR and/or EUDPR to the processing of personal data under the future Regulation in a recital of the Proposal instead of

text: Article 19(2)

text: . On the other hand, if no personal data are meant to be processed, as it currently seems to stem from the Proposal, the reference to the EUDPR should be deleted.

text: 4. Conclusions

text: 9. In light of the above, the EDPS makes the following recommendations: (1) to clarify whether any personal data would be processed under the Proposal, if so, by whom and for what purposes; (2) to delete the reference to the EUDPR in

text: Article 19(2)

text: and, if any processing of personal data is envisaged, to refer to data protection legislation (GDPR and/or EUDPR) in a recital of the Proposal; (3) to make reference to this Opinion in a recital of the final text of the Proposal. Brussels, 11 December 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 6

type: vagledning

utgivare: edps


text: COM(2023) 736 final. COM(2023) 734 final. 1

text: OJ L 295, 21.11.2018, p. 39. 4

text: Council Regulation (EU) No 904/2010 of 7 October 2010

text: on administrative cooperation and combating fraud in the field of VAT, OJ 12.10.2010, L 268, p. 1.

text: Council Regulation (EU) 2018/1541 of 2 October 2018

text: amending Regulations

text: (EU) No 904/2010

text: and

text: (EU) 2017/2454

text: as regards measures to strengthen administrative cooperation in the field of value added tax, OJ 16.10.2018, L 259/1, p. 1-11. See also COM(2023) 736 final. p. 1. 6 Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ L 281, 23.11.1995, p. 31. 4

text: EDPS Opinion 12/2022 on the Recommendation for a Council Decision to authorise the Commission to open negotiations for the amendment of the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, fight against fraud and recovery of claims in the area of value added tax, issued on 20 June 2022. 8 Point 5e of Annex XI to the EEA Agreement. 5

text: Charter of Fundamental Rights of the European Union, OJ C 326, 26.10.2012, p. 391–407. 10 EDPS Opinion 12/2022 on the Recommendation for a Council Decision to authorise the Commission to open negotiations for the amendment of the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, fight against fraud and recovery of claims in the area of value added tax, issued on 20 June 2022, paragraph 15. 6

identifier: EDPS yttrande 54/2023

amnesord:
International Cooperation
Tax cooperation

title: EDPS Opinion 54/2023 on the amendment of the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, combating fraud and recovery of claims in the field of value added tax

text: 13 December 2023

text: Opinion 54/2023

text: on the Proposals for a Council Decision on the conclusion and signing on behalf of the Union of the amendment of the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, combating fraud and recovery of claims in the field of value added tax

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’. Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Council Decision on the conclusion on behalf of the Union of the amendment of the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, combating fraud and recovery of claims in the field of value added tax , as well as to the Proposal for a Council Decision on the signing on behalf of the Union of the amendment of the Agreement between the European Union and the Kingdom of Norway . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 24 November 2023, the European Commission issued a Proposal for a Council Decision on the conclusion on behalf of the Union of the amendment of the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, combating fraud and recovery of claims in the field of value added tax, as well as a Proposal for a Council Decision on the signing on behalf of the Union, of the amendment of the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, combating fraud and recovery of claims in the field of value added tax (‘the Proposals’).

text: The aim of the Proposals is to foster the administrative cooperation in the field of value added tax between the competent tax authorities in the European Union and their homologue in Norway.

text: The EDPS welcomes that the Agreement would update the reference to the applicable data protection law by making reference to the provisions of the European Economic Area (EEA) agreement equivalent to

text: Regulation (EU) 2016/679

text: (‘GDPR’). The EDPS recommends, however, to clearly distinguish between confidentiality rules pursuant to national law and confidentiality rules pursuant to data protection law to avoid any possible confusion.

text: Articles 12

text: to 15, 17, 21 and 22 of the GDPR. While the aim of the restrictions would be to safeguard an objective of general interest recognized by the Union, the EDPS recommends ensuring that the public interests referred to in the Agreement are indicated in an exhaustive manner. In addition, the EDPS recommends to clearly indicate in what circumstances and under which conditions a restriction of data subject rights may be adopted to ensure that the restriction remains limited to what is strictly necessary.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by Union institutions, bodies offices and agencies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 24 November 2023, the European Commission issued a Proposal for a Council Decision on the conclusion on behalf of the Union of the amendment of the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, combating fraud and recovery of claims in the field of value added tax (‘the Agreement’), as well as a Proposal for a Council Decision on the signing on behalf of the Union, of the amendment of the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, combating fraud and recovery of claims in the field of value added tax (‘the Proposals’). The text of the amendment of the Agreement is attached as Annex to the Proposal for a Council Decision on the conclusion on behalf of the Union of the amendment of the Agreement.

text: 2. The objective of the Proposals is to improve cooperation and enhance the fight against tax fraud, bringing added value for both parties to the Agreement (the European Union and Norway). Since the conclusion of the Agreement, which entered into force in September 2018, several amendments were introduced to

text: Council Regulation (EU) No 904/2010

text: , namely by the amending

text: Council Regulation (EU) 2018/1541

text: . 3. The amendment of the Agreement provides for new administrative cooperation tools, similar to the ones introduced by

text: Council Regulation (EU) 2018/1541

text: . In addition, references to the repealed Directive

text: in the Agreement would be updated by the Proposals.

text: 4. On 20 June 2022, the EDPS has issued the Opinion on the Recommendation for Council Decision to authorise the Commission to open negotiations for the amendment of the Agreement .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 24 November 2023, pursuant to Article 42(1) of EUDPR. The EDPS appreciates that fact that he has already been consulted informally at the early stages of the Proposals.

text: 2. General comments

text: 6. The EDPS recognises the importance of ensuring the implementation of the administrative cooperation between the European Union and Norway in the field of value added tax.

text: 7. The EDPS welcomes the reference to the consultation of the EDPS pursuant to Article 42(1) of the EUDPR in recital 5 of the Proposal for Council Decision on the conclusion on behalf of the Union of the amendment of the Agreement and in recital 5 of the Proposal for Council Decision on the signing on behalf of the Union of the amendment of the Agreement.

text: 8. The EDPS welcomes the updated reference to the applicable data protection law. Instead of making reference to Directive

text: , the fifth recital to the preamble of the Agreement would make reference to the provisions of the European Economic Area (EEA) agreement equivalent to

text: Regulation (EU) 2016/679

text: (‘GDPR’) . In the same sentence, the recital would also make reference to rules on confidentiality pursuant to national law.

text: 9. For the sake of clarity, the EDPS recommends having a separate sentence dedicated to compliance with GDPR to avoid any possible confusion with confidentiality rules pursuant to national law. The same recommendation applies to the amendment to Article 6(1) of the Agreement, referring to “confidential and protected” information, as well as with regard to

text: Article 6(9)

text: , addressing in the same sentence breach of confidentiality and personal data breach.

text: 3. Restriction of data subject rights

text: 10. The EDPS notes that the Agreement would allow states to restrict the scope of the obligations and rights provided for in the provisions of the EEA Agreement equivalent to

text: Articles 12

text: to 15, 17, 21 and 22 of the GDPR. Such restrictions should be limited to what is strictly necessary to safeguard the interests referred to in the provisions of the EEA Agreement equivalent to point (e) of

text: Article 23(1) of Regulation (EU) 2016/679

text: , in particular: (a) enable the competent authorities of the states to fulfil their tasks properly for the purposes of this Agreement; or (b) avoid obstructing official or legal enquiries, analyses, investigations or procedures for the purposes of this Agreement and to ensure that the prevention, investigation and detection of tax evasion and tax fraud is not jeopardised.

text: 11. The EDPS notes that the aim of the restrictions would be to safeguard taxation as important objective of general interest recognized by the Union within the meaning of Art. 52(1) of the Charter . However, the EDPS recommends that the public interests referred to in the Agreement are indicated in an exhaustive manner, i.e. deleting the wording “in particular”.

text: 12. In addition, the EDPS recommends to clearly indicate in what circumstances and under which conditions a restriction may be adopted to ensure that the restriction remains limited to what is strictly necessary. In particular, the EDPS recommends for the Agreement to clearly specify: the purposes of the processing; the categories of personal data concerned; the scope of the restrictions introduced; the safeguards to prevent abuse or unlawful access or transfer. Furthermore, the Agreement should specify the controller or categories of controllers; the storage periods; the applicable safeguards taking into account: the nature, scope and purposes of the processing or categories of processing; the risks to the rights and freedoms of data subjects. Moreover, the right of the data subject to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction, should also be referred to in the Agreement.

text: 4. Transfers to third countries

text: 13. Concerning the paragraph on transfers to third countries (

text: Article 6(7)

text: ), the EDPS welcomes the addition of the wording “legally binding and enforceable” (before “assistance arrangements”), as recommended in the Opinion on the Recommendation for Council Decision to authorise the Commission to open negotiations for the amendment of the Agreement .

text: 5. Access to personal data processed by the Commission

text: 14. The amendment to Article 6(10) of the Agreement would allow persons duly accredited by the Security Accreditation Authority of the European Commission to have access to information obtained under the Agreement in so far as it is necessary for care, maintenance and development of the electronic systems hosted by the Commission and used by states to implement the Agreement. It further specifies that “[a]ny access to personal data shall be treated in accordance with

text: Regulation (EU) 2018/1725

text: ”. As

text: Regulation (EU) 2018/1725

text: applies to EU institutions and bodies (and not to states), the EDPS recommends replacing

text: 6. Conclusions

text: 15. In light of the above, the EDPS makes the following recommendations: (1) to distinguish between rules on confidentiality pursuant to national law and rules on confidentiality pursuant to data protection law in the amendments to the fifth recital to the preamble,

text: Article 6(1)

text: and Article 6(9) of the Agreement; (2) to indicate in

text: Article 6

text: (6.a) the general public interests referred to in the Agreement in an exhaustive manner by deleting the word “in particular”; (3) to indicate in what circumstances and under which conditions a restriction of data subject rights may be adopted, in particular by clearly specifying the purposes of the processing; the categories of personal data; the scope of the restrictions introduced; the safeguards to prevent abuse or unlawful access or transfer; the controller or categories of controllers; the storage periods and the applicable safeguards. The right of the data subject to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction, should also be referred to in the Agreement; Brussels, 13 December 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7


text: Eiopa – ordinarie användning EIOPA-BoS-19/040 SV Måndagen den 19 februari 2019

text: Europaparlamentets och rådets förordning (EU) nr 1094/2010 av den 24 november 2010

text: om inrättande av en europeisk tillsynsmyndighet (Europeiska försäkrings- och tjänstepensionsmyndigheten), om ändring av beslut nr

text: och om upphävande av

text: kommissionens beslut 2009/79/EG

text: (EUT L 331, 15.12.2010, s. 48–83).

text: Europaparlamentets och rådets direktiv 2009/138/EG av den 25 november 2009

text: om upptagande och utövande av försäkrings- och återförsäkringsverksamhet (Solvens II) (EUT L 335, 17.12.2009, s. 1–155).

text: Europaparlamentets och rådets direktiv (EU) 2016/97 av den 20 januari 2016

text: om försäkringsdistribution (omarbetning) (EUT L 26, 2.2.2016, s. 19–59). Se slutsatserna från Europeiska rådets extra möte (

text: artikel 50

text: ) den 13 december 2018, punkt 5 (http://data.consilium.europa.eu/doc/document/XT-20022-2018-INIT/sv/pdf). Eiopas yttrande om kontinuitet i tillhandahållandet av tjänster i samband med Förenade kungarikets utträde ur Europeiska unionen (EIOPA-BoS-17/389). Se Eiopas meddelande av den 5 november 2018, https://eiopa.europa.eu/Pages/News/EIOPA-calls-forimmediate-action-to-ensure-service-continuity-in-cross-border-insurance-.aspx

sprak: sv

title: Recommendations for the insurance sector in light of the United Kingdom withdrawing from the European Union

serie: rekommendationer

text: Rekommendationer för försäkringssektorn i samband med Förenade kungarikets utträde ur Europeiska unionen

text: Rekommendationer

text: Inledning

text: 1. I enlighet med

text: artikel 16 i förordning (EU) nr 1094/2010

text: (Eiopaförordningen) utfärdar Eiopa rekommendationer för försäkringssektorn i samband med Förenade kungarikets utträde ur Europeiska unionen.

text: 2. Dessa rekommendationer utgår från direktiv

text: (Solvens II),

text: direktiv (EU) 2016/97

text: (försäkringsdistributionsdirektivet, IDD) samt Eiopas riktlinjer och andra relevanta Eiopa-instrument.

text: 3. Dessa rekommendationer följer en rad yttranden som Eiopa har utarbetat för att främja konsekventa tillsynsmetoder i samband med konsekvenserna av Förenade kungarikets utträde ur Europeiska unionen.

text: 4. Utträdet sker det datum då avtalet om utträde träder i kraft, eller i avsaknad därav, två år efter att Förenade kungariket meddelade sitt utträde, dvs. den 30 mars 2019, såvida inte ett beslut fattas om att förlänga denna tvåårsperiod.

text: 5. Om Förenade kungariket lämnar unionen utan att ha ratificerat avtalet om utträde blir Förenade kungariket ett tredjeland den 30 mars 2019 och brittiska företag och distributörer inom försäkringssektorn förlorar sin rätt att bedriva näringsverksamhet i medlemsstaterna genom etableringsfriheten och friheten att tillhandahålla tjänster. Dessutom kommer brittiska distributörer som inte är registrerade i EU-27 inte längre att ha rätt att bedriva distributionsverksamhet i EU-27.

text: 6. EU och Förenade kungariket har förhandlat fram ett utkast till avtal om utträde som omfattar en övergångsperiod efter utträdet under vilken Förenade kungariket förblir en del av den inre marknaden. Huruvida utkastet till avtalet om utträde kommer att godkännas är för närvarande oklart. Den 13 december 2018 efterlyste Europeiska rådet en intensifiering av arbetet med att på alla nivåer förbereda sig för följderna av Förenade kungarikets utträde, med 4 beaktande av alla tänkbara utfall.

text: 7. Enligt artikel 41.4 i Solvens II-direktivet krävs att försäkringsföretag vidtar rimliga åtgärder för att garantera att deras verksamhet bedrivs med kontinuitet och på ett korrekt sätt, inklusive utvecklingen av beredskapsplaner . Eiopa utfärdade ett yttrande den 21 december 2017 där de behöriga myndigheterna uppmanas att garantera att försäkringsföretagen som bedriver gränsöverskridande verksamhet som kommer att påverkas utvecklar realistiska kontinuitetsplaner där det fastställs åtgärder som ska förhindra icke auktoriserad försäkringsverksamhet och säkerställa att tjänsterna fortsätter att tillhandahållas efter att Förenade kungariket har lämnat unionen samt att de genomför dessa åtgärder. De åtgärder som kan vidtas av brittiska försäkringsföretag är att överlåta försäkringsavtal med gränsöverskridande försäkringar till ett försäkringsföretag som är registrerat i EU-27 och att registrera tredjelandsfilialer i EU-27.

text: 8. Ett flertal brittiska försäkringsföretag i Förenade kungariket och i Gibraltar, särskilt de med större gränsöverskridande verksamhet i EU-27, har vidtagit åtgärder och genomför beredskapsåtgärder. I november 2018 hade dock 124 försäkringsföretag i Förenade kungariket och i Gibraltar, vilka står för 0,16 procent av den totala försäkringsverksamheten inom EES-30, inga eller otillräckligt utarbetade beredskapsplaner för att förhindra icke auktoriserad försäkringsverksamhet och säkerställa kontinuitet i tillhandahållandet av tjänsterna efter Förenade kungarikets utträde . Den berörda verksamheten omfattar 9,1 miljoner försäkringstagare och försäkringsskulder på 7,4 miljarder euro. Majoriteten av sektorn (med försäkringsskulder på 5,4 miljarder euro) omfattar en handfull skadeförsäkringsföretag i Förenade kungariket. Endast 3 procent av de försäkringstagare som eventuellt berörs har ett avtal med livförsäkringsföretag. De resterande företagen står huvudsakligen för kortfristiga försäkringsavtal med lägre försäkringsvärden. Totalt omfattar 75 procent av de berörda försäkringsavtalen försäkringsbestånd med genomsnittliga tecknade premier på mindre än 100 euro per år. I genomsnitt är den kvarstående tidsperioden för försäkringsåtagandena för 76 procent av försäkringsavtalen mindre än två år. Även om detta gäller ett flertal medlemsstater inom EU-27, påverkas en del specifikt med hänsyn till antalet försäkringstagare med ett befintligt gränsöverskridande avtal.

text: 9. Det övergripande målet för dessa rekommendationer är att främja konvergens och konsekventa tillsynsmetoder i behandlingen av brittiska försäkringsföretag och försäkringsdistributörer i medlemsstaterna genom att tillhandahålla en vägledning för hur den befintliga rättsliga ramen för överenskommelser mellan EU och motparter utanför EU ska tillämpas.

text: 10. Dessa rekommendationer är även tillämpbara för försäkringsföretag och försäkringsdistributörer som är registrerade i Gibraltar.

text: 11. Dessa rekommendationer är avsedda för de behöriga myndigheterna. Trots att det i specifika bestämmelser beskrivs skyldigheter som ska uppfyllas av försäkringsföretag och försäkringsförmedlare ska detta dokument inte läsas som att det ålägger dessa finansinstitut några direkta krav. Finansinstituten måste följa det tillsynssystem eller regelverk som tillämpas av deras nationella behöriga myndighet.

text: 12. Termer som inte definieras i dessa rekommendationer har den betydelse som anges i de rättsakter som det hänvisas till i inledningen.

text: 13. Rekommendationerna ska tillämpas från det datum som följer det datum då fördragen upphör att gälla för och i Förenade kungariket i enlighet med

text: artikel 50.3 i fördraget om Europeiska unionen

text: . Rekommendation 1 – Övergripande mål

text: 14. När det gäller behandlingen av gränsöverskridande brittiska försäkringsföretags verksamhet bör de behöriga myndigheterna, med utgångspunkt i unionsrätten och de nationella lagarna, sträva efter att minimera nackdelarna för försäkringstagarna och förmånstagarna. Rekommendation 2 – Ordnad avveckling

text: 15. Behöriga myndigheter bör tillämpa en rättslig ram eller mekanism för att underlätta en ordnad avveckling av företag som inte längre är auktoriserade att bedriva verksamhet eller kräva att försäkringsföretagen omedelbart vidtar alla nödvändiga åtgärder för att auktoriseras för att bedriva verksamhet i enlighet med unionsrätten.

text: 16. De behöriga myndigheterna bör förhindra att brittiska företag ingår nya försäkringsavtal eller upprättar, förnyar, förlänger, utökar eller återupptar försäkringsskydd genom befintliga försäkringsavtal i sina jurisdiktioner så länge de enligt unionsrätten inte är auktoriserade att bedriva sådan försäkringsverksamhet. Detta påverkar inte försäkringstagarens rätt att utöva sin valmöjlighet eller rätt att enligt ett befintligt försäkringsavtal ta ut sina pensionsförmåner. 17.De behöriga myndigheterna bör göra sitt yttersta för att kontrollera brittiska försäkringsföretags gränsöverskridande verksamhet i sina jurisdiktioner. Tillsynen bör omfatta kontroll av marknadsbeteende och, i samarbete med tillsynsmyndigheterna i Förenade kungariket, lämplig översyn av relevanta tillsynsaspekter när det gäller gränsöverskridande verksamhet, däribland de brittiska företagens finansiella ställning. Tillsynen bör vara riskbaserad och ta hänsyn till proportionalitetsprincipen. Rekommendation 3 – Godkännande av tredjelandsfilialer

text: 18. I enlighet med artikel 162 i Solvens II-direktivet får brittiska försäkringsföretag ansöka om auktorisation för att kunna bedriva gränsöverskridande verksamhet genom en filial i en medlemsstat och därmed garantera att företaget får bedriva gränsöverskridande verksamhet i den medlemsstaten. 19. I bedömningen av huruvida de rättsliga villkoren för auktorisationen för en sådan filial är uppfyllda bör de behöriga myndigheterna tillämpa proportionalitetsprincipen och beakta att de brittiska försäkringsföretagen omfattades av kraven i Solvens II före Förenade kungarikets utträde. 20. Om det påskyndar auktorisationsförfarandet bör de behöriga myndigheterna överväga att begränsa auktorisationen av filialen till att avveckla befintlig verksamhet. Rekommendation 4 – Återkallande av auktorisation 21.Om en medlemsstats rättsliga ram omfattar bestämmelser för behandling av försäkringsföretag efter att dess auktorisation har återkallats i enlighet vad som anges i artikel 144.1 a i Solvens II-direktivet, bör den behöriga myndigheten överväga att tillämpa dessa bestämmelser på brittiska försäkringsföretag i sina jurisdiktioner efter Förenade kungarikets utträde. I detta fall bör den behöriga myndigheten göra sitt yttersta för att garantera att dessa bestämmelser tillämpas effektivt i samarbete med tillsynsmyndigheterna i Förenade kungariket. Rekommendation 5 – Överlåtelse av försäkringsbestånd

text: 22. Behöriga myndigheter bör ge brittiska försäkringsföretag utrymme att slutföra överlåtelse av försäkringsbestånden till försäkringsföretag inom EU-27 i det fall som processen inleddes före utträdesdatumet. För detta ändamål bör de behöriga myndigheterna ha ett nära samarbete med tillsynsmyndigheterna i Förenade kungariket och beakta kraven i artikel 39 i Solvens II-direktivet samt bestämmelserna i avsnitt 4.2.1 i tillsynsstyrelsens beslut om samarbetet mellan medlemsstaternas försäkringstillsynsmyndigheter i Europeiska ekonomiska samarbetsområdet av den 30 januari 2017 (EIOPA-BoS-17/014). De behöriga myndigheterna bör bedöma att en överlåtelse av försäkringsbestånd ska inledas i de fall där de brittiska tillsynsmyndigheterna har underrättat dem om inledandet av överlåtelsen av försäkringsbeståndet och det brittiska försäkringsföretaget har betalat transaktionsavgiften till tillsynsmyndigheten i Förenade kungariket och utsett en oberoende expert för att sköta överlåtelsen. Rekommendation 6 – Ändring av försäkringstagarens hemvist eller etableringsställe

text: 23. Om en försäkringstagare med en hemvist eller, om det handlar om en juridisk person, etableringsställe i Förenade kungariket, har ingått ett livförsäkringsavtal med ett brittiskt försäkringsföretag och efter att försäkringstagaren har ändrat sin hemvist eller etableringsställe till en medlemsstat inom EU-27, bör de behöriga myndigheterna i sin tillsynsbedömning beakta att försäkringsavtalet ingicks i Förenade kungariket och att det brittiska försäkringsföretaget inte tillhandahöll några gränsöverskridande tjänster för EU-27 i detta avtal. 24. De behöriga myndigheterna bör tillämpa samma synsätt för skadeförsäkringsavtal som inte reglerar fastigheter eller fastigheter med dess innehåll eller fordon. Rekommendation 7 – Samarbete mellan behöriga myndigheter

text: 25. Om ett brittiskt försäkringsföretag bedriver gränsöverskridande verksamhet i fler än en medlemsstat bör de behöriga myndigheterna i de medlemsstaterna samarbeta i fråga om tillsyn av verksamheten, särskilt vad gäller utbyte av följande uppgifter samt med beaktande av proportionalitetsprincipen: (a)Karaktären och omfattningen hos verksamheten i deras jurisdiktion. (b)Åtgärder som företaget har vidtagit eller planerar att vidta för att säkerställa en ordnad avveckling av den gränsöverskridande verksamheten. (c) Tillsynsåtgärder som har vidtagits eller, om tillämpligt, planeras att vidtas av den behöriga myndigheten i fråga om företaget. (d)Eventuella problem i fråga om marknadsbeteende eller solvens när det gäller företaget.

text: 26. Om det bedöms vara nödvändigt, får Eiopa upprätta en samarbetsplattform för specifika företag med deltagande av de berörda behöriga myndigheterna. De behöriga myndigheterna bör göra sitt yttersta för att delta i plattformen. Rekommendation 8 – Information till försäkringstagare och förmånstagare

text: 27. De behöriga myndigheterna bör informera brittiska försäkringsföretag som bedriver gränsöverskridande verksamhet i deras medlemsstater om kravet att underrätta försäkringstagarna och förmånstagarna om avtal som påverkas av konsekvenserna av att Förenade kungariket lämnar unionen och konsekvenserna för försäkringstagarnas och förmånstagarnas rättigheter och skyldigheter i fråga om dessa avtal. 28. Behöriga myndigheter bör ta bort brittiska försäkringsföretag från sina nationella register över försäkringsföretag på utträdesdatumet och informera allmänheten om den rättsliga ram som är tillämplig för brittiska försäkringsföretag. Rekommendation 9 – Distributionsverksamhet

text: 29. De behöriga myndigheterna bör säkerställa att brittiska förmedlare och enheter som avser fortsätta eller inleda distributionsverksamhet för försäkringstagare inom EU-27 och för risker inom EU-27 efter Förenade kungarikets utträde är etablerade och registrerade i EU-27 i enlighet med bestämmelserna i IDD. De behöriga myndigheterna bör säkerställa att förmedlare som är juridiska personer och som är registrerade i unionen uppvisar en lämplig nivå av företagsmässig tyngd som är proportionell till karaktären, omfattningen och komplexiteten i deras verksamhet. Dessa förmedlare bör inte uppvisa en innehållslös karaktär. Dessutom måste de yrkesmässiga och organisatoriska kraven i IDD uppfyllas löpande. Detta påverkar inte medlemsstaternas rätt att införa särskilda bestämmelser i sina nationella lagar för tredjelandsförmedlare i den mån som motsvarande behandling av förmedlare på respektive marknad säkerställs. 30. I sin bedömning av huruvida en brittisk förmedlare eller enhet tillhandahåller distributionstjänster i EU bör de behöriga myndigheterna beakta att endast en konsekvent och enhetlig tillämpning av IDD kan garantera samma skyddsnivå för konsumenter och säkerställa likvärdiga konkurrensvillkor i unionen. De behöriga myndigheterna bör säkerställa att alla förmedlare som tillhandahåller distributionstjänster som inriktar sig på försäkringstagare och risker inom EU-27 omfattas av tillämpningsområdet för IDD. 31. För detta ändamål bör de behöriga myndigheterna bedöma alla distributionsmodeller i förhållande till hur distributionsverksamhet definieras i IDD. Regler för efterlevnad och rapportering

text: 32. Detta dokument innehåller rekommendationer som har utfärdats enligt artikel 16 i Eiopaförordningen. I enlighet med artikel 16.3 i Eiopaförordningen ska behöriga myndigheter och finansinstitut med alla tillgängliga medel söka följa dessa riktlinjer och rekommendationer.

text: 33. De behöriga myndigheter som följer eller har för avsikt att följa dessa rekommendationer bör införliva dem i sina ramar för regler och tillsyn på ett lämpligt sätt. 34. De behöriga myndigheterna ska, inom två månader från det att de översatta versionerna har offentliggjorts, bekräfta till Eiopa huruvida de följer eller avser att följa dessa rekommendationer, och ange skälen till att de eventuellt inte följer dem. 35. Om Eiopa inte har fått något svar inom denna tidsfrist kommer behöriga myndigheter att anses inte följa rapporteringen och rapporteras i enlighet med detta. Slutbestämmelse om översyn

text: 36. Dessa rekommendationer ska vara föremål för översyn av Eiopa.

utgivare: eiopa


text: EIOPA-BoS-19/144 26 April 2019

text: See Insurance Stress Test 2018.

text: As listed in the Annex 1 – Sample of the 2018 Insurance Stress Test Report.

text: Recommendations on supervisory convergence and financial stability issues

text: NCAs should strengthen supervision of the Groups identified as

text: facing greater exposure to Yield Curve Up and/or Yield Curve Down scenarios. This affects, in particular, those Groups where

text: transitional measures have a greater impact.

text: All NCAs with Groups

text: NCAs should carefully review and, where necessary, challenge the participating in the 2018 capital and risk management strategies of the affected Groups. In stress test exercise particular: o NCAs should require Groups to clarify the impact of the stress test in terms of capital and risk management. o For the affected Groups, stress test scenarios similar to Yield Curve Up and Yield Curve Down should be properly considered in the risk management framework, including the ORSAs. o Review the risk appetite framework for the affected Groups.

text: NCAs should evaluate the potential management actions to be implemented by the affected Groups. In particular: o NCAs should require Groups to indicate the range of actions based on the results of the stress testing. o NCAs should assess if the actions identified are realistic in such stress scenarios. o NCAs should consider any eventual second-round effects.

text: Recommendations on efficiency and enhancing the ST exercise process 4. NCAs should further contribute to enhance the stress test process: o NCAs should check the adequacy of the systems and supporting All NCAs, even if they technologies and the flexibility of the risk modelling used by are not acting as Group Groups to run stress tests scenario/sensitivity analysis Supervisor of the

text: participating Groups

text: o Ensure availability of resources of National experts for future EIOPA Stress Test exercises

text: Recommendations on cross-sectoral coordination

text: All NCAs with financial

text: NCAs should enhance cooperation and information exchange with

text: conglomerates or

text: other relevant Authorities, such as the ECB/SSM or other national

text: banking groups with

text: authorities, concerning the stress test results of the affected insurers

text: major insurance

text: which form part of a financial conglomerate.

text: See EIOPA, 2018, Solvency II tools with macroprudential impact. As stressed in

text: Article 308

text: e of the Solvency II Directive, supervisory authorities shall be informed as soon as an undertaking applying the transitional measures observes that they would not comply with the SCR without the application of such measures. In that case, undertakings are obliged to provide plans with measures in order to ensure, that they are sufficiently capitalised at the end of the transition period. In the YCU scenario, the aggregate AoL ratio drops from 109.5% to 107.6% (drop of 32.2% in the eAoL). Without the use of LTG and transitional measures, the AoL ratio would drop to 105.1% (i.e. 53.1 in the eAoL) with 3 groups reporting an AoL ratio below 100%. In the YCD scenario the aggregate AoL ratio decreases from 109.5% to 106.7%, corresponding to a drop in eAoL of 27.6%. Without LTG and transitional measures, the ratio would drop to 104.8%, corresponding to a decrease of 47.7% in eAoL, with 3 groups reporting an AoL ratio below 100%. 6 As stated in Article 44 of the Solvency II Directive: “Where the reduction of the matching adjustment or the volatility adjustment to zero would result in non-compliance with the Solvency Capital Requirement, the undertaking shall also submit an analysis of the measures it could apply in such a situation to re-establish the level of eligible own funds covering the Solvency Capital Requirement or to reduce its risk profile to restore compliance with the Solvency Capital Requirement”. It should be noted, however, that the LTG measures are of different nature compared to transitional measures, given that the LTG measures are a permanent feature of the Solvency II Directive.

text: In line with EIOPA Opinion to Institutions of the European Union on the Harmonisation of Recovery and Resolution Frameworks for (Re)insurers across the Member States, in a harmonised recovery and resolution framework the insurers should be subject to pre-emptive recovery plans, in a proportionate way. These plans supplement the recovery plans envisaged in Solvency II that should be drafted by undertakings within two months form the observation of non-compliance with the SCR. Pre-emptive recovery plans are already in place for G-SIIs. Some countries have also broadened the scope and requested recovery plans to other type of institutions. These plans focus specifically on the identification of possible measures to be adopted to restore the financial position of the insurer. They are therefore relevant risk management tools to address the implications of any type of scenario such as the YCD and YCU. 8 FSB, 2013, “Principles for An Effective Risk Appetite Framework”. 9 In line with Article 108 of the Solvency II Directive.

text: As stated in the Regulation,

text: Article 23(1)

text: . 11 This request is not associated to the “request to take the necessary measures” as described under Article 138 of Solvency II. 12 EBA defines second-round or feedback effects means the spill over effects caused by the responses of individual institutions to an external original shock, which in aggregate generally amplify (it may also mitigate) such an original shock, thereby causing an additional negative feedback loop.

text: EIOPA (2018): Systemic Risk and macroprudential policy in insurance.

text: As stated in the FICOD (Directive

publisher: Europeiska försäkrings- och tjänstepensionsmyndigheten

title: EIOPAs Insurance stress test 2018 Recommendations

text: Introduction and legal basis

text: 1. During the course of 2018, EIOPA carried out a European-wide stress test (ST) in accordance with Articles 21(2)(b) and 32 of

text: Regulation (EU) 1094/2010 of 24 November 2010

text: of the European Parliament and of the Council (hereafter the ‘Regulation’).

text: 2. The Recommendations contained in this document are issued in accordance with

text: Article 21(2)

text: (b) of the Regulation in order to address issues identified in the stress test.

text: 3. EIOPA will support National Competent Authorities (NCAs) and undertakings through guidance and other measures if needed.

text: Context

text: 4. The results and findings of EIOPA’s Insurance Stress Test 2018 exercise are set out in th detail in the report “2018 Insurance Stress Test Report” published by EIOPA on 14 December 2018.

text: 5. Three stress scenarios were tested in the 2018 exercise, i.e. two scenarios combining market and insurance specific risks, and one natural catastrophe (NatCat) scenario. A detailed description of both scenarios can be found in Section 1.2. of the 2018 Insurance Stress Test Report.

text: 6. The Yield Curve Up (YCU) scenario assumes an abrupt and sizeable reversal of risk premia (RP) in global financial markets leading to a tightening of financial conditions. In the YCU scenario, market shocks are combined with an instantaneous shock to lapse rates and claims inflation.

text: 7. The Yield Curve Down (YCD) scenario assumes a protracted period of extremely low interest rates, with very low rates prevailing for longer maturities. In the YCD scenario, market stresses are combined with a shock to average life expectancy, which is assumed to increase significantly across the entire population.

text: 8. Finally, the NatCat scenario assumes a set of catastrophic losses over Europe from various perils and natural hazards.

text: 9. The insurance ST is a bottom-up exercise, which involves calculations performed by the participating groups on the impact of the three scenarios on their group balance sheet, own funds (OF) and solvency capital requirements (SCR). As in previous exercises, the main objective of the 2018 stress test exercise is to assess the resilience of the European insurance sector to specific adverse scenarios with potential negative implications for the stability of the European financial markets and the real economy. Hence, it cannot be considered as a pass-or-fail or capital exercise for the participating groups.

text: 10. The sample encompasses 42 (re)insurance groups, representing an EEA market coverage of around 75% based on total consolidated assets and of around 65% based on total assets reported for solo undertakings.

text: 11. Groups were requested to calculate their post-stress financial position by applying the same models used for their regular Solvency II reporting. The use of LTG and transitional measures was taken into account and the impact of these measures had to be reported separately.

text: 12. The 2018 Stress Test results showed that on aggregate the insurance sector is sufficiently capitalised to absorb the combination of shocks prescribed in the three scenarios. However, it also confirms the significant sensitivity to market shocks for the European insurance sector with Groups being vulnerable not only to low yields and longevity risk, but also to a sudden and abrupt reversal of risk premia, combined with an instantaneous shock to lapse rates and claims inflation. The exercise further reveals potential transmission channels of the tested shocks to insurers’ balance sheets. For instance, in the YCU scenario the assumed claim inflation shock leads to a net increase in the liabilities of those Groups more exposed to non-life business through claims inflation. Finally, both the YCD and YCU scenario have similar negative impact on poststress SCR ratios.

text: 13. As outlined in the Executive Summary of the 2018 Insurance Stress Test Report, further analyses of the results are required by EIOPA and the NCAs to obtain a deeper understanding of the risks and vulnerabilities of the sector.

text: 14. In order to follow-up on the main vulnerabilities, EIOPA is issuing the present Recommendations related to the 2018 stress test exercise.

text: 15. The Recommendations set out in this document are addressed to the relevant National Competent Authorities in the EU and EEA. The Recommendations relate to the findings of the EIOPA’s 2018 Insurance Stress Test, grouped into three different subject matters:  Supervisory convergence and financial stability issues;  Efficiency and enhancing the ST exercise process; and  Cross-sectoral coordination.

text: 16. EIOPA has followed a bottom-up approach to identify these Recommendations, making use of all the data available from the ST exercise. In a first step, the ST results were analysed at individual Group level. A subset of affected Groups in terms of exhibiting higher vulnerabilities to the scenarios tested was identified and prioritized for the follow-up. Subsequently, several discussions were held with Group supervisors, where deemed necessary.

text: 17. Therefore, the Recommendations contained in this document constitute the aggregation of the discussions and assessments of the individual ST results of the 42 insurance Groups that participated in the EIOPA’s 2018 Insurance Stress Test.

text: 18. EIOPA will undertake a coordinating role in the follow up of the Recommendations addressed to the NCAs, with the aim of enhancing future exercises and contribute to a more resilient insurance sector in Europe.

text: 19. EIOPA will engage with Members in the course of 2019 to explore what actions have been taken in light of these Recommendations.

text: Overview of recommended actions

text: 20. After analysis of the ST results, EIOPA recommends a series of actions. First, concerning in particular the affected Groups, EIOPA focuses on the need to strengthen supervision (Recommendation 1), review the capital and risk management strategies (Recommendation 2) as well as the evaluation of potential management actions to mitigate the risks identified (Recommendation 3). Next, EIOPA seeks to enhance the stress-test process in light of future exercises (Recommendation 4). Lastly, there is a general recommendation aimed at cross-sectoral coordination (Recommendation 5). Recommended actions NCA(s) concerned

text: Recommendation 1

text:  NCAs should strengthen the supervision of the Groups identified as facing

text: greater exposure to Yield Curve Up and/or Yield Curve Down scenarios. This affects, in particular, those Groups where transitional measures have a greater impact.

text: 21. In accordance with the EIOPA Regulation, the main objective of the stress test is to assess the resilience of financial institutions. Therefore, it provides a good basis to identify risks and vulnerabilities and, in particular, the potential systemic risk posed by financial institutions to adverse market developments, and evaluate the potential for systemic risk to increase in situations of stress.

text: 22. The ST exercise generates a significant amount of quantitative and qualitative information both to EIOPA and the NCAs. As a next step, the assessment of the information and identification of threats should lead to specific supervisory actions to transfer, manage or mitigate such risks and vulnerabilities. NCAs should therefore strengthen the monitoring and supervision, in particular of those Groups that were more severely affected in the ST. In principle, this should lead to concrete supervisory initiatives adopted by NCAs.

text: 23. Strengthened supervision should also be devoted to those Groups where transitional measures have a greater impact. As concluded by EIOPA, although the transitional measures contribute to mitigate the potential procyclicality effects of regulatory changes, the downside may be that insurers are capitalised at a level that is lower than needed from an economic perspective for a longer period.

text: 24. The ST report discloses the impact of the LTG and transitional measures on the Groups. The LTG measures foreseen under Solvency II were also designed to avoid, at least partly, some of the potential procyclical behaviour that might arise in such situations. NCAs should devote attention to those Groups that would have suffered the larger impact if, in particular, transitional measures had been deducted. This recommendation also applies to those cases where removing the LTG measures would result in non-compliance with the SCR.

text: Recommendation 2

text:  NCAs should carefully review and, where necessary, challenge the capital and

text: risk management strategies of the affected Groups. In particular:

text: of capital and risk management.

text: o For the affected Groups, stress test scenarios similar to YCU and YCD should

text: o Review the risk appetite framework for the affected Groups.

text: 25. The ST includes two scenarios combining market and insurance specific risks of relevance for the insurance sector. From that point of view, the ST scenarios and/or ST results could be used to assess the capital and risk management of undertakings. In particular, it could be used to better calibrate the projections of the ORSAs or to review the tolerance limits for main categories of risk, as well as to better understand how the indicators and risks should be monitored, in order to keep them aligned within risk appetite.

text: 26. NCAs should require Groups to clarify the impact of the ST in terms of capital and risk management. NCAs should discuss with Groups their capital buffer levels (i.e. the actual level of additional capital compared with the required SCR level) and risk transfer measures. The ST results showed that several Groups do not have significant buffer levels in case the ST scenarios would materialize. This is especially significant for Groups with books of life products with guarantees looking currently to de-risk and diversify their portfolios. For instance, Groups could consider measures such as adapting their product policy in order to reduce the risks inherent in their books.

text: 27. While NCAs cannot change the Group strategies, they can require Groups to provide quantitative forecasts identifying plans, constraints and challenges also considering the risk-return trade-off, as well as in case of deviations from projections, how funding can be reliably called on and timing of effects. A crucial cornerstone is the Groups’ hedging framework and how the current ST exercise may affect its revision.

text: 28. For the affected Groups, NCAs should ensure that ST scenarios similar to YCU and YCD are properly considered in the risk management framework, including the ORSAs of affected companies. Article 44 of the Solvency II Directive requires undertakings to have in place an effective risk management system comprising strategies, processes and reporting procedures necessary to identify, measure, monitor, manage and report, on a continuous basis the risks, at an individual and at an aggregated level, to which they are or could be exposed, and their interdependencies. Additionally,

text: Article 45.1

text: (a) states that the ORSA should include, among others, “the overall solvency needs taking into account the specific risk profile, approved risk tolerance limits and the business strategy of the undertaking”. For those Groups that were more impacted by either the YCU, the YCD, or both scenarios, EIOPA expects NCAs to discuss with these Groups how to enhance their risk management framework, including the ORSAs that should include scenarios of similar severity or nature.

text: 29. As a consequence of the ST results, EIOPA observed that the stresses considered internally by the affected Groups do not consider severe or combined stresses such as those specified in the ST scenarios (e.g. a Group may currently consider a low yields scenario only, then a separate longevity scenario, etc.). Hence, NCAs should encourage the affected Groups to consider both YCD- and YCU-types of scenarios in the ORSA and pre-emptive recovery plans, where applicable, taking into account a combined set of potential risk factors or stress that would reflect their specific risk profile.

text: 30. NCAs should ensure that the affected Groups align their appetite for risk- taking with their risk bearing capacities and their ability to manage those risks. In order to do so, it is crucial that they have a clear understanding with regard to the risks the Group is assuming, including the risk drivers. As shown in the ST results, either low yields plus longevity risk, or an abrupt and sizeable reversal of risk premia in global financial markets leading to a tightening of financial conditions could negatively impact the financial position of the insurance Groups.

text: 31. In that respect, NCAs should consider the calibration of risk limits or triggers for the affected Groups. For instance, the FSB states that risk limits should be understood as the allocation of the Groups’ aggregate risk appetite statement to business line, legal entity levels, specific risk categories, concentrations, and as appropriate, other levels. This also involves the need for close alignment and timely monitoring of the early warning indicators and the risk limits or triggers (for example, a traffic light approach could be considered, which clearly establishes thresholds for early warnings and risk limits to trigger actions).

text: 32. Consideration should also be given to the extent to which the reduction of future discretionary benefits can effectively be used as loss-absorbing mechanism on a goingconcern basis. This should take into account policyholders’ expectations to avoid any overestimation of such absorbing capacity. Some Groups recognize a significant amount of future discretionary benefits (FDB) as part of their liabilities, which in turn serves the Groups as a basis to recognize certain loss absorbency capacity (LAC) Technical Provisions.

text: Recommendation 3

text:  NCAs should evaluate the potential management actions to be implemented by

text: the affected Groups. In particular:

text: o NCAs should require Groups to indicate the range of actions based on the

text: results of the stress testing.

text: o NCAs should assess if the actions identified are realistic in such stress

text: scenarios.

text: o NCAs should consider any eventual second-round effects.

text: 33. The results of the ST exercise provide insights to supervisors on the assessment of risks and vulnerabilities of the Groups. Likewise, as stated in its Regulation, the buildup of a ST regime shall help EIOPA identify those financial institutions that may pose a systemic risk. These institutions shall be subject to strengthened supervision, and where necessary, even to recovery and resolution procedures.

text: 34. As a result of the strengthened supervision (see Recommendation 1) and after carefully reviewing the capital strategies as well as the risk appetite frameworks (see Recommendation 2), supervisors should consider potential remedial measures or actions to be taken by the affected Groups, in case of non-compliance with the SCR under the respective ST scenarios. The impact of the LTG and transitional measures on the Groups results should be taken into account in this analysis as well.

text: 35. NCAs should require Groups to identify the range of actions to be taken. Based on the analysis of ST results, EIOPA concludes that the NCAs should evaluate and discuss the potential management actions to be eventually implemented by the affected Groups. For instance, some Groups could consider increasing the current capital buffer/surplus (over SCR coverage) as a cushion to absorb losses in more severe scenarios. Others could consider a higher diversification of the product portfolio, seek measures to de-risk the portfolio, reduce the cost of guarantees to a level that is sustainable based on current asset return yields, or reduce dependency of the SCR calculation on the loss absorbing mechanisms.

text: 36. The Groups, in some cases, do already provide supervisors with a list of contingency actions or measures (e.g. as part of the ORSA cycle or pre-emptive Recovery Planning). However, for other Groups this may not be the case and could be discussed as part of the capital management process.

text: 37. NCAs should assess if the management actions identified are realistic in such stress scenarios. In some occasions, the Group may be overly optimistic about certain actions it intends to take in a potential crisis. From that perspective, it is vital that NCAs assess the feasibility, credibility and timeliness of the possible actions or measures in order to deal with the risks and vulnerabilities of the Groups in the relevant YCD and YCU scenarios.

text: 38. NCAs should consider any eventual second-round effects. To the extent possible, NCAs should also consider any potential second-round effects arising within their jurisdiction and stemming from the behaviour of Groups that intend to implement similar actions, simultaneously. For example, it should not be unduly assumed that capital will be entirely available to the Groups at the time it is needed, particularly in crisis times. Should several Groups suffer losses and intend to reinforce their capital buffer at the same time (e.g. large equity issues, divestment of similar run-off portfolios), such coincident actions may not yield the expected results. Subsequently, EIOPA will take a coordinating role with the involvement of the relevant NCAs to evaluate the potential second round effects at the European level.

text: 39. EIOPA acknowledges the importance of such behaviour-based related sources of systemic risk in insurance. In this case, the behaviour-based source relates to the risk of collective behaviour by insurers that may exacerbate market price movements, in this case, stemming from potential second round-effects of the simultaneous implementation of actions in crisis times.

text: Recommendation 4

text:  NCAs should further contribute to enhance the stress test process.

text: 40. EIOPA is committed to continue enhancing its ST exercises to make them more methodologically sound, efficient and useful to NCAs and stakeholders in general. Two aspects were identified concerning the 2018 Insurance ST.

text: 41. Firstly, NCAs should check the adequacy of the systems and supporting technologies and the flexibility of the risk modelling used by Groups to run stress tests scenario/sensitivity analysis, primarily to serve the purpose for their own risk assessment and regular dialogue with supervisors (e.g. ORSA) and to ensure readiness for demanding and complex EU wide exercises. A potential issue identified during the interaction with the participating Groups and in the calculation phase refers to the estimation of the group post-stress balance sheet and capital position. Participating Groups made clear that, given the severity of the prescribed shocks and the allowed timeframe, they were not able to re-assess the post-stress SCR and own funds using the standard models utilised for the regular calculation for reporting purposes (e.g. Solvency II reporting) and supervisory dialogue (e.g. ORSA). As a result, EIOPA recommends that NCAs should check: a) the adequacy and usability of the models used by Groups to run stress testing to support their regular supervisory dialogue; and b) the flexibility of the models used for calculation of the balance sheet and capital position to support their regular supervisory dialogue (e.g. narrow fitting range, specifically the capability of the models to work under severe but plausible shock assumptions).

text: 42. Secondly, NCAs should ensure availability of resources from national experts for future EIOPA ST exercises. Stress tests can be an extremely useful tool for supervisors but are also time- and resource-intensive exercises. Synchronisation of all participants involved from the industry, institutions and supervisory community is a challenging issue, which requires significant resources at the national level in terms of coordinating with the participants, validating the data, as well as contributing to the methodological framework and analysing the results. In the context of a bottom-up exercise, EIOPA leans on the expertise and support of NCAs, which should ensure sufficient staff are available, taking into account the workload and different phases of the exercise.

text: Recommendation 5

text:  NCAs should enhance cooperation and information exchange with other

text: relevant Authorities, such as the ECB/SSM or other national authorities, concerning the stress test results of the affected insurers which form part of a financial conglomerate.

text: 43. EIOPA is mandated by its Regulation to act in the field of activities of financial conglomerates, among others. Financial conglomerates can be defined as large groups which provide services and products in more than one financial sector (banking, investment or insurance). Such conglomerates may be among the biggest financial groups which provide services and are active in the national markets.

text: 44. If such conglomerates (and, in particular, credit institutions or insurance undertakings which are part of such a conglomerate) were to face financial difficulties, these could seriously destabilise the financial system and affect individual depositors, insurance policyholders and investors.

text: 45. In light of the individual results obtained from the insurance Groups participating in the 2018 insurance stress test exercise, EIOPA observed that some of the insurers that are more negatively affected are part of bank-led financial conglomerates. Some of these Groups appear to be vulnerable either to low yields and longevity risk, or to a sudden and abrupt reversal of risk premia combined with an instantaneous shock to lapse rates and claims inflation.

text: 46. The 2018 insurance ST marks an important step in the reassessment of capital requirements under adverse scenarios and provides a valuable basis for continuous dialogue between group supervisors and the participating Groups. Therefore, EIOPA recommends that the NCAs increase cooperation and information exchange with the relevant Authorities. For example, those concerned with prudential supervision on a group-wide basis of financial conglomerates and banking groups with major insurance subsidiaries, such as the ECB Single Supervisory Mechanism or other relevant national authorities.

text: 47. Furthermore, EIOPA advises the NCAs to keep EIOPA informed on the related crosssectoral discussions. The multiplicity of Authorities involved in financial conglomerates supervision portrays a complex supervisory landscape, in which EIOPA should have a growing role. This goes in line with the mandate stated in the Regulation to assess and to promote the resilience of financial institutions, in particular the systemic risk posed by financial institutions. To this aim, effective information-exchange on the related financial conglomerate issues could be achieved, in particular, by discussing the individual ST results in the financial conglomerate’s Colleges, or by activating more frequently platforms of communication between cross-sectoral EU supervisors.