text: OJ L 295, 21.11.2018, p. 39. 2 Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable to the general budget of the Union, amending Regulations

text: (EU) No 1296/2013

text: (EU) No 1301/2013

text: (EU) No 1303/2013

text: (EU) No 1304/2013

text: (EU) No 1309/2013

text: (EU) No 1316/2013

text: (EU) No 223/2014

text: (EU) No 283/2014

text: , and Decision No

text: and repealing Regulation (EU, Euratom) No 966/2012 (OJ L 193, 30.7.2018, p. 1). 3 See COM(2022) 223 final, p. 1. 4

text: See, for instance, Article 38 of the Financial Regulation. 5

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 008, 12.01.2001, p. 1). 5

text: See for example the Judgment of the Court of Justice of the European Union of 24 February 2022, SIA 'SS' v Valsts ieņēmumu dienests,

text: Case C-175/20

text: , paragraphs 54-56. See Judgment of the European Court of Justice of 21 June 2022 in

text: Case C‑817/19

text: , Ligue des droits humains v Conseil des ministres, see in particular paragraphs 183-187. 8 COM(2022) 223 final, p. 8. 9 See Art. 36(6) in connection with Art. 36(2)(d) of the Proposal. 10 See Art. 36(7) of the Proposal. 6

text: I.e. the Commission or an executive agency as referred to in

text: Article 69

text: , the Member States implementing the budget pursuant to

text: Article 62(1)

text: , first subparagraph, point (b), the Member States that receive and implement Union funds pursuant to budget implementation under

text: Article 62(1)

text: , first subparagraph, point (a), the persons or entities implementing the budget pursuant to

text: Article 62(1)

text: , first subparagraph, point (c), OLAF, the Court of Auditors, EPPO and other Union investigative and control bodies, within the exercise of their respective competences. 7

text: Similar to the hit/no hit approach taken in Art. 100(3) and 101(5) of the COUNCIL REGULATION

text: (EU) 2017/1939

text: of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’), see https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R1939&from=EN 13 See https://ec.europa.eu/social/main.jsp?catId=325&intPageId=3587&langId=en. See also EDPS Opinion of 17 February 2014 on a notification for Prior Checking received from the Data Protection Officer of the European Commission regarding the "Risk analysis for fraud prevention and detection in the management of ESF and ERDF" - ARACHNE (2013-0340), available at https://edps.europa.eu/sites/default/files/publication/14-02-17_arachne_en.pdf and in particular the recommendations included therein. 8

text: See also the EDPS Guidance on Security Measures for Personal Data Processing. 9

text: The EDPS would like to highlight that in Ligue des droits humains v Conseil des ministres (which concerned the comparatively more serious context of terrorist offences and serious crime) the Court held that the retention of data after expiry of the initial retention period of six months does not appear to be limited to what is strictly necessary in respect of those data subjects for whom no objective evidence establishing a risk could be established. See Judgment of the European Court of Justice of 21 June 2022 in

text: Case C‑817/19

text: , Ligue des droits humains v Conseil des ministres, in particular paragraphs 257-258. 16 See Judgment of the European Court of Justice of 9 November 2010 in Joint Cases

text: and

text: Volker und Markus Schecke GbR (

text: ) and Hartmut Eifert (

text: ) v Land Hessen, ECLI:EU:C:2010:662, par. 85. 17 Idem, par 53, where the CJEU considered that legal persons can claim the protection of Articles 7 and 8 of the Charter in so far as the official title of the legal person identifies one or more natural persons. 10

text: Idem, par 87. 19 See

text: Article 38

text: paragraph 2b and paragraph 6, second subparagraph of the Proposal. 20 See Judgment of the European Court of Justice of 9 November 2010 in Joint Cases

text: and

text: Volker und Markus Schecke GbR (

text: ) and Hartmut Eifert (

text: ) v Land Hessen, ECLI:EU:C:2010:662, paragraphs 77 and 81. 21 See paragraph 3 of

text: Article 38

text: . 11

identifier: EDPS yttrande 14/2022

text: 7 July 2022

text: Opinion 14/2022

text: on the Proposal for a Regulation of the European Parliament and of the Council on the financial rules applicable to the general budget of the Union (recast)

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Commission Proposal for a Regulation of the European Parliament and of the Council on the financial rules applicable to the general budget of the Union (recast). This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the draft Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 16 May 2022, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on the financial rules applicable to the general budget of the Union, amending the Financial Regulation. The EDPS notes that the Proposal aims to improve the quality and interoperability of data on recipients of Union funding and on those ultimately benefitting, directly or indirectly, from Union funding in order to effectively prevent, detect, investigate and correct frauds or remedy irregularities.

text: The EDPS fully supports the goals of the Proposal, including the increased use of digitalisation to better protect EU financial interests and to combat fraud and other irregularities. While processing of personal data may be necessary to achieve this goal, it is incumbent upon the EU legislator to ensure that any interference with the right to data protection remain limited to what is strictly necessary and proportionate to the objectives pursued.

text: The EDPS welcomes that the Proposal aims to establish the categories of data that will be processed in order to achieve the Proposal’s objectives. The EDPS understands, however, that the process of data-mining and risk-scoring will not be limited to the data explicitly identified by the Proposal and that those data would be compared with data from other sources. The EDPS considers it necessary to explicitly identify all the categories of personal data to be processed, as well as the sources of those data. Appropriate safeguards to ensure the quality and accuracy of those data should also be put in place, particularly in circumstances where those other data would be collected from third parties.

text: The EDPS observes that no additional information in the Proposal is provided as regards to the IT system itself. Therefore, he recommends clarifying the type of the IT system to be used, in particular whether the Commission plans to base the system on the already existing IT system “Arachne” or to create a completely new IT system. Regardless of the use of existing structures, the EDPS would like to remind that appropriate safeguards need to be established and introduced in the architecture of this IT system, in line with the general data protection rules applicable to the processing of personal data. This should be well reflected upon in the design and development phase of the IT system, in line with the requirement of data protection by design.

text: The EDPS also strongly recommends the co-legislator to clearly define the maximum duration for which personal data referred to may be stored and made available in the single integrated IT system for data-mining and risk-scoring provided by the Commission.

text: Regarding publication of relevant information concerning all recipients of funds financed from the EU budget, the EDPS positively notes the efforts to made to balance the principle of transparency against the interference with the right of the recipients concerned to respect for their private life in general and to the protection of their personal data by exempting recipients from publication of their personal data if certain conditions would be met (threshold in terms of the amount of aid received, nature of the measure, risks for the rights and freedoms etc.).

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 16 May 2022, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on the financial rules applicable to the general budget of the Union (recast) (‘the Proposal’), amending the Financial Regulation .

text: 2. The objective of the Proposal is to align the Financial Regulation with the 2021-2027 Multiannual Financial Framework (MFF) package, to maintain a “single rule book” governing the expenditure of the Union, meaning that all general financial rules are included in the Financial Regulation. In addition, the Proposal includes targeted improvements and simplifications which have been identified since the entry into force of the 2018 Financial Regulation. The Proposal also aims to increase the use of digitalisation to better protect EU financial interests, to better contribute to the achievement of the EU policy objectives and to achieve additional simplification for recipients of Union funds .

text: 3. The present EDPS Opinion is issued in response to a consultation by the European Commission of 16 May 2022, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 257 of the Proposal. In this regard, the EDPS also positively notes that he had been informally consulted pursuant to recital 60 EUDPR.

text: 2. General remarks

text: 4. The Financial Regulation lays down the principles and general financial rules for establishing and implementing the EU budget and controlling EU finances. This Proposal amending the Financial Regulation comes after the adoption of the MFF package, to further improve the rules to be used in the implementation of the 2021-2027 programmes and instruments, and beyond. The Proposal reflects certain derogations to the current Financial Regulation that the Union legislator decided during the MFF negotiations.

text: 5. The EDPS acknowledges the objectives pursued by this Proposal, namely targeted amendments to maintain a single rulebook governing the expenditure of the Union and appreciates that he has been consulted on this Proposal. Nevertheless, he would like to point out and regret that he had not been consulted during the legislative procedure on the Financial Regulation itself, prior to this Proposal for a recast of the same Regulation, given that the Financial Regulation itself already introduced provisions having an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data .

text: 6. Although the current Proposal introduces a number of changes to the provisions of the Financial Regulation, the focus of this Opinion is on two provisions, most relevant from the data protection point of view. In that regard, the EDPS notes that Article 36 of the Proposal introduces an obligation, for the different bodies implementing the EU budget, to record data on the recipients of EU funding (including their beneficial owners) and to use a single integrated IT system for data-mining and risk-scoring to analyse those data with a view of combatting fraud, corruption, conflicts of interest, double funding and other irregularities. In addition, the EDPS takes note of Article 38 of the Proposal aiming to ensure transparency of the use of the Union budget, by publication of relevant information concerning all recipients of funds financed from the EU budget. Finally, as a matter of keeping legal references in the Financial Regulation up to date with current legislative developments, the EDPS appreciates that references to the repealed

text: Regulation (EC) No 45/2001

text: are now to be replaced with references to EUDPR.

text: 7. The EDPS supports the goals of the Proposal, including the increased use of digitalisation to better protect EU financial interests and to combat fraud and other irregularities. While processing of personal data may be necessary to achieve this goal, it is incumbent upon the EU legislator to ensure that any interference with the right to data protection remain limited to what is strictly necessary and proportionate to the objectives pursued. In accordance with the established case law of the Court of Justice of the European Union (“CJEU”), any limitation on fundamental rights, including the right to the protection of personal data, implies that the legal basis which permits interference with those rights must itself define the scope of the limitation of the exercise of the right concerned. A measure enabling such interference must provide for clear and precise rules on the scope and application of the measure in question and establish minimum requirements to ensure that the persons whose personal data have been transmitted have sufficient guarantees to effectively protect their data against risks of misuse . In order to ensure that an interference is limited to what is strictly necessary, the legal basis in question should also clearly identify and circumscribe the personal data that may be processed and should indicate in a sufficiently clear and precise manner the databases concerned (at least in such a manner that would make such databases identifiable) .

text: 3. Compulsory integrated IT system for data-mining and riskscoring

text: 3.1. Purposes of the processing

text: 8. The Proposal aims to improve the quality and interoperability of data on recipients of Union funding and on those ultimately benefitting, directly or indirectly, from Union funding in order to effectively prevent, detect, investigate and correct frauds or remedy irregularities . In that regard, the proposed amendments to Article 36 of the Financial Regulation provide for standardised electronic recording and storing of data on the recipients of Union funds and their beneficial owners, for the purposes of prevention, detection, correction and follow-up of fraud, corruption, conflicts of interest, double funding and other irregularities .

text: 9. The Proposal would also establish an obligation to use a single integrated IT system for data-mining and risk-scoring provided by the Commission. The system would access and analyse data on the recipients of Union funds to facilitate risk assessment for the purposes of selection, award, financial management, monitoring, investigation, control and audit and contribute to effective prevention, detection, correction and follow-up of fraud, corruption, conflicts of interest, double funding and other irregularities .

text: 3.2. Roles and responsibilities

text: 10. The EDPS welcomes that Article 36(7) of the Proposal provides for a clear identification of the recipients of the data and entities who may make use of the IT system for data-mining and risk-scoring , as well as the designation of the Commission as a controller for the IT system.

text: 11. The EDPS notes, that in line with

text: Article 36(7)

text: , there are entities other than Commission that will be using and accessing the data within the exercise of their respective competences. Insofar as these entities would process personal data in accordance with their own tasks and obligations, the EDPS considers that these entities would likely (also) be acting as controllers. The EDPS therefore invites the co-legislator to further clarify in the Proposal the roles of the entities that would be using and accessing any personal data processed by the single integrated IT system for data-mining and risk-scoring.

text: 3.3. Categories of personal data

text: 12. Article 36(6) of the Proposal specifies certain categories of data to be recorded and stored electronically in an open, interoperable and machine-readable format and regularly made available in the single integrated IT system for data-mining and risk-scoring provided by the Commission. Specifically, the following categories of data shall be recorded, stored and made available: (a) the recipient’s full legal name in the case of legal persons, the first and last name in the case of natural persons, their VAT identification number or tax identification number where available or another unique identifier at country level and the amount of funding. If a natural person, also the date of birth; (b) the first name(s), last name(s), date of birth, and VAT identification number(s) or tax identification number(s) where available or another unique identifier at country level of beneficial owner(s) of the recipients, where the recipients are not natural persons.

text: 13. The EDPS welcomes that the Proposal aims to establish the categories of data that will be processed in order to achieve the Proposal’s objectives. The EDPS understands, however, that the process of data-mining and risk-scoring will not be limited to the data explicitly identified by the Proposal in

text: Article 36(6)

text: and that those data would be compared with data from other sources. The EDPS considers it necessary to explicitly identify all the categories of personal data to be processed, i.e. which data will be brought into connection with the identification data mentioned in Article 36(6) of the Proposal, as well as a clear indication of the sources of those data. Appropriate safeguards to ensure the quality and accuracy of those data should also be put in place, particularly in circumstances where those other data would be collected from third parties.

text: 14. A clear specification of the categories of personal data and the databases with which those personal data may be combined (or compared) is necessary in order to establish that the processing of personal data in the context of the integrated IT system for data-mining and risk-scoring is limited to what is strictly necessary.

text: 15. Finally, the EDPS would like to point out that the storage and processing of a variety of data categories in a single integrated IT system creates risks. To minimise these risks, due consideration must be given to the requirements of data minimisation, data protection by design, as well as security. The EPDS regrets that the impact assessment accompanying the Proposal does not contain sufficient elements that would demonstrate the necessity of the envisaged approach. In particular, the current reference to an open, interoperable and machine-readable format of data, which are to be made available in the single integrated IT system for data-mining and risk-scoring, does not allow for the EDPS to conclude whether, for the purpose of risk-scoring, a hit / no hit scenario would be a suitable one, less restrictive alternative to the creation of a separate single integrated IT system.

text: 3.4. The nature of the IT system and the security aspects

text: 16. The EDPS would like to point out that the newly added paragraph 7 of Article 36 of the Proposal, stipulates that the Commission shall be responsible for the development, management and supervision of this IT system. However, no additional information as regards to the IT system itself is provided. Therefore, the EDPS recommends clarifying the type of the IT system to be used, in particular whether the Commission plans to base the system on the already existing IT system “Arachne” or to create a completely new IT system. The EDPS would like to remind in this context that the controller in any event needs to review continuously the risks assessment as defined in Article 33(1) of the EUDPR, when changes are made either on the system itself or there were other developments affecting security. The requirement of data protection by design and by default should be taken into consideration both during the design of the system and when there are significant changes of the system.

text: 17. Moreover, the same paragraph 7 of Article 36 of the Proposal states that the Commission should be responsible, among other, for “ensuring the security, integrity and confidentiality of data, the authentication of the users and for protecting the IT system against mismanagement and misuse”. While the EDPS welcomes the confirmation of responsibilities for information security, the EDPS recalls that the IT system must in any event take into account the obligation to security of personal data perspective under the EUDPR, as appropriate, and in particular to ensure compliance with its

text: Article 33

text: 18. In addition, regardless of the use of existing structures, the EDPS would like to remind that appropriate safeguards need to be established and introduced in the architecture of this IT system, in line with the general data protection rules applicable to the processing of personal data. This should be well reflected upon in the design and development phase of the IT system, in line with the principle of data protection by design. The current reference to an open, interoperable and machine-readable format of data, which are to be made available in the single integrated IT system for data-mining and risk-scoring, does not allow for the EDPS to conclude on the nature of the structure of the IT system or the fact that the principle of data protection by design has so far been applied in its design and development phase. In particular these concerns regard, but are not limited to, the fact that the Proposal does not define why the system is “interoperable”, with what it would be “interoperable”, under which circumstances, which actors would be involved and why it should allow for interoperability in the first place. In a similar manner, the Proposal does not clarify the “open” nature of the IT system by stating who should access it and for which purpose.

text: 19. The EDPS therefore recommends, regardless of whether the Commission intends to make use of existing structures, to include in the Proposal itself a high level description of the tool, including data protection roles and responsibilities and relevant applicable safeguards. The EDPS also recommends further clarifying the types of processing and logic involved in the “data-mining and risk-scoring” envisaged by the Proposal.

text: 20. The EDPS also notes that, in line with Article 38 of the Proposal, certain the data to be processed within the IT system is to be published on a website. However, some of the data, such as the VAT of a natural person, would not be made public. Provided that processing such categories of data is in fact necessary and proportionate, the EDPS suggests applying additional safeguards for those non-published types of data. For instance, pseudonymisation of data should be considered and encouraged.

text: 21. Finally, the EDPS notes that the Proposal adds a new paragraph 2(d) to Article 36 of the Financial Regulation, which provides that prevention, detection, correction and follow-up of fraud, corruption, conflicts of interest, double funding and other irregularities would be achieved “through the electronic recording and storage of data on the recipients of Union funds including their beneficial owners, as defined in

text: Article 3

text: , point 6 of

text: Directive (EU) 2015/849

text: , and through the use of a single integrated IT system for data-mining and risk-scoring provided by the Commission to access and analyse those data”. The EDPS would like to point out that it is not clear from the Proposal whether this electronic recording and storage of data would be done within the IT system for data-mining and risk-scoring or the IT system would just have access to data stored somewhere else and suggests to clarify this ambiguity.

text: 3.5. Storage duration

text: 22. According to the storage limitation principle, personal data should be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. The period of time should be as short as possible in relation to the purpose pursued and must be justified so as to ensure that the storage is limited to what is strictly necessary for the purposes pursued. The EDPS strongly recommends the co-legislator to clearly define the maximum duration for which the data referred to in Article 36 of the Proposal may be stored and made available in the single integrated IT system for data-mining and risk-scoring provided by the Commission .

text: 4. Publication of data on natural persons

text: 23. The EDPS takes note of Article 38 of the Proposal aiming to ensure transparency of the use of the Union budget, by publication of relevant information concerning all recipients of funds financed from the EU budget. He would however, like to recall that the CJEU rejected the argument that the disclosure of personal data to the public serves such a significant goal that the objective of transparency would automatically prevail over the right to protection of personal data .

text: 24. Moreover,

text: Article 3(1)

text: EUDPR defines personal data as ‘any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person’. Even the data concerning legal persons may therefore, in some cases be considered as personal data, as clarified by the CJEU . In these cases, the determining factor is whether the information ‘relates to’ an ‘identifiable’ natural person. Consequently, personal data would normally be processed in all cases where the information concerning the recipients of funds pertains to an identified or identifiable individual. The EDPS would also like to recall that the Court has additionally confirmed that the seriousness of the breach of the right to protection of personal data manifests itself in different ways for, on the one hand, legal persons and, on the other, natural persons . In that regard, the EDPS positively notes that the Proposal indeed differentiates the categories of data to be published depending on whether it would be a natural or a legal person .

text: 25. The EDPS furthermore positively notes the fact that the Commission has taken into consideration alternative methods of publishing information on the recipients of funds that would be consistent with the principle of transparency while causing less interference to the recipients' rights to privacy and personal data protection . In that respect, the EDPS appreciates that Article 38 of the Proposal undertakes to balance the principle of transparency against the interference with the right of the recipients concerned to respect for their private life in general and to the protection of their personal data by exempting recipients from publication of their personal data if certain conditions would be met (threshold in terms of the amount of aid received, nature of the measure, risks for the rights and freedoms etc.) .

text: 5. Conclusions

text: 26. In light of the above, the EDPS makes the following recommendations: (1) to clarify the role of all entities that would be using and accessing any personal data processed by the single integrated IT system for data-mining and risk-scoring. (2) to clarify the type of the IT system to be used, in particular whether the Commission plans to base the system on the already existing IT system “Arachne” or to create a completely new IT system. (3) to explicitly identify all the categories of data concerned, i.e. which data will be processed/brought into connection with the identification data mentioned in

text: Article 36

text: paragraph 6 of the Proposal, as well as the sources of those data. (4) introduce appropriate safeguards to ensure the quality and accuracy of data, particularly in case those other data would be collected from third parties. (5) regardless of whether the Commission intends to make use of existing structures, to include in the Proposal itself a high level description of the IT tool, including data protection roles and responsibilities and relevant applicable safeguards. (6) to apply additional safeguards for the non-published types of data. For instance, pseudonymisation of data should be considered. (7) to clarify whether electronic recording and storage of data would be done within the IT system for data-mining and risk-scoring or the IT system would only have access to data stored elsewhere. (8) to clearly define the maximum duration for which the data referred to in Article 36 of the Proposal may be stored and made available in the single integrated IT system for data-mining and risk-scoring provided by the Commission. Brussels, 7 July 2022 [e-signed] Wojciech Rafał Wiewiórowski 12


text: COM(2023) 132 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 132 final. 4 See page 2 of the Explanatory Memorandum to the Proposal. 5 European Union Serious and Organised Crime Threat Assessment: A corrupt Influence: The infiltration and undermining of Europe’s economy and society by organised crime, page 12.

text: Europol and the global cocaine trade, available at https://www.emcdda.europa.eu/publications/eu-drug-markets/cocaine/europeand-global-cocaine-trade_en. Europol and the global cocaine trade, available at https://www.emcdda.europa.eu/publications/eu-drug-markets/cocaine/europeand-global-cocaine-trade_en. 8 EU Drug Market: Cocaine, p. 47, available at EU Drug Market: Cocaine | www.emcdda.europa.eu 9 EU Drug Market: Cocaine, p. 24, available at EU Drug Market: Cocaine. | www.emcdda.europa.eu 10 Europol Programming Document 2022-2024, p. 150. 11 EU Drug Market: Cocaine, available at EU Drug Market: Cocaine, www.emcdda.europa.eu . 12 https://www.europol.europa.eu/partners-agreements/strategic-agreements 13

text: Regulation (EU) 2016/794

text: of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA, OJ L 135, 24.5.2016, p. 53. 14 See EDPS Opinion 2/2018 on eight negotiating mandates to conclude international agreements allowing the exchange of data between Europol and third countries, adopted on 14 March 2018, https://edps.europa.eu/sites/edp/files/publication/18-03- 19_opinion_international_agreements_europol_en.pdf and EDPS Opinion 1/2020 on the negotiating mandate to conclude an international agreement on the exchange of personal data between Europol and New Zealand law enforcement authorities, issued on 31 January 2020 https://edps.europa.eu/sites/default/files/publication/20-01-31_opinion_recommendation_europol_en.docx.pdf 6

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89. 16 See Judgment of the Court of Justice of 30 April 1974,

text: Case C-181/73

text: , R. & V. Haegeman a.o., ECLI:EU:C:1974:41, par. 5. 17 See Judgment of the Court of Justice of 3 June 2008,

text: Case C-308/06

text: , Intertanko a.o., ECLI:EU:C:2008:312, par. 42. 18 See Judgment of the Court of Justice of 3 September 2008, joined cases

text: P and

text: P, Kadi a.o., ECLI:EU:C:2008:461, par. 285.

text: For further details see the EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data. 20 See Judgment of the Court of Justice of 8 April 2014, joined cases

text: and

text: , Digital Rights Ireland Ltd, ECLI:EU:C:2014:238, paragraph 52..

text: Regulation (EU) 2022/991

text: of the European Parliament and of the Council of 8 June 2022 amending

text: Regulation (EU) 2016/794

text: , as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role in research and innovation, OJ L 169, 27.6.2022, p. 1. 22 See

text: Articles 18

text: a(6) and 23(9) of the Europol Regulation. 8

text: See Opinion 1/15 of the Court of Justice of 26 July 2017, EU-Canada PNR Agreement, ECLI:EU:C:2017:592, paragraph 141. 24 Idem. 25

text: Article 5(1)

text: (f) GDPR and

text: Article 4(1)

text: (f) LED and EUDPR. 26 See Judgment of the Court of Justice of 8 April 2014, in joined cases

text: and

text: , Digital Rights Ireland Ltd, ECLI:EU:C:2014:238, paragraph 40. 10

text: Smaranda Bara a.o. See Judgment of the Court of Justice of 1 October 2015,

text: Case C-201/14

text: , , ECLI:EU:C:2015:638, in particular para. 32 and 33 where the Court found that “the requirement to inform the data subjects about the processing of their personal data is all the more important since it affects the exercise by the data subjects of their right of access to, and right to rectify, the data being processed, and their right to object to the processing of those data” and that “That information concerns the identity of the data controller, the purposes of the processing and any further information necessary to guarantee fair processing of the data”.

text: See more at https://www.gov.br/anpd/pt-br 12

identifier: EDPS yttrande 14/2023

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 14/2023 on the negotiating mandate to conclude an international agreement on the exchange of personal data between Europol and Brazilian law enforcement authorities

serie: yttranden

text: 3 May 2023

type: rubrik

text: Opinion 14/2023

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Recommendation for a Council decision authorising the opening of negotiations for an agreement between the European Union and the Federative Republic of Brazil on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Brazilian authorities competent for fighting serious crime and terrorism . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Recommendation that are relevant from a data protection perspective.

text: Executive Summary

text: On 22 February 2023 the European Commission issued a Recommendation for a Council decision authorising the opening of negotiations for an agreement between the European Union and the Federative Republic of Brazil on the exchange of personal data between Europol and the Brazilian authorities competent for fighting serious crime and terrorism.

text: The objective of the Recommendation is to open negotiations with Brazil with the purpose of signing and concluding an international agreement enabling the exchange of personal data between Europol and the Brazilian authorities competent for fighting serious crime and terrorism. The Annex to the Recommendation lays down the Council’s negotiating directives to the Commission, i.e. the objectives the latter should aim to achieve on behalf of the EU in the course of these negotiations.

text: Transfers of personal data gathered in the context of criminal investigations and further processed by Europol to produce criminal intelligence are liable to have a significant impact on the lives of the individuals concerned. For that reason, the international agreement must ensure that the limitations to the rights to privacy and data protection in relation to the fight against serious crime and terrorism apply only in so far as is strictly necessary.

text: The EDPS positively notes that the Commission has established by now, based also on a number of the recommendations from the previous EDPS Opinions on this matter, a well-structured set of objectives (negotiating directives), incorporating fundamental data protection principles, which the Commission aims to achieve on behalf of the EU in the course of international negotiations to conclude agreements on the exchange of personal data between Europol and third country law enforcement authorities.

text: In this regard, the recommendations in this Opinion are aimed at clarifying and, where necessary, further developing the safeguards and controls in the future Agreement between the EU and Brazil with respect to the protection of personal data. In this context, the EDPS recommends that the future Agreement explicitly lays down the list of the criminal offences regarding which personal data could be exchanged; provides for a periodic review of the need for storage of the transferred personal data as well as other appropriate measures ensuring that the time limits are observed; adduces additional safeguards as regards the transfer of special categories of data; ensures that no automated decision based on the received data under the Agreement would take place without the possibility for a human being to intervene in an effective and meaningful way; lays down clear and detailed rules regarding the information that should be made available to the data subjects.

text: The EDPS recalls that, pursuant to Article 8(3) of the Charter, the control by an independent authority is an essential element of the right to the protection of personal data. In this context, the EDPS positively notes the recent establishment in Brazil of an independent data protection authority, the Brazilian Data Protection Supervisory Authority (Autoridade Nacional de Proteção de Dados – ANPD). In addition, in order to ensure proper implementation of the Agreement, the EDPS also suggests that the Parties exchange on a regular basis information on the exercise of

text: rights by data subjects as well as relevant information about the use of the oversight and redress mechanisms related to the application of the Agreement. 3

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 9 March 2023 the European Commission issued a Recommendation for a Council decision authorising the opening of negotiations for an agreement between the European Union and the Federative Republic of Brazil on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Brazilian authorities competent for fighting serious crime and terrorism (‘the Recommendation’). The Recommendation is accompanied by its respective Annex.

text: 2. The objective of the Recommendation is to open negotiations with the Federative Republic of Brazil (hereinafter ‘Brazil’) with the purpose of signing and concluding an international agreement enabling the exchange of personal data between Europol and the Brazilian law enforcement authorities competent for fighting serious crime and terrorism. The Annex to the Recommendation lays down the Council’s negotiating directives to the Commission, i.e. the objectives the latter should aim to achieve on behalf of the EU in the course of these negotiations.

text: 3. In the Explanatory Memorandum of the Recommendation the Commission assesses that Latin America’s organised crime groups pose a serious threat to the EU internal security as their actions are increasingly linked to a series of crimes within the Union, particularly in the realm of drug trafficking . The 2021 EU Serious and Organised Crime Threat Assessment (‘SOCTA’) by Europol highlights that unprecedented quantities of illicit drugs are trafficked from Latin America to the EU, generating multi-billion-euro profits, which are used to finance a diverse range of criminal organisations (international and EU-based) and to weaken the rule of law in the EU . Organised crime organisations based in Latin America are also active in other crime areas that fall within Europol’s mandate, such as cybercrime, money laundering, and environmental crimes. 5

text: 4. Most of the drugs seized in the EU are transported by sea, primarily in maritime shipping containers , and shipped to the EU directly from the countries of production as well as from neighbouring countries of departure in Latin America, including Brazil . Brazilian organised crime organisations have become partners of Colombian criminal networks and also purchase cocaine produced in Bolivia and Peru. In addition to their trafficking activities, these networks are service providers for globally operating criminal networks that use Brazilian ports to traffic cocaine . Based on quantities of cocaine seized in European ports and in ports elsewhere destined for Europe, Brazil, with a cocaine seizure of about 71 tonnes, was one of the main departure points in 2020, as it has been for some years .

text: 5. In its Programming Document 2022-2024, Europol has flagged that, among others, the growing demand for drugs and increased drug trafficking routes into the EU justify the need for enhanced cooperation with Latin American countries . In the same vein, Brazil has been identified as a key international partner to reduce the global supply of cocaine by the European Monitoring Centre for Drugs and Drug Addiction (EMCDDA) . Currently, the cooperation between Europol and Brazil is based on an Agreement on Strategic Cooperation signed in April 2017 , which does not provide a valid legal basis under Union law for exchange of personal data.

text: 6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 9 March 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes that he has been consulted on the Recommendation and expects a reference to this Opinion to be included in the preamble of the Council Decision. In addition, the EDPS welcomes the reference, in Recital 4 of the Recommendation, to Recital 35 of the

text: Regulation (EU) 2016/794

text: (‘Europol Regulation’), which provides that the Commission should be able to consult the EDPS also during the negotiations of the Agreement and, in any event, before the Agreement is concluded.

text: 7. The EDPS recalls that he has already had the opportunity to comment in 2018 and in 2020 on the exchange of personal data between Europol and the law enforcement authorities of third countries on the basis of Europol Regulation .

text: 8. The EDPS positively notes that the Commission has established by now, based also on a number of the recommendations from the previous EDPS Opinions on this matter, a wellstructured set of objectives (negotiating directives), incorporating fundamental data protection principles, which the Commission aims to achieve on behalf of the EU in the course of international negotiations to conclude agreements on the exchange of personal data between Europol and third country law enforcement authorities.

text: 9. In this context, the recommendations in this Opinion are aimed at clarifying and, where necessary, further developing the safeguards and controls in the future Agreement between the EU and Brazil with respect to the protection of personal data. They are without prejudice to any additional recommendations that the EDPS could make on the basis of further available information and the provisions of the draft agreement during the negotiations.

text: 2. General remarks

text: 10. The Europol Regulation lays down specific rules regarding transfers of data by Europol outside of the EU.

text: Article 25(1)

text: thereof lists a number of legal grounds based on which Europol could lawfully transfer data to authorities of third countries. One possibility would be an adequacy decision of the Commission in accordance with

text: Article 36 of Directive (EU) 2016/680

text: (‘LED’) finding that the third country to which Europol transfers data ensures an adequate level of protection. Since there is no such adequacy decision for Brazil at the moment, the other alternative for Europol to regularly transfer data would be the conclusion of a binding international agreement between the EU and Brazil, adducing adequate safeguards with respect to the protection of privacy and other fundamental rights and freedoms of individuals.

text: 11. Pursuant to

text: Article 216(2)

text: TFEU, international agreements concluded by the European Union ‛are binding upon the institutions of the Union and on the Member States’. Moreover, according to the settled case law of the Court of Justice of the European Union (‛CJEU’), international agreements become from their coming into force ‛an integral part of 16 17 Community law’ , and they have primacy over acts of secondary Union legislation .

text: 12. Since the proposed Agreement would be a binding international instrument, the EDPS notes that, in line with the case law of the CJEU, the ‛obligations imposed by an international agreement cannot have the effect of prejudicing the constitutional principles of the EC Treaty, which include the principle that all Community acts must respect fundamental rights, that respect constituting a condition of their lawfulness’ . It is therefore essential to ensure that the obligations stemming from the Agreement would not prejudice these principles as far as data protection is concerned.

text: 13. Transfers of personal data gathered in the context of criminal investigations and further processing by Europol to produce criminal intelligence envisaged under the future Agreement are liable to have a significant impact on the lives of the individuals concerned, 7 as they may potentially be used as incriminating evidence in prosecution cases in the receiving country under its national law.

text: 14. As transfers of personal data to third countries constitute an interference with individuals’ right to data protection guaranteed by Article 8 of the Charter, requirements of necessity and proportionality of the envisaged processing need to be assessed in accordance with Article 52(1) of the Charter . As a result, the international agreement must ensure that the limitations to the right to data protection in relation to the fight against serious crime and terrorism apply only in so far as is strictly necessary .

text: 15. Following the amendments of Europol Regulation in 2022 , Chapter IX of EUDPR applies to the processing of operational personal data by Europol. According to Recital 10 of EUDPR, the rules for the protection of operational personal data processed by Union bodies, offices or agencies, when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part Three TFEU, such as Europol, should be consistent with the LED. In this regard, Article 35(3) of the LED lays down the general principle that the level of protection of natural persons applicable in the EU must not be undermined by the transfer of their personal data to third countries or international organisations.

text: 16. The EDPS furthermore considers that the proposed Agreement should also take into account the potential risks in case of transfer of personal data from a third country to Europol. The Europol Regulation explicitly prohibits processing by Europol of “any information which has clearly been obtained in obvious violation of human rights” . This safeguard is even more valid in the context of the extended powers of Europol pursuant to

text: Article 18

text: a(6) of the amended Europol Regulation to process personal data that do not relate to the categories of data subjects listed in Annex II of the same Regulation, provided by a third country on the basis of an international agreement like the envisaged one, or pursuant to

text: Article 4(1)

text: (t) thereof, which mandates Europol to propose to Member States to enter information alerts in the Schengen Information System based on data provided by third countries on persons involved in terrorism or serious crime. Therefore, the EDPS recommends the future Agreement to exclude explicitly transfers of personal data obtained in a manifest violation of human rights.

text: 3. Purpose limitation and data minimisation

text: 17. Purpose limitation is among the key principles of the EU data protection framework. It requires, on the one hand, that personal data are collected for specified, explicit and legitimate purposes and, on the other hand, that personal data are not further processed in a manner that is incompatible with those purposes. Article 18 of the Europol Regulation lays down an exhaustive list of purposes for data processing activities by Europol that are considered legitimate.

text: 18. In that regard, the EDPS notes that directive 2 of the Annex limits the exchange of data under the future Agreement only to crimes and related criminal offences falling within Europol's competence in accordance with Article 3 of Europol Regulation, in particular, preventing and combating terrorism, disrupting organised crime and fighting drug trafficking and cybercrime. It also envisages that the Agreement should specify its scope and the purposes for which Europol may transfer personal data to the competent authorities of Brazil. Furthermore, directive 3(b) of the Annex underlines the principle of specificity, according to which the data should not be processed for other purposes than for the purposes of the transfer. In addition, directive 3(c) aims to ensure that personal data would be adequate, relevant and limited to what is necessary in relation to that purpose. The EDPS considers that all these requirements also apply to any sharing or onward transfer, in accordance with directives 3(i) and (j).

text: 19. In addition, the EDPS welcomes that the Agreement will oblige competent authorities of Brazil to respect any restrictions Europol may impose on access or use of transferred personal data and specify how compliance with these restrictions will be enforced in practice.

text: 20. Given the strong emphasis placed on purpose limitation in the Europol Regulation and for additional legal certainty, the EDPS recommends that the future Agreement explicitly lays down the list of the criminal offences regarding which personal data could be exchanged. Moreover, the transferred personal data must be related to individual cases.

text: 4. Storage limitation

text: 21. The EDPS notes that directive 3(c) of the Annex provides that personal data “will not be retained for longer than is necessary for the purposes for which they have been transferred”. Directive 3(f) further requires that the agreements should lay down rules on storage, review, correction and deletion of personal data. In that regard, the EDPS would like to point out that the Europol Regulation contains an elaborate regime for data storage with technical and procedural safeguards, which ensures that storage and erasure obligations are complied with in practice.

text: 22. In particular,

text: Article 31

text: thereof requires Europol to conduct reviews of the necessity and proportionality of storing the data every three years. This is without prejudice to different retention periods communicated by data providers when sending the data to Europol, which are binding for Europol. Any decision to store the data after the first three years must be duly justified and the motivation must be recorded. Europol is also bound to erase the data that have been erased in the systems of the data provider as soon as it is informed thereof. The EDPS considers these rules as fully applicable also for data received by Europol in the context of international cooperation.

text: 23. The EDPS recommends that the future Agreement provides for a periodic review of the need for storage of the transferred personal data as well as other appropriate measures ensuring that the time limits are observed. 9

text: 5. Special categories of personal data and different categories of data subjects

text: 24. According to the CJEU case law, the need for safeguards applies particularly where the protection of the particular category of personal data that is sensitive data is at stake .

text: 25. In this regard, the EDPS welcomes directive 3(d) aiming to align the special categories of data and their processing with Article 30 of the Europol Regulation, as well as to ensure specific safeguards relating to the transfer of personal data on minors, victims of criminal offence, witnesses or other persons who can provide information concerning criminal offences. However, given the sensitivity of special categories of personal data, the EDPS suggests that the future Agreement adduces the safeguards provided in Article 30 of the Europol Regulation, such as the prohibition of the selection of a particular group of persons solely on the basis of such personal data.

text: 6. Automated decisions

text: 26. The EDPS welcomes directive 3(f) aiming to provide for safeguards in respect to automated processing of personal data. According to the case law of the CJEU, ‛the need for [...] safeguards is all the greater where personal data is subject to automated processing. Those considerations apply particularly where the protection of the particular category of personal data that is sensitive data is at stake’ .

text: 27. In that regard, the EDPS recalls that in line with Article 77 (1) of the EUDPR and Article 11(1) of the LED, such safeguards should include at least the right to obtain human intervention. This would ensure that no automated decision based on the received data under the Agreement would take place without the possibility for a human being to intervene in an effective and meaningful way. This is especially important in the area of law enforcement, where the consequences of profiling on individuals are potentially even more severe. Therefore, the EDPS recommends including specifically this safeguard in the future Agreement.

text: 7. Data security

text: 28. The EDPS wishes to stress that ensuring the security of personal data is not only a clear requirement under EU law , but it is also considered by the CJEU as essential requirement in relation to the fundamental right to data protection . Data security is also essential for ensuring the confidentiality of criminal investigations.

text: 29. The EDPS therefore welcomes directive 3(h) of the Annex, the obligation to ensure security of personal data through appropriate technical and organisational measures, including by allowing only authorised persons to have access to personal data as well as an obligation of notification in the event of a personal data breach affecting data transferred under the Agreement. The EDPS considers it essential that security measures should cover data processed in the place of destination, as well as in transit.

text: 8. Right to information

text: 30. The EDPS welcomes the fact that directive 3(e) of the Annex requires that the future international agreement ensures “enforceable rights of individuals whose personal data are processed by laying down rules on the right of access, rectification and erasure, including the specific grounds which may allow any necessary and proportionate restrictions”. Furthermore, directive 3(f) provides for that the Agreement should lay down rules, inter alia, “on information to be made available to individuals”.

text: 31. The EDPS recalls that data subjects usually have no knowledge of the fact that their data are processed and transferred for law enforcement purposes. At the same time, the right to information is of utmost importance as it allows the exercise of the other data protection rights, including the right to remedies, and ensures fair processing of the data .

text: 32. The EDPS recommends that the future Agreement lays down clear and detailed rules regarding the information that should be made available to the data subjects, in line with

text: Article 79

text: EUDPR. Such rules should also include information about the applicable regime for EU data subjects to exercise their rights of access, rectification and erasure in Brazil. In the same vein, the future Agreement should also lay down mechanisms to facilitate the exercise of such rights in practice, e.g. consultations between the competent law enforcement authorities and Europol.

text: 9. Supervision

text: 33. Pursuant to Article 8(3) of the Charter, the control by an independent authority is an essential element of the right to the protection of personal data. Therefore, the EDPS welcomes directive 3(k) of the Annex, according to which the Agreement should ensure “a system of oversight by one or more independent public authorities responsible for data protection with effective powers of investigation and intervention to exercise oversight over those public authorities of Brazil that use personal data/exchanged information”. 11

text: 34. In this context, the EDPS positively notes the recent establishment in Brazil of an independent data protection authority, the Brazilian Data Protection Supervisory Authority (Autoridade Nacional de Proteção de Dados – ANPD) .

text: 10. Review of the Agreement

text: 35. The EDPS welcomes Article 5 of the Annex providing that the Agreement will include provisions on the monitoring and periodic evaluation of the Agreement.

text: 36. For the purposes of this review, the EDPS suggests that the Parties exchange on a regular basis information on the exercise of rights by data subjects, including statistics on the number of requests and their outcome, notably the number of cases where the right was restricted. In addition, the Parties could agree to exchange relevant information about the use of the oversight and redress mechanisms related to the application of the Agreement, including the decisions taken on that account.

text: 11. Conclusions

text: 37. In light of the above, the EDPS recommends: (1) that the future Agreement excludes explicitly transfers of personal data obtained in a manifest violation of human rights, (2) that the future Agreement explicitly lay down the list of the criminal offences regarding which personal data could be exchanged and that the transferred personal data must be related to individual cases, (3) that the future Agreement provide for a periodic review of the need for storage of the transferred personal data as well as other appropriate measures ensuring that the time limits are observed, (4) to ensure the future Agreement adduce the safeguards provided for in Article 30 of the Europol Regulation, (5) to ensure that security measures cover data processed in the place of destination, as well as in transit, (6) to ensure that no automated decision based on the received data under the Agreement would take place without the possibility for a human being to intervene in an effective and meaningful way, (7) that the future Agreement lays down clear and detailed rules regarding the information that should be made available to the data subjects, (8) for the purposes of this review of the Agreement, that the Parties exchange on a regular basis information on the exercise of rights by data subjects and relevant information about the use of the oversight and redress mechanisms related to the application of the Agreement. Brussels, 3 May 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 13

type: vagledning

utgivare: edps


text: COM(2024) 33 final 1

text: OJ L 295, 21.11.2018, p. 39. COM(2024) 33 final. Directive

text: of the European Parliament and of the Council of 7 September 2005 on harmonised river information services (RIS) on inland waterways in the Community, OJ L 255, 30.9.2005, p. 152–159. COM(2024) 33 final, p. 3. 4

text: COM(2024) 33 final, p. 3. COM(2024) 33 final, p. 2. The EDPS observes that there appears to be general uncertainty as regard the purpose for which personal may be exchanged (and to what extent) and to what extent. See also SWD(2024) 15 final, p. 7-8 and p. 21 (“This example indicates that both Member States and stakeholders seem to be unaware how far and for which purposes personal data is or could be lawfully exchanged via RIS”.) SWD(2024) 15 final, p. 7-8.

text: Article 4(1)

text: GDPR. Judgment of the Court of Justice of 19 October 2016, Breyer,

text: , EU:C:2016:779, paragraphs 42 and 43. Judgment of the Court of Justice of 9 November 2023, Gesamtverband Autoteile-Handel eV v Scania CV AB,

text: , ECLI:EU:C:2023:837, paragraphs 46 to 49. In line with the Court “a datum such as the VIN – which is defined by Article 2(2) of Regulation No 19/2011 as an alphanumeric code assigned to the vehicle by its manufacturer in order to ensure that the vehicle is properly identified and which, as such, is not ‘personal’ – becomes personal as regards someone who reasonably has means enabling that datum to be associated with a specific person”. 5

text: See: Judgment of the Court of Justice of 9 November 2023, Gesamtverband Autoteile-Handel eV v Scania CV AB,

text: , ECLI:EU:C:2023:837, paragraphs 49. The Court clarifies that “(...) where independent operators may reasonably have at their disposal the means enabling them to link a VIN to an identified or identifiable natural person, which it is for the referring court to determine, that VIN constitutes personal data for them, within the meaning of Article 4(1) of the GDPR, and, indirectly, for the vehicle manufacturers making it available, even if the VIN is not, in itself, personal data for them”. SWD(2024) 15 final, p. 7-8.

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1. 6

text: See the EDPS draft Guidance for co-legislators on key elements of legislative Proposals, issued for public consultation on 16 January 2024. COM(2024) 33 final, p. 6. 7

identifier: EDPS yttrande 14/2024

title: EDPS Opinion 14/2024 on the Proposal for a Directive on harmonised river information services (RIS) on inland waterways in the Community

text: 20 March 2024

text: Opinion 14/2024

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’. Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’. This Opinion relates to the Proposal for a Directive amending Directive

text: on harmonised river information services (RIS) on inland waterways in the Community .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: on harmonised river information services (‘RIS’) on inland waterways in the Community (‘the Proposal’).

text: The EDPS acknowledges the importance of providing an efficient framework for the deployment and use of RIS. He also positively remarks that one of the objectives of the Proposal is to address data protection concerns.

text: The EDPS understands that the Proposal does not aim to provide for an obligation to exchange personal data currently through RIS. However, the RIS Directive enables the exchange of data and, according to the impact assessment, certain elements (such as data relating to the position of the vessel or the identification number of vessel) may be considered as falling within the definition of personal data under the GDPR.

text: In this regard, the EDPS recalls that any legislative proposal that implies the processing of personal data must comply with the Charter of Fundamental Rights of the European Union, including the right to respect for private and family life and the right to protection of personal data. The EDPS considers that the provisions of the Proposal, in their current form, are too broad and general to adequately address the data protection concerns raised by RIS deployment in the Member States. In addition, the Proposal does not clearly indicate when the performance of RIS entails the collection and processing of personal data.

text: In addition, the EDPS considers that both the purposes of the processing and the categories of personal data in the context of the deployment of RIS should be clearly delineated by the Proposal. Provided that the interference is not serious, the categories of personal data could also be further specified in the implementing or delegated acts that would be adopted in line with the explicit empowerment given to the Commission in the Proposal. Finally, as regards the RIS platform, the EDPS recommends clearly assigning the roles of the competent authorities as controllers in the enacting terms of the Proposal.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 26 January 2024, the European Commission issued the Proposal for a Directive of the European Parliament and of the Council amending Directive

text: 2. The general objective of the Proposal is to amend the Directive

text: (‘the RIS Directive’) in order to provide an efficient framework for the deployment and use of RIS. The specific objectives are: – to ensure RIS data availability and harmonised standards; – to facilitate the integration of inland water way (‘IWT’) into the multimodal chain; and – to ensure greater uptake and interoperability of digital solutions, and address data protection concerns .

text: 3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 26 January 2024, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 26 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of the EUDPR.

text: 2. General comments

text: 4. The EDPS acknowledges the importance of providing an efficient framework for the deployment and use of RIS. The deployment of RIS on inland waterways supports the safety and efficiency of transport by inland waterways, and ultimately its sustainability, by increasing the efficiency of inland waterways operations. He also positively remarks that one of the objectives of the Proposal is to address data protection concerns .

text: 3. Processing of personal data

text: 5. According to the Explanatory Memorandum , the Proposal does not provide for an obligation to exchange personal data currently through RIS. Nevertheless, the RIS Directive enables the exchange of data and, according to the impact assessment, certain elements (such as data relating to the position of the vessel or the identification number of the vessel) may be considered as falling within the definition of personal data under the GDPR .

text: 6. In this context, the EDPS recalls that personal data is any information that relates to an identified or identifiable living individual . An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number or location data.

text: 7. In order to determine whether a natural person is identifiable, directly or indirectly, account should be taken of all the means likely reasonably to be used either by the controller, within the meaning of Article 4(7) of the GDPR, or by any other person, to identify that person, without, however, requiring that all the information enabling that person to be identified should be in the hands of a single entity . Thus, to be personal data, the information must (i) relate to a natural person and (ii) the controller or another person has means reasonably likely to identify that person.

text: 8. In a recent judgement the Court of Justice of the EU (‘the Court’) further clarifies that when an identification number, in this case Vehicle Identification Number (VIN), is used as a mere alphanumeric code, it does not constitute personal data. However, it could become "personal" to someone who has access to it and has means enabling him to use it to identify the owner of the vehicle to which it relates. The Court found that "where independent operators may reasonably have at their disposal the means enabling them to link a VIN to an identified or identifiable natural person (…) that VIN constitutes personal data for them" .

text: 4. Lawfulness of processing

text: 9. The Impact Assessment specifies that the current RIS Directive is a legal framework providing for the technical requirements, specifications and conditions which ensure the electronic exchange of personal data if national or international regulations foresee such exchange. Currently, RIS is basically a platform for data exchange providing harmonised technical specifications for data, but not the legal basis on which some personal data is actually collected and has to be submitted (e.g. border regulations, police regulations, etc.) .

text: 10. Pursuant to Recital 15 of the Proposal, Member States should exchange RIS related information to increase the efficiency of RIS and reduce reporting requirements. Where transmission and exchange of RIS related information for these purposes cannot be achieved without processing of personal data, Member States should ensure the lawfulness of the processing of those personal data in accordance with the GDPR .

text: 11. The EDPS notes that Article 9(1) of the current Directive

text: , which imposes on the Member States the obligation to ensure that processing of personal data necessary for the operation of RIS is carried out in accordance with the data protection legal framework, would be removed by the Proposal. In this regard, the EDPS recalls that any legislative proposal that implies the processing of personal data must comply with the Charter of Fundamental Rights of the European Union, including the right to respect for private and family life and the right to protection of personal data.

text: 12. The EDPS considers that the provisions of the Proposal, in their current form, are too broad and general to adequately address the data protection concerns raised by RIS deployment in the Member States. In addition, the Proposal does not clearly indicate when the performance of RIS entails the collection and processing of personal data.

text: 13. Against this background, the EDPS recommends to clearly indicate in the Proposal when the performance of RIS will lead to the collection and processing of personal data and what is the legal basis that justifies such processing. In addition, the Proposal should maintain the obligation for the Member States to provide an explicit legal basis in the Member States law. In other words, the EDPS recommends to maintain (not delete) Article 9(1) of the current Directive

text: , which imposes on the Member States the obligation to ensure that processing of personal data necessary for the operation of RIS is carried out in accordance with the data protection legal framework. In this regard, the EDPS refers to draft Guidance for co-legislators on key elements of legislative Proposals , which offers practical advice on the main elements to consider with regards to legislative proposals that imply the processing of personal data.

text: 14. Even if the Proposal does not seek to provide a legal basis for the processing of personal, the EDPS considers that both the purposes of the processing and the categories of personal data in the context of the deployment of RIS should be clearly delineated by the Proposal. Provided that the interference is not serious, the categories of personal data could also be further specified in the implementing or delegated acts that would be adopted in line with the explicit empowerment give to the Commission in the Proposal.

text: 5. Roles and responsibilities

text: 15. In line with the Explanatory Memorandum , the Proposal introduces an important change in the architecture of RIS, as it requires a central node for the exchange of information and the provision of services (‘RIS Platform’). Therefore, information now is not exchanged directly between the different users (like the vessel operator with inland ports) but is done through the platforms and functionalities of the RIS Platform.

text: 16. According to the amended

text: Article 4(5)

text: Member States shall create, operate, use and maintain a single RIS Platform which provides fairway-, infrastructure-, traffic-, and transport related data. The RIS Platform shall be accessible for all RIS users and be the main platform for the exchange of RIS related information. The Commission, shall adopt implementing acts laying down the functional and technical specifications for the RIS platform.

text: 17. The EDPS welcomes Recital 10 of the Proposal that specifies that Member States should designate one or more competent authorities responsible for operating RIS Platform and that these authorities are controllers for purpose of operating the RIS Platform. The EDPS recommends clearly assigning the role of the competent authorities as controllers also in the enacting terms part of the Proposal.

text: 6. Implementing acts

text: 18. According Article 4(5) of the Proposal, the Commission shall adopt implementing acts laying down the operational characteristics, roles and procedures for the RIS platform and identifying its operating entity, based on the principles for RIS technical specifications set out in point 7 of Annex II, to ensure their uniform implementation throughout the Union.

text: 19. Furthermore, recital 16 states that in order to ensure that RIS users are supplied with the necessary information concerning navigation and voyage planning, and taking account of scientific and technical progress, the power to adopt acts in accordance with

text: Article 290

text: TFEU should be delegated to the Commission in order to amend the minimum data requirements established in the Annex I to Directive

text: 20. In this regard, the EDPS reminds the Commission of its obligation to consult the EDPS when preparing delegated or implementing acts that would impact on the protection of individuals' rights and freedoms with regard to the processing of personal data pursuant to Article 42(1) of the EUDPR.

text: 7. Conclusions

text: 21. In light of the above, the EDPS makes the following recommendations: (1) to clearly indicate in the Proposal when the performance of RIS will lead to the collection and processing of personal data and what is the legal basis that justifies such processing; (2) to reinstate in the Proposal Article 9(1) of the current Directive

text: , while replacing the reference in this Article to Directive 95/46 with a reference to the GDPR; (3) to clearly specify the purposes for which personal data may be processed in the context of the deployment of RIS; (4) to specify the categories of personal data in the context of the deployment of RIS directly in the Proposal or in the implementing or delegated acts that would be adopted in line with the explicit empowerment give to the Commission in the Proposal; (5) to clearly assign the role of the competent authorities as controllers in the enacting terms of the Proposal. Brussels, 20 March 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8