text: OJ L 119, 4.5.2016, p. 1. OJ L 295, 21.11.2018, p. 39. OJ L 119, 4.5.2016, p. 89. Communication, p. 2. http://europa.eu/rapid/press-release_IP-18-5681_en.htm The Code and its Annex as well as the opinion of the Sounding board are available at: https://ec.europa.eu/digital-single-market/en/news/code-practice-disinformation. Available at: https://www.consilium.europa.eu/media/35936/28-euco-final-conclusions-en.pdf. Communication, p. 10. Explanatory memorandum to the proposed Regulation, p. 2. See

text: Article 27(4)

text: (a) of Regulation No 1141/2014 and the Commission factsheet on free and fair European elections available at: https://ec.europa.eu/commission/sites/beta-political/files/soteu2018-factsheet-freefair-elections_en.pdf. Explanatory memorandum to the proposed Regulation, p. 6. This Authority was established under Regulation No 1141/2014 (

text: Article 6

text: ). Recommendation 6. Also, in its Communication, p. 7, the Commission “calls also upon Member States to promote, in compliance with the applicable national and Union law, the sharing of information by the national data protection authorities to the authorities in charge of monitoring elections and political parties’ activities and financing where it follows from their decisions, or where there are otherwise reasonable grounds to believe, that an infringement is linked to political activities by national political parties or foundations in the context of elections to the European Parliament”. Emphasis added. Recommendation 11. Recommendations 1 to 5 included. Communication, p. 7 and the Commission factsheet on free and fair European elections available at: https://ec.europa.eu/commission/sites/beta-political/files/soteu2018-factsheet-free-fair-elections_en.pdf. Communication, footnote 20: “[t]his would concern in particular cases where an election process is targeted with malicious intent, including incidents based on attacks against information systems. Depending on the circumstances, criminal investigations that may result in criminal penalties may be appropriate. As noted above, definitions of offences and minimum maximum levels of penalties for attacks against information system have been harmonised by Directive

text: ”. Communication, p. 7. Recommendations 7 to 10 included and 12 to 19 included. Communication, p. 8, point 3 “Applying Data protection rules in the electoral process”. Conclusions available at: https://www.consilium.europa.eu/media/36775/18-euco-final-conclusions-en.pdf. See points 10 to 12 of the Resolution on the use of Facebook users’ data by Cambridge Analytica and the impact on data protection P8_TA-PROV(2018)0433 (2018/2855(RSP)), available at: http://www.europarl.europa.eu/sides/getDoc.do?pubRef=-//EP//NONSGML+TA+P8-TA-2018- 0433+0+DOC+PDF+V0//EN, emphasis added. Available at: http://www.europarl.europa.eu/sides/getDoc.do?type=COMPARL&reference=PE- 630.530&format=PDF&language=EN&secondRef=02 Available at: http://www.europarl.europa.eu/sides/getDoc.do?pubRef=-//EP//NONSGML+REPORT+A8-2018- 0435+0+DOC+PDF+V0//EN http://www.venice.coe.int/webforms/documents/default.aspx?pdffile=CDL-AD(2010)037-e European Commission for Democracy through Law (Venice Commission), ‘Report on the timeline and inventory of political criteria for assessing an election’ p. 4 and 5, Study no. 558/2009, Strasbourg, 21.10.2010. http://eprints.lse.ac.uk/71945/7/LSE%20MPP%20Policy%20Brief%2019%20- %20The%20new%20political%20campaigning_final.pdf London School of Economic, Media Policy Brief 19 ‘The New Political Campaigning’ p.6. March 2017. See European Parliament resolution of 3 May 2018 on media pluralism and media freedom in the European Union P8_TA(2018)0204 (2017/2209(INI)), point S, available at: http://www.europarl.europa.eu/sides/getDoc.do?pubRef=-//EP//NONSGML+TA+P8-TA-2018- 0204+0+DOC+PDF+V0//EN .

text: EDPS Opinion 3/2018 on online manipulation and personal data and EDPB Statement the data protection impacts of economic concentration adopted on 27 August 2018. Resolution on the Use of Personal Data for Political Communication, Montreux (Switzerland), 14th to 16th September 2005. Communication, pp. 2 and 5 and the Guidance, point 2.4. Communication, p. 6. Proposal for a Regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive

text: (Regulation on privacy and electronic communications), COM(2017) 10 final, 2017/0003 (COD). See EDPS Opinion 6/2017 on the Proposal for a Regulation on Privacy and Electronic Communications (ePrivacy Regulation) and his blog available at https://edps.europa.eu/press-publications/press-news/blog/urgent-casenew-eprivacy-law_en . Regulation (EU, Euratom) No 1141/2014 of the European Parliament and of the Council of 22 October 2014 on the statute and funding of European political parties and European political foundations (OJ L 317, 4.11.2014, p.1). Explanatory memorandum, p.2. Article 1(3) of the proposed Regulation introducing a new

text: Article 10

text: a. The Committee was established by Regulation No 1141/2014 (

text: Article 11

text: ). See also Recital 4 of the proposed Regulation. Article 1(4) of the proposed Regulation introducing a second sentence to

text: Article 11(3)

text: subparagraph 1 of Regulation No 1141/2014. Article (6)(a) of the proposed Regulation introducing a new point (vii) to

text: Article 27(2)

text: (a) of Regulation No 1141/2014. Explanatory memorandum, p.4. See in particular points 40 and following of the Judgment of the Court (Grand Chamber) of 20 March 2018, Garlsson Real Estate SA v. Commissione Nazionale per le Società e la Borsa (Consob),

text: , ECLI:EU:C:2018:193, whereby the Court stated that “the fact that the imposition of that criminal penalty depends on an additional constituent element in relation to the administrative fine of a criminal nature is not, in itself, capable of calling into question the identity of the material facts at issue. Subject to verification by the referring court, the administrative fine of a criminal nature and the criminal proceedings at issue in the main proceedings appear therefore to relate to the same offence” and that “a limitation to the ne bis in idem principle guaranteed by Article 50 of the Charter may be justified on the basis of

text: Article 52(1)

text: thereof”. Article 33(8) of Regulation No 1141/2014 provides that “European political parties and European political foundations, the Member States and the independent bodies or experts authorised to audit accounts under this Regulation shall be liable in accordance with applicable national law for any damage they cause in the processing of personal data pursuant to this Regulation. The Member States shall ensure that effective, proportionate and dissuasive sanctions are applied for infringements of this Regulation, of Directive

text: and of the national provisions adopted pursuant thereto, and in particular for the fraudulent use of personal data”. Article 1(3) of the proposed Regulation. Article 1(4) of the proposed Regulation amending Article 11 of Regulation No 1141/2014. EDPS Opinion on online manipulation and personal data, p. 19. See also the Resolution on Collaboration between Data Protection Authorities and Consumer Protection Authorities for Better Protection of Citizens and Consumers in the Digital Economy adopted on 23 October 2018 by the International Conference of Data Protection and Privacy Commissioners, available at: https://icdppc.org/wpcontent/uploads/2018/10/20180918_ICDPPC-40th_DCCW-Resolution_ADOPTED.pdf EDPS Opinion 3/2018 on online manipulation and personal data, p. 22.

text: Directive (EU) 2016/1148

text: of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union, OJ L 194, 19.7.2016, p. 1.

text: Regulation (EU) No 910/2014

text: of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive

text: , OJ L 257, 28.8.2014, p. 73. Communication, p. 4. See footnote 1 referring to the report issued in July 2018 by the Information Commissioner’s Office (ICO) summarising the policy findings from the investigation it conducted into the use of data analytics for political purposes, with a particular focus on the EU referendum campaign and the use of social media and footnote 3 referring to the rules adopted by the Italian Data Protection Authority in March 2014, the additional guidelines

text: provided by the French National Data Protection Commission (CNIL) in November 2016 to its 2012 recommendations on political communication, specifying the rules for processing of personal data on social networks and the Guidance on political campaigning published by ICO. See Judgment of the Court of Justice of the European Union (Grand Chamber) of 5 June 2018, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH, Case C- 210/16, ECLI:EU:C:2018:388. Opinion 00264/10/EN,

text: WP 169

text: , available in https://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2010/wp169_en.pdf, to be updated in the light of the GDPR in a near future.

identifier: EDPS yttrande 10/2018

amnesord:
Charter of Fundamental Rights
Rights of the Individual

title: Commission Package on free and fair European elections

text: Opinion 10/2018

text: on the Commission Package on free and fair European elections

text: 17 December 2018 1 | P a g e

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by the Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Under Article 57(1)(g) of Regulation 2018/1725, the EDPS shall ‘advise on his or her own initiative or on request, all Union institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data’.

text: He was appointed in December 2014 together with the Assistant Supervisor with the specific remit of being constructive and proactive. The EDPS published in March 2015 a five-year strategy setting out how he intends to implement this remit, and to be accountable for doing so.

text: This Opinion relates to the EDPS' mission to advise the EU institutions on the data protection implications of their policies and to foster accountable policymaking in line with Action 9 of the EDPS Strategy: 'Facilitating responsible and informed policymaking'. It provides for several recommendations in relation to the proposed Regulation in order to further improve the articulation between data protection legal framework on the one hand and the purpose of this initiative on the other hand.

text: 2 | P a g e

text: Executive Summary

text: The functioning of the Union is founded on representative democracy. Political communication is essential to the participation of citizens, political forces and candidates in democratic life and to the fundamental right to freedom of expression. These rights and freedoms are interdependent with the right to respect for private and family life, home and communications and the right the protection of personal data. Earlier this year, in his Opinion 3/2018 on online manipulation, the EDPS highlighted the risks to fundamental rights of concentrated markets.

text: In the context of the 2018 State of the Union speech, the Commission presented a security package focusing on Free and fair European elections. This package is composed of a Communication, a Guidance document on the application of Union data protection law in the electoral context, a Recommendation and a proposal for a Regulation as regards a verification procedure related to infringements of rules on the protection of personal data in the context of elections to the European Parliament. The EDPS recognises the reference made to the role of social media platforms and on how this initiative would be coherent with the Code of Practice on online disinformation. In light of the upcoming European Parliament elections in May next year, and the numerous other national elections scheduled for 2019, the EDPS also recognises the recommendations for the setting up of national election networks and a European coordination network. He takes this opportunity to show his availability to participate in this European network. It would complement EDPS action in this area, in particular the worskop which he organises in February next year. The EDPS also recognises the recommendation to Member States to perform a comprehensive assessment of risks associated with the elections to the European Parliament with a view to identifying potential cyber incidents that could affect the integrity of the electoral process and underlines the urgency of this matter.

text: In general, the EDPS considers that, for further clarity, a reference could have been included to the processing of personal data by the European Parliament, the Authority for European political parties and European political foundations and the Committee of independant persons, as being within the scope of Regulation 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data (previously, Regulation 45/2001). In addition and more specifically, the EDPS makes several recommendations in relation to the proposed Regulation, among which clarifying the scope of the measures and the complementary aims of such sanctions, including EDPS decisions finding an infringement to Regulation 2018/1725 and a reference to the current data protection legal framework for cooperation between national data protection supervisory authorities and the EDPS as well as ensuring the confidentiality of the exchange of information in the context of the cooperation between data protection supervisory authorities and the Committee of independant persons.

text: 3 | P a g e

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof, Having regard to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) ,

text: Having regard to

text: Regulation (EU) 2018/1725

text: Regulation (EC) No 45/2001

text: and Decision No

text: , and in particular Articles

text: (g) and 58(3)(c) thereof, Having regard to

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA ,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction and background

text: 1. In the context of the 2018 State of the Union speech, the Commission presented on 12 September 2018 a security package focusing on Free and fair European elections. It is composed of a legislative proposal accompanied by 3 non-legislative measures:  a Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU, Euratom) No 1141/2014 as regards a verification procedure related to infringements of rules on the protection of personal data in the context of elections to the European Parliament (COM (2018) 636 final/2) (hereafter the ‛proposed Regulation’);  a Communication on Securing free and fair European elections (COM (2018) 637 final) (hereafter the ‛Communication’);  a Recommendation on election cooperation networks, online transparency and protection against cybersecurity incidents and fighting disinformation campaigns in the context of elections to the European Parliament (C (2018) 5949 final) (hereafter the ‛Recommendation’) and  a Guidance on the application of Union data protection law in the electoral context (COM (2018) 638 final) (hereafter the ‛Guidance’). 2. This package has been adopted with a view of securing fair and free elections to the European Parliament to be held in May 2019, taking into account the new challenges put forward by online communication and recent revelations such as the “Facebook/Cambridge Analytica” case . It is presented together with a proposal for a Regulation of the European parliament and of the Council establishing the European Cybersecurity Industrial, 5 | P a g e Technology and Research Competence Centre and the Network of National Coordination Centres (COM(2018) 630 final) . 3. It is complementary to the Commission Communication of 26 April 2018 “Tackling online disinformation: a European approach” (COM/2018/236 final), which seeks to promote a more transparent, trustworthy and accountable online environment. One of its key deliverables, the self-regulatory Code of Practice on Disinformation, was published on 26 September 2018. The Commission has also published the opinion of the Sounding board of the Multi-stakeholder forum on the Code of Practice . The actions foreseen in this Communication, including this Code of Practice, complement the ongoing work of the EEAS. Following the European Council conclusions of 28 June 2018 , the Commission and the High Representative of the Union for Foreign Affairs and Security Policy will present in cooperation with Member States a revised action plan to fight disinformation, by the end of the year .

text: 4. The proposed Regulation “aims to allow financial sanctions on European political parties or foundations that use infringements of data protection rules to deliberately influence or attempt to influence the outcome of elections to the European Parliament” . In addition to financial penalties which could be imposed on European political parties or foundations, of 5% of their annual budget , a new ground would “be added to the list of infringements which prevent a European political party or foundation to apply for funding from the general budget of the European Union in the year when the sanction was imposed” . In its Recommendation, the Commission encourages national data protection supervisory authorities established under the General Data Protection Regulation (hereafter the ‛GDPR’) to inform immediately and proactively the Authority for European political parties and European political foundations (hereafter the ‛Authority’) of their decisions finding an infringement of data protection rules, where the infringement is linked to political activities by a European political party or foundation “with a view to influencing elections to the European Parliament” . The Commission also recommends, for cases involving political parties or foundations at national and regional level, Member States to “apply appropriate sanctions” .

text: 5. In addition, the Recommendation encourages the establishment of a national election network in each Member State as well as a European coordination network on the elections to European Parliament . The latter is a follow up to the first exchange organised by the Commission between EU countries on electoral best practices in April 2018. It would be composed of national contact points and should meet in January and April 2019 . It is planned as a real time European alert process and as a forum for exchange of information. The national networks would inter alia aim at exchanging information on issues capable of affecting the European elections, between national authorities with competence for electoral matters and for cybersecurity as well as national data protection authorities and national audio-visual regulatory authorities or bodies. It is recommended that these national networks consult and cooperate with the relevant national law enforcement authorities in accordance with national law and that where appropriate, cooperation between national law enforcement authorities at European level may be facilitated by Europol. According to the Commission, “[t]his will enable them quickly to detect potential threats to the elections to the European Parliament and swiftly enforce existing rules, including available financial sanctions, such as reimbursement of the public contribution” .

text: 6. The Commission finally presents several recommendations to facilitate transparency in political advertising ahead of the elections to the European Parliament and encourages Member States to take appropriate measures in the area of cybersecurity of the European Parliament electoral process and to engage in awareness raising activities with third 6 | P a g e parties, including online platforms and information technology providers, for better transparency and trust building in the electoral process.

text: 7. The Guidance highlights the existing Union data protection framework and its application in the electoral context. According to the Commission, since it is the first time that the GDPR will be applied in the European electoral context, it is important for all actors involved in election processes to understand clearly how best to apply these rules. The Commission underlines that the national data protection authorities “have to make full use of their strengthened powers to address possible infringements” .

text: 8. On 18 October 2018, the European Council called for measures to “protect the Union's democratic systems and combat disinformation, including in the context of the upcoming European elections, in full respect of fundamental rights. In this respect, the measures proposed by the Commission on election cooperation networks, online transparency, protection against cybersecurity incidents, unlawful data manipulation and fighting disinformation campaigns and tightening the rules on European political party funding deserve rapid examination and operational follow-up by the competent authorities ”.

text: 9. On 25 October 2018, the European Parliament adopted a resolution recalling “the measures proposed by the Commission for securing free and fair European elections, in particular the legislative amendment to tighten up the rules on European political party funding, creating the possibility to impose financial sanctions for breaching data protection rules in order to deliberately influence the outcome of the European elections” and that “the processing of personal data by political parties in the EU is subject to the GDPR, and that the breach of the principles, rights and obligations encompassed within this law would result in additional fines and sanctions”. The resolution considers that “election interference to be a huge risk for democracy, the tackling of which requires a joint effort involving service providers, regulators and political actors and parties” and welcomes this Commission package . On 3 December 2018, the Committee on Civil Liberties, Justice and Home Affairs of the European Parliament adopted its opinion on the proposed Regulation . On 6 December 2018, the Committee on Constitutional Affairs adopted its report on the proposed Regulation .

text: 10. The European Data Protection Supervisor (hereafter the ‛EDPS’) welcomes the informal consultation by the Commission on the proposed Regulation, the Recommendation and the Guidance prior to their adoption and the fact that part of his informal comments were taken into account. He underlines however that due to the short notice, these were preliminary comments. Therefore, he makes the following formal comments. In this regard, he would like to recall that, when it adopts a legislative proposal relating to the protection of individuals' rights and freedoms with regard to the processing of personal data, as it is the case here, the Commission shall consult the EDPS.

text: 2. Comments

text: 2.1. General Comments

text: 11. The EDPS recognises political communication as essential to the participation of citizens, political forces and candidates in democratic life and to the fundamental right to freedom of expression, and that these rights and freedoms are interdependent with the right under Article 7 of the Charter of Fundamental Rights of the European Union (hereafter the ‘Charter’) to respect for private and family life, home and communications, and the right under Article 8 of the Charter to the protection of personal data.

text: 12. Article 2 of the Treaty on European Union (hereafter the ‘TEU’) provides that “[t]he Union is founded on the values of respect for human dignity, freedom, democracy, equality, the 7 | P a g e rule of law and respect for human rights, including the rights of persons belonging to minorities. These values are common to the Member States in a society in which pluralism, non-discrimination, tolerance, justice, solidarity and equality between women and men prevail.” According to

text: Article 10(4)

text: TEU, “[p]olitical parties at European level contribute to forming European political awareness and to expressing the will of citizens of the Union”. Article 12(2) of the Charter expresses the same principle. Article 3 of Protocol I to the European Convention of Human Rights guarantees everyone a right to free election. Freedom, fairness and transparency are recognised as key principles of democratic elections . In the EU context,

text: Article 10(1)

text: and (2) TEU provide that “[t]he functioning of the Union shall be founded on representative democracy” and that “[c]itizens are directly represented at Union level in the European Parliament”. Article 39 of the Charter guarantees the right to vote in European Parliament elections. The principle of electoral transparency would appear to be compromised where the voters have no freedom to seek, receive and impart information about the process and the candidates, including about the source and spending of financial support received by a candidate or a party . Article 11 of the Charter contains the requirement for the freedom and pluralism of the media to be respected. The Resolution of the European Parliament on media pluralism and media freedom in the European Union adopted on 3 May 2018 referred to the “concentration of power of media conglomerates, platform operators and internet intermediaries and media control by economic corporations and political actors risk[ing] causing negative consequences for the pluralism of public debate and access to information (...)” . The EDPS and most recently the EDPB have also highlighted the risks to fundamental rights of concentrated markets . Data protection supervisory authorities have underlined the importance of the use of personal data for political communication within the framework of the International Conference of Data Protection and Privacy Commissioners . In this context, the EDPS would like to recall that according to Recital 56 GDPR “[w]here in the course of electoral activities, the operation of the democratic system in a Member State requires that political parties compile personal data on people's political opinions, the processing of such data may be permitted for reasons of public interest, provided that appropriate safeguards are established.”

text: 13. Against this background, the EDPS recognises the direct reference made, in particular in the Communication and the Guidance, to the role of social media platforms and on how the initiative would be coherent with the Code of Practice on online disinformation . He also takes note that the assessment of the code “will be part of the work towards an action plan with specific proposals for a coordinated EU response to the challenge of disinformation, to be presented by the Commission and the High Representative before the end of the year” . Political advertisements are increasingly targeted on the basis of large scale personal data processing, profiling and algorithmic decision making for which social media platforms in question are accountable under the GDPR and other relevant regulation. The EDPS would like therefore to reiterate its support for a swift adoption of a new ePrivacy Regulation with the ambition to provide a high level of protection with respect to both content and metadata and the objective of extending the confidentiality obligations to a broader range of services - including the so-called ‘over the top’ services (OTTs) which reflects the progress of technology .

text: 14. Also, for purpose of clarity, the initiative could have included a reference to the processing of personal data by the Authority, the European Parliament and the Committee of independent eminent persons as being within the scope of

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) 8 | P a g e No 45/2001 and Decision No

text: Text with EEA relevance (see Article 33 of Regulation No 1141/2014 ). 2.2. Comments on the proposed Regulation

text: 15. The explanatory memorandum to the proposed Regulation states that “existing rules do not allow to effectively dissuade and sanction abuses of data protection rules which may affect the democratic debate and free elections”. The aim of the proposed amendments is therefore to financially sanction “European political parties or foundations that use infringements of data protection rules to deliberately influence or attempt to influence the outcome of elections to the European Parliament” . The proposed Regulation creates a verification procedure related to infringements of rules on the protection of personal data, whereby: 1) without undue delay and no later than 1 month after the decision of a data protection supervisory authority within the meaning of point 21 of

text: Article 4

text: GDPR “finding that a natural or legal person has infringed applicable rules on the protection of personal data and “if it follows from that decision, or where there are otherwise reasonable grounds to believe, that the infringement is linked to political activities by a European political party or a European political foundation in the context of elections to the European Parliament”, the Authority shall request the opinion of the Committee of independent eminent persons (hereafter the ‘Committee’) ; 2) “when requested by the Authority, the Committee shall give an opinion on whether a European political party or a European political foundation has deliberately influenced or attempted to influence the outcome of elections to the European Parliament by taking advantage of an infringement of the applicable rules on the protection of personal data” . 3) where the opinion of the Committee finds that “a European political party or a European political foundation has deliberately influenced or attempted to influence the outcome of elections to the European Parliament by taking advantage of an infringement of the applicable rules on the protection of personal data”, the Authority shall impose financial sanctions .

text: 16. The EDPS understands that such mechanism is supposed to be complementary to the sanctions, and in particular to the administrative fines, that national data protection supervisory authorities are entitled to impose under the GDPR. According to the explanatory memorandum of the proposed Regulation, “there is no double penalisation of the same behaviour” as the “behaviour sanctioned by this proposal is the taking advantage of infringements of data protection rules to deliberately influence or to attempt to influence the elections to the European Parliament. The Authority will not impose sanctions on infringements of data protection rules as such” .

text: 17. In this regard, the EDPS considers that the proposed Regulation would benefit from further clarification of the scope of the measures taken. In other words, bearing in mind the competences of data protection supervisory authorities under the GDPR and the ne bis in idem principle enshrined in Article 50 of the Charter as interpreted by the Court of Justice of the European Union , the body of the proposed Regulation should be very clear, as it seems prima facie from the proposed Regulation, that the Authority would not impose sanctions for infringements of the GDPR as such. The Committee and the Authority should of course not be expected to undertake a new and separate assessment of the infringement of the GDPR which has already been determined by the competent data protection supervisory authorities defined in

text: Article 4 (21)

text: GDPR. It should be clear that the Committee and the Authority build on the assessment of the data protection supervisory 9 | P a g e authority on the infringement of the GDPR and the scope of the measure taken by the Authority should be limited to sanctioning an unlawful conduct consisting in the breach of the one or more provisions of Regulation No 1141/2014 for which it is competent (e.g. electoral fraud or manipulation), which, under the proposed Regulation, would include a breach achieved by means of the infringement of data protection rules.

text: 18. In that respect, the proposed Regulation could clarify the legal rules (e.g. Regulation No 1141/2014 and not the GDPR) whose infringement would be sanctioned by the Authority and the complementary aims of such sanction.

text: 20. According to the proposed Regulation, the Authority shall refer the matter to the Committee only where a decision has been issued by a national data protection supervisory authority finding an infringement of data protection law and that, either “it follows from that decision (...) that the infringement is linked to political activities by a European party or foundation” or “there are otherwise reasonable grounds to believe the infringement is linked to political activities” . We would suggest clarifying whether the ‘reasonable grounds’ for believing an infringement is linked to political activities are to be determined solely by the Authority or also potentially in cooperation with the data protection supervisory authority.

text: 21. Moreover, this new procedure would give rise to a new sharing of information by the national data protection supervisory authorities with the Committee . For instance, the Committee might need, to adopt a meaningful opinion, to access preliminary or interim investigation reports of data protection authorities. The EDPS welcomes the fact that the proposed Regulation provides that such cooperation shall take place “in accordance with applicable law”. Due to the sensitivity of the matter, it is of utmost importance to ensure the confidentiality of such exchange of information. He notes however that such cooperation between the Committee and the national data protection authorities is not covered by Article 28 of Regulation No 1141/2014, which specifically provides for an agreement with the Member States “on practical arrangements for (...) exchange of information, including the rules regarding the disclosure of confidential information or evidence”. This provision does not concern the cooperation with the Committee. The EDPS recommends therefore to also amend that provision so that Member States and the Committee shall conclude such practical arrangements as well.

text: 22. Furthermore, the implementation of the new procedure would in some cases require a cooperation between the national data protection supervisory authorities and the EDPS to facilitate the gathering of evidence proving an infringement of the GDPR. The EDPS recommends that a short reference be made to the current Data Protection legal framework for such cooperation.

text: 23. Finally, the EDPS observes that as it stands, the proposed Regulation would not cover cases of infringements of

text: Regulation (EU) 2018/1725

text: , as the latter falls under the supervision of the EDPS and not of the national data protection supervisory authorities under the GDPR. In order to fully achieve the objectives of the proposed Regulation, the EDPS therefore recommends to include EDPS decisions finding such infringement together with the aforementioned safeguards as to the cooperation with the Committee in the framework of this new procedure. 2.3. Comments on the Recommendation

text: 24. The EDPS recognises the recommendation for the setting up of national election networks. He also recognises the recommendation for the European coordination 10 | P a g e network on the elections to the European Parliament which should take place with the support of the Commission. The EDPS takes this opportunity to show his availability to participate, either as member or as an observer, in this network.

text: 25. The EDPS has for several years argued for greater collaboration between data protection authorities and other regulators to safeguard the rights and interests of individuals in the digital society. In particular, given the concentrated nature of digital markets and the pivotal role of a very small number of major platforms in mediating and targeting political advertisements in recent years, the EDPS has recommended that competition authorities, who are responsible for determining cases of alleged abuse of dominance and proposed mergers, and consumer protection authorities concerned with the transparency and fairness of the terms of use of online services, be integrated into this dialogue . Such an initiative would contribute to the enforcement of the data protection rules -especially the GDPR- with rigour and in tandem with other norms for elections and media pluralism and would complement EDPS action in this area, in particular the workshop which will take place early next year between national regulators in the area of data protection, electoral and audio-visual law .

text: 26. The EDPS takes note of recommendation (6) which aims at encouraging national supervisory authorities under the GDPR to cooperate with the Authority. The Recommendation, while not binding, implies a new task for national supervisory authorities under the GDPR to systematically assess whether it follows from their decision or whether there are otherwise ‘reasonable grounds’ to believe that the data protection law infringement found in their decision is linked to political activities by a European political party or European political foundation with a view to influencing elections to the European Parliament and to immediately and proactively inform the Authority. As mentioned above for the proposed Regulation, the EDPS underlines that such cooperation may only take place in accordance with the national data protection supervisory authorities’ obligations under the applicable legal framework and therefore, welcomes the fact that the Recommendation specifies that the national supervisory authorities under the GDPR should cooperate “in compliance with their obligations under (...) Union and national law”.

text: 27. With regard to cybersecurity, the Recommendation emphasizes existing principles laid 46 47 down in the NIS

text: Directive (EU) 2016/1148

text: and the eID

text: Regulation (EU) 910/2014

text: . The security requirements of these instruments are complemented by the relevant provisions on the security of personal data laid down in the GDPR. The EDPS therefore recognises that national competent authorities designated according to the NIS Directive shall be part of the recommended national election networks.

text: 28. The EDPS takes note of the attention given to the network and information security considering all information systems used for the organisation of elections (recommendation (12)). He underlines that such systems play a central role, even when no electronic voting tools are offered to voters. The management of voter lists, preparation of ballot stations, registration of nominated candidates, lists and parties, aggregation and compilation of voting results and subsequent processes usually rely on information systems and complex networks of such systems. Alleged or real attacks on the integrity, confidentiality or availability of such systems and networks may be used to undermine the credibility and put in doubt the legitimacy of the vote, even if no actual damage has been achieved.

text: 29. Stakes and risks are much higher when the actual voting process is carried out by electronic means, at ballot stations or even more where any form of online voting is used. Widespread electronic voting systems used in third countries and the EU have been found to suffer from 11 | P a g e significant vulnerabilities. The complexity of such systems, caused inter alia by the apparently contradictory objectives of keeping the votes secret and ensuring the possibility to verify the correctness of the voting results, makes it difficult or impossible to explain the integrity of such systems to many citizens so that they may have the same level of confidence and transparency as it is possible with paper ballots. The risk that real attacks or false claims of such attacks undermine the confidence in the election appears higher than in traditional paper ballot systems. Even availability problems, such as temporary interruptions of the voting process due to small technical faults may cause some voters to lose the possibility to exercise their fundamental right or increase fears about manipulations.

text: 30. On this background, the EDPS recognises the recommendation to Member States to perform a “comprehensive assessment of risks associated with the elections to the European Parliament with a view to identifying potential cyber incidents that could affect the integrity of the electoral process”(recommendation (16)). In view of the complexity of this task and the subsequent implementation of appropriate technical and organisational measures, and the short time left until the elections, the EDPS underlines the urgency of this matter and of launching the process without further delay. 2.4. Comments on the Guidance

text: 31. The EDPS takes note of the Guidance which aims at providing specific guidance regarding the processing of personal data in elections to European but also national political parties, national governments, authorities, private entities and stakeholders .

text: 32. In general, while regretting that the Guidance lacks concrete examples of good practices, the EDPS welcomes the reference made to some of the rules or guidelines on data processing for political purposes developed by national data protection authorities and which contain such concrete examples of good practices .

text: 33. The EDPS welcomes also the reference made, under point 1 on the Union data protection framework, to the supervisory powers, including the possible sanctions in case of infringement, as it is key for the actors concerned to be aware of the supervision process which is in place and of the possible sanctions in case of infringement of data protection law.

text: 34. In addition, the EDPS recognises the fact that, under point 2.1. on Data controllers and processors, the need to undertake a case-by-case assessment of each situation is underlined and the fact that it is referred to the case where candidates run for election independently of any political party. Such candidates are the controllers of the data processed for the electoral campaign they are running for. However, the various scenarios possible for data controllers and data processors could have been further detailed: in particular, political parties and foundations are likely to be considered controllers, or joint controllers alongside the platforms, such as social media providers, used to target political messages . Data brokers and data analytics companies are more likely to be considered processors. Within an electoral process, these entities should only process data on behalf of data controllers and not act as such. Further guidance may be found in the Opinion 1/2010 of the

text: Article 29

text: Data Protection Working Party on the concepts of “controller” and “processor” .

text: 35. Finally, the EDPS welcomes the reference made, under points 2.3 on the transparency requirements and 2.4. on profiling, automated decision-making and micro-targeting, with regard to social media platforms, to the rights of the data subject under the GDPR to information about data processing and to not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. 12 | P a g e

text: 3. Conclusion

text: 36. The EDPS recognises political communication as essential to the participation of citizens, political forces and candidates in democratic life and to the fundamental right to freedom of expression, and that these rights and freedoms are interdependent with the right under Article 7 of the Charter to respect for private and family life, home and communications, and the right under Article 8 of the Charter to the protection of personal data.

text: 37. He recognises the reference made, in particular in the Communication and the Guidance, to the role of social media platforms and on how this initiative would be coherent with the Code of Practice on online disinformation.

text: 38. In light of the upcoming European Parliament elections in May next year, and the numerous other national elections scheduled for 2019, the EDPS also recognises the recommendations for the setting up of national election networks and a European coordination network. He takes this opportunity to show his availability to participate in this European network. It would complement EDPS action in this area, in particular the worskop which he organises in February next year.

text: 39. The EDPS also recognises the recommendation to Member States to perform a comprehensive assessment of risks associated with the elections to the European Parliament with a view to identifying potential cyber incidents that could affect the integrity of the electoral process and underlines the urgency of this matter.

text: 40. In general, the EDPS considers that, for further clarity, a reference could have been included to the processing of personal data by the European Parliament, the Authority and the Committee, as being within the scope of Regulation 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data (previously, Regulation 45/2001).

text: 41. In addition and more specifically, the EDPS makes several recommendations in relation to the proposed Regulation, among which: - clarifying the scope of the measures and the complementary aims of such sanctions; - including EDPS decisions finding an infringement to Regulation 2018/1725; - including a reference to the current data protection legal framework for cooperation between national data protection supervisory authorities and the EDPS; and - ensuring the confidentiality of the exchange of information in the context of the cooperation between data protection supervisory authorities and the Committee of independant persons. Brussels, (signed) Giovanni BUTTARELLI 13 | P a g e

text: Notes

text: 14 | P a g e

text: 15 | P a g e

text: 16 | P a g e

type: vagledning

utgivare: edps


text: OJ L 119, 4.5.2016, p. 1. OJ L 295, 21.11.2018, p. 39. OJ L 119, 4.5.2016, p. 89.

text: Regulation (EU) 2018/1727

text: of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council Decision 2002/187/JHA, OJ L 295, 21.11.2018, p. 138, hereinafter “the Eurojust Regulation”. Brussels, 6.10.2020 COM(2020) 660 final 2020 Communication on EU enlargement policy. https://eeas.europa.eu/sites/eeas/files/eugs_review_web_0.pdf For further details see the EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data https://edps.europa.eu/sites/edp/files/publication/19-12-19_edps_proportionality_guidelines_en.pdf See Judgments in Joined Cases

text: and

text: DRI, paragraph 52;

text: Case C-73/07

text: Satakunnan Markkinapörssi and Satamedia, paragraph 56; Joined Cases

text: and

text: Volker und Markus Schecke and Eifert, paragraphs 77 and 86. CJEU judgments in

text: Case C-43/12

text: Commission v Parliament and Council, para. 29 and

text: Case C-263/14

text: Parliament v Council, para. 43. CJEU, Opinion 1/15, EU-Canada PNR Agreement, ECLI:EU:C:2017:592, para. 232.

identifier: EDPS yttrande 10/2020

publisher: Europeiska datatillsynsmannen

sprak: en

title: Ten agreements allowing the exchange of data between Eurojust and the competent authorities for judicial cooperation in criminal matters in certain third countries

serie: yttranden

text: Opinion 10/2020

type: rubrik

text: on the negotiating mandate to conclude ten agreements allowing the exchange of data between Eurojust and the competent authorities for judicial cooperation in criminal matters in certain third countries

text: 17 December 2020 1 | P a g e

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the EDPS' mission to advise the EU institutions on coherently and consistently applying the EU data protection principles, including when negotiating agreements in the judicial and law enforcement sector. It builds on the general obligation that international agreements must comply with the provisions of TFEU and the respect for fundamental rights that stands at the core of EU law. In particular, compliance with Articles 7 and 8 of the Charter of Fundamental Rights of the EU and Article 16 TFEU must be ensured.

text: 2 | P a g e

text: Executive Summary

text: On 19 November 2020, the Commission issued a Recommendation to the Council to authorise the opening of negotiations between the European Union and respectively Algeria, Armenia, Bosnia and Herzegovina, Egypt, Israel, Jordan, Lebanon, Morocco, Tunisia and Turkey, in order to conclude international agreements concerning the exchange of personal data between Eurojust and the competent authorities for judicial cooperation in criminal matters of those states. Such international agreements would provide the required legal basis for the exchange of personal data between Eurojust and the authorities of these third countries competent for judicial cooperation in criminal matters. The Annex to this Recommendation lays down the Council’s directives to negotiate these ten international agreements envisaged and sets out the mandates given to the Commission.

text: International agreements allowing Eurojust and third countries to cooperate and exchange personal data should prove necessary and proportionate in accordance with Article 52(1) of the Charter of fundamental rights of the EU. They should strike a fair balance between the need to prevent and combat crime on the one hand and the sound protection of personal data and other fundamental rights protected by the Charter, on the other.

text: Hence, the recommendations in this Opinion are aimed at clarifying and, where necessary, further developing the safeguards and controls in the future agreements with respect to the protection of personal data.

text: Finally, the EDPS stands ready to give further advice during the negotiations and before the finalisation of these ten international agreements.

text: 3 | P a g e

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof, Having regard to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) , Having regard to

text: Regulation (EC) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular

text: Article 42(1)

text: thereof, Having regard to

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA ,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION

text: 1.1 Background

text: 1. The Eurojust Regulation lays down specific rules regarding transfers of data by Eurojust outside of the EU.

text: Article 56(2)

text: thereof lists a number of legal grounds based on which Eurojust could lawfully transfer data to authorities of third countries. One possibility would be an adequacy decision of the Commission in accordance with

text: Article 36 of Directive (EU) 2016/680

text: finding that the third country to which Eurojust transfers data ensures an adequate level of protection. Since there is no such adequacy decision at the moment, the other alternative for Eurojust to regularly transfer data to a third country would be to use an appropriate framework resulting from the conclusion of a binding international agreement between the EU and the receiving third country pursuant to

text: Article 218

text: TFEU that provides for adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

text: 2. On 19 November 2020, the Commission adopted a Recommendation for a Council Decision authorising the opening of negotiations for Agreements between the European Union (EU) and Algeria, Armenia, Bosnia and Herzegovina, Egypt, Israel, Jordan, Lebanon, Morocco, Tunisia and Turkey on cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the competent authorities for judicial cooperation in criminal matters of those third States. Such 5 | P a g e international agreements would provide the required legal basis for the exchange of personal data between Eurojust and the authorities of these third countries competent for judicial cooperation in criminal matters.

text: 3. Taking into account the political strategy, the operational needs of judicial authorities across the EU, and the potential benefits of closer cooperation in this area, the Commission considers it necessary to start negotiations in the short-term with ten third countries to regulate the way Eurojust can cooperate with the competent authorities of these countries. The Commission has made its assessment of priority countries taking into account Eurojust's operational needs.

text: 4. The first priority was to enhance cooperation with candidate countries and potential candidates, as these third States should be best prepared for high-level judicial cooperation in criminal matters as a matter of EU acquis. The Commission’s view regarding Bosnia and Herzegovina and Turkey was set out in the Commission’s 2020 Regular Reports . In both cases, the conclusion of an international agreement, allowing for the exchange of personal data with Eurojust, is subject to both countries making the necessary amendments to their relevant data protection laws.

text: 5. The second priority was to enhance cooperation with other third countries which have not applied for Union membership but have a potentially high security impact on Europe for geographical reasons, such as countries in the Middle East and North African Region. This choice is also in line with the Global Strategy for the European Union’s Foreign and Security policy .

text: 6. A third priority was to ensure as much as possible consistency in EU JHA agencies’ relations with third countries, in particular between Europol and Eurojust, thus ensuring possible follow-up between law enforcement and judicial cooperation. At the current time, the Commission - on behalf of Europol - seeks to conclude agreements with 8 out of 10 of the above mentioned countries. The Commission considers it worthwhile, as far as possible and feasible, to strive towards having both Eurojust and Europol included in these future negotiations, which might also make them more attractive to the third countries concerned.

text: 7. In accordance with the procedure laid down in Article 218 of the Treaty on the Functioning of the European Union (TFEU), the Commission will be responsible for negotiating these international agreements with third countries on behalf of the EU. With this Recommendation, the Commission seeks to obtain authorisation from the Council of the European Union (Council) to start the negotiations with the ten third countries identified. Once the negotiations are completed, in order to formally conclude these agreements, the European Parliament will have to give its consent to the texts of the agreements negotiated, while the Council will have to sign the agreements.

text: 8. Pursuant to Article 42(1) of Regulation 2018/1725, the Commission is obliged to consult the EDPS following the adoption of a proposal for a recommendation to the Council pursuant to

text: Article 218

text: TFEU, where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data. The EDPS was formally consulted by the Commission on 19 November 2020. 6 | P a g e

text: 9. The EDPS welcomes that he has been consulted on the Recommendation by the European Commission and expects that a reference to this Opinion will be included in the preamble of the Council Decision. The present Opinion is without prejudice to any additional comments that the EDPS could make on the basis of further available information at a later stage.

text: 2. GENERAL COMMENTS

text: 10. Transfers of personal data gathered in the context of criminal investigations envisaged under the Agreement are liable to have a significant impact on the lives of the individuals concerned, as they would potentially be used in prosecution cases in the receiving country under its national law.

text: 11. As transfers of personal data to third countries constitute an interference with individuals’ rights to privacy and data protection guaranteed by Articles 7 and 8 of the Charter, requirements of necessity and proportionality of the envisaged processing need to be assessed in accordance with Article 52(1) of the Charter . As a result, the international agreement must ensure that the limitations to rights to privacy and data protection in relation to preventing and combating crime apply only in so far as is strictly necessary .

text: 12. The EDPS has already had the opportunity to comment on similar exchanges of personal data, in particular between Europol and the law enforcement authorities of 8 of the envisaged 10 third countries on the basis of

text: Article 25(1)

text: (b) of Europol Regulation, as well as on the negotiating mandate to conclude an international agreement on the exchange of personal data between Europol and New Zealand law enforcement authorities. The EDPS welcomes that the Commission has incorporated a number of the recommendations made in his Opinion 2/2018 and Opinion 1/2020, respectively, into this proposed negotiating mandate. In this context, we recommend amending Recital 4 of the draft Recommendation, according to which the ‘Commission should be able to consult the [EDPS] also during the negotiation of the agreement and, in any event, before the agreements are concluded’ so that it reads ‘the Commission should consult the [EDPS] [...]’.

text: 13. The recommendations in this Opinion are aimed at clarifying and, where necessary, further developing the safeguards and controls in the future agreements with respect to the protection of personal data. They are without prejudice to any additional recommendations that the EDPS could make on the basis of further available information and the provisions of the draft agreements. 7 | P a g e

text: 3. SPECIFIC RECOMMENDATIONS

text: 3.1. Substantive legal basis of the Council Decision

text: 14. The explanatory memorandum of the Recommendation states that it is based on

text: Article 218

text: TFEU. The preamble to the draft Council Decision refers more specifically to

text: Article 218 (3)

text: and (4) TFEU. However, the preamble does not refer to any substantive legal basis for the envisaged Agreement.

text: 15. In accordance with

text: Article 296(2)

text: TFEU and the settled case law of the CJEU , the EDPS questions the fact that the citations in the preamble to the Council Decision only refer to the appropriate procedural legal basis and do not equally refer to the relevant substantive legal basis. The EDPS recalls that, in a similar law enforcement context, the CJEU found that “the Council Decision on the conclusion of the envisaged Agreement [between Canada and the European Union on the transfer and processing of Passenger Name Record] data must be based jointly on

text: Article 16(2)

text: and

text: Article 87(2)

text: (a) TFEU” .

text: 16. According to the negotiating directive, the Commission should simultaneously pursue several objectives during the negotiations of the envisaged agreements, among which allowing the transfer of personal data and ensure respect for the fundamental rights enshrined in the Charter, including the rights to privacy and the protection of personal data. The envisaged agreements would thus relate directly to the objective pursued by

text: Article 16

text: TFEU. Therefore, the EDPS recommends adding in the preamble of the Council Decision a reference to the appropriate substantive legal bases for the future agreements, which should include

text: Article 16

text: TFEU. 3.2. Necessity and proportionality

text: 17. EDPS welcomes that the Explanatory Memorandum specifies the political context in each third country in question, including its relations with the EU, and the operational needs supporting an enhanced cooperation between each third country and Eurojust. On this basis, directive 2 in the Annex specifies some of the purposes of the transfer of personal data by Eurojust to the third country in question. Furthermore, it states that the Agreements shall specify their scope and the purposes for which Eurojust may transfer data to the competent authorities of the third countries concerned.

text: 18. The necessity and proportionality of the international agreements envisaged to allow Eurojust to regularly transfer data to the competent authorities of the ten third countries in question needs to be fully assessed to ensure compliance with Article 52(1) of the Charter. To ensure such an in depth assessment on a case-by-case basis, the EDPS recommends to the Commission to further narrow down and differentiate the needs for transfers based on the particular situation of each third country and the reality on the ground. Moreover, the ten third countries are very different one from another as far as level of development of the data protection system is concerned. Therefore, the scope of each international agreement and the purposes for transfers to each third country should be further specified accordingly in the Annex. To this end, the EDPS recommends carrying out impact assessments to better assess the risks posed by 8 | P a g e transfers of data to these third countries for individuals’ rights to privacy and data protection, but also for other fundamental rights and freedoms protected by the Charter, in order to define the precise safeguards necessary for every single country. In this context, the safeguards in the Annex should be considered as the minimum standards which could be further developed based on the specific situation of each third country. 3.3. Involvement of the supervisory authorities in the monitoring and evaluation

text: 19. The monitoring and the periodic evaluation of the future Agreements, foreseen in directive 5 of the Annex to the Recommendation, is an important guarantee for their effective implemenation in practice and of the required level of protection of fundamental rights and freedoms To this end, the EDPS recommends that the independent supervisory authorities of the EU and of the respective third countries are fully involved in this monitoring and evaluation.

text: 4. CONCLUSIONS

text: 20. Transfers of personal data gathered in the context of criminal investigations envisaged under the Agreement are liable to have a significant impact on the lives of the individuals concerned, as they would potentially be used in prosecution cases in the receiving country under its national law. Therefore, the international agreements must ensure that the limitations to the rights to privacy and data protection in relation to the fight against crime apply only in so far as is strictly necessary.

text: 21. The EDPS welcomes the objective of the negotiation mandate to ensure respect for the fundamental rights and observe the principles recognised by the Charter, in particular the right to private and family life, recognised in Article 7 of the Charter, the right to the protection of personal data in Article 8 of the Charter and the right to effective remedy and fair trial in Article 47 of the Charter. Moreover, the EDPS appreciates the fact that Commission has incorporated into the proposed negotiating mandate a number of the specific recommendations already expressed by the EDPS in his Opinion 2/2018 on eight negotiating mandates to conclude international agreements allowing the exchange of data between Europol and third countries and Opinion 1/2020 on the negotiating mandate to conclude an international agreement on the exchange of personal data between Europol and New Zealand law enforcement authorities.

text: 22. The EDPS, however, wishes to reiterate that the Council Decision authorising opening of negotiations pursuant to

text: Article 218

text: TFEU should contain a reference not only to the procedural legal basis but also to the relevant substantive legal basis, which should include

text: Article 16

text: TFEU. The scope of each international agreement and the purposes for transfers to each third country should be further specified accordingly in the Annex to the Recommendation. The EDPS recommends further carrying out impact 9 | P a g e assessments to better assess the risks posed by transfers of data to these third countries for individuals’ rights to privacy and data protection, but also for other fundamental rights and freedoms protected by the Charter, in order to define the precise safeguards necessary. In addition, the EDPS believes that the respective supervisory authorities of the EU and of the respective third countries should be involved in the monitoring and periodic evaluation of the Agreements.

text: 23. The EDPS remains at the disposal of the Commission, the Council and the European Parliament to provide advice at further stages of this process. The comments in this Opinion are without prejudice to any additional comments that the EDPS could make as further issues may arise and would then be addressed once further information is available. To this end, the EDPS expects to be consulted later on the provisions of the draft Agreements before their finalisation. Brussels, 17 December 2020 Wojciech Rafał WIEWIÓROWSKI (e-signed) 10 | P a g e

text: Notes

text: 11 | P a g e


text: OJ L 295, 21.11.2018, p. 39. 2 COM(2022) 174 final, p. 1.

text: 1.The EDPS was consulted on the

text: Regulation (EU) No 1308/2013

text: and adopted his Opinion on 14 December 2011 . 4

text: COM(2022) 174 final, p. 2. 5 See in particular Recital 11 of the Proposal. See Chapter 2 of the Proposal. 7 See Chapter 3 of the Proposal. 8

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (Text with EEA relevance) (OJ L 119, 4.5.2016, p. 1–88). 5

text: See EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: , 7 November 2019, p. 11. See also judgment of Court of Justice of the European Union of 5 June 2018, Wirtschaftsakademie Schleswig-Holstein, C- 210/16, ECLI:EU:C:2018:388, paragraph 29. 10 Article 15(8) of the Proposal. 11

text: Article 26(1)

text: and (2) of the Proposal. 12 Article 26(8) of the Proposal. 6

identifier: EDPS yttrande 10/2022

title: Regulation of the European Parliament and of the Council on geographical indication protection for craft and industrial products and amending Regulations of the European Parliament and of the Council and Council Decision

text: 02 June 2022

text: Opinion 10/2022

text: on the Proposal for Regulation on geographical indication protection for craft and industrial products

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’ and under article 57(1)(g), the EDPS shall ‘advise on his or her own initiative or on request, all Union institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the EDPS' mission to advise the EU institutions on coherently and consistently applying the EU data protection principles. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: Executive Summary

text: (EU) 2017/1001

text: and

text: (EU) 2019/1753

text: and

text: Council Decision (EU) 2019/1754

text: (hereafter ‘the Proposal’).

text: This proposal aims to complement the EU protection system for geographical indications, which already exist for agricultural products and foodstuffs, wines and spirits, and at enabling the effective fulfilment of obligations stemming from the EU accession to the Geneva Act of the Lisbon Agreement.

text: The EDPS positively notes that the Proposal determines the roles of the Commission, the EUIPO and the competent authorities of Member States with regard to the processing of personal data in the procedures under this Proposal.

text: The EDPS recommends clarifying whether the different controllers involved in the processing of personal data will act as joint controllers or not. If so, the EDPS recommends to provide for an arrangement as envisaged by

text: Articles 28

text: EUDPR and/or

text: Article 26

text: GDPR. In this regard, the EDPS recalls that detailed arrangements to ensure compliance with data protection requirements, where necessary, may also be defined by way of an implementing act.

text: The EDPS notes that the Proposal foresees the creation of a publicly accessible electronic register of geographical indications for craft and industrial products. In this regard, the EDPS recommends a clear delineation of the categories of data which will be processed. The EDPS recommends to specify in the Proposal itself any categories of personal data involved. Finally, the EDPS considers that the chosen data retention period for the documentation related to the cancellation of geographical indications should be further justified.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 13 April 2022, the European Commission adopted a Proposal for a Regulation on geographical indication protection for craft and industrial products and amending Regulations

text: (EU) 2017/1001

text: and

text: (EU) 2019/1753

text: Council Decision (EU) 2019/1754

text: ( ‘the Proposal’).

text: 2. The objective of the Proposal is to establish a directly applicable geographical indication (‘GI’) protection for craft and industrial (‘CI’) products at EU level. It also aims to ensure that producers can benefit from the international framework for the registration and protection of GIs ('Lisbon system') .

text: 3. The Proposal complements existing EU protection for GIs in the agricultural domain. It follows similar approaches taken on the eligibility conditions and the protection of GIs for agricultural products and foodstuffs, wines and spirits as set out in: -

text: Regulation (EU) No 1151/2012

text: of the European Parliament and of the Council on quality schemes for agricultural products and foodstuffs, -

text: Regulation (EU) 2019/787

text: of the European Parliament and of the Council on the definition, description, presentation and labelling of spirit drinks, and -

text: Regulation (EU) No 1308/2013

text: of the European Parliament establishing a common organisation of the markets in agricultural products .

text: 4. The Proposal would amend

text: Regulation (EU) 2017/1001

text: on the European Parliament and of the Council on the European Union trade mark concerning possible conflicts between GIs and trade marks and specify additional tasks for the European Union Intellectual Property Office (‘EUIPO’). It also proposes an amendment to

text: Council Decision (EU) 2019/1754

text: on the accession of the European Union to the Geneva Act of the Lisbon Agreement on Appellations of Origin and Geographical Indications, in order to establish a connection between the EU GI protection system for CI products and the Lisbon system .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 13 April 2022, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 63 of the Proposal. The comments and recommendations in this Opinion are limited to the provisions in the Proposal that are most relevant from a data protection perspective.

text: 2. General Comments

text: 6. The establishment of a directly applicable GI protection for CI products at Union level implies the processing of personal data, in particular where it is necessary to identify individuals in the course of the procedures for registration, approval of amendments, cancellation, opposition, granting of transitional periods and control .

text: 7. The registration procedure consists in a ‘two-stage system’, with a first stage at the level of Member States , where national authorities would play a first examination role over agreed product specifications and GI applications. The second stage would be at EU level , with the EUIPO in charge of the Union level registration and acting as competent authority under the Geneva Act.

text: 8. The EDPS welcomes the reference to the right to protection of personal data in Recitals 10 and 11, as well as the need for the Member States to comply with

text: Regulation (EU) 2016/679

text: (‘GDPR’) , and for the Commission and the EUIPO to comply with the EUDPR.

text: 3. Specific Comments

text: 3.1 Determination of roles and responsibilities

text: 9. The EDPS positively notes that Article 4 of the Proposal determines the roles of the Commission, the EUIPO and the competent authorities of Member States under EU data protection law.

text: Article 4(1)

text: designates the Commission and the EUIPO as ‘controllers’ within the meaning of Article 3(9) of the EUDPR and the competent authorities of Member States as ‘controllers’ within the meaning of Article 4(7) of the GDPR. Each entity shall be considered a controller in relation to the processing of personal data in the procedures for which they would be competent in accordance with the Proposal.

text: 10. The EDPS recalls that the concepts of controller, joint controller and processor play a crucial role in the application of data protection law, since they determine who shall be responsible for compliance with different data protection rules, and how data subjects can exercise their rights in practice.

text: 11. In line with

text: Articles 28

text: EUDPR and 26 GDPR, where two or more controllers together determine the purposes and means of the processing, they shall be joint controllers. This specification makes it clear that the concept of controllership does not necessarily refer to one single entity, but can also involve multiple parties playing a role in a processing operation. As a result, and as confirmed by the CJEU, each of the actors involved have obligations under data protection law . Insofar as the various actors act as joint controllers, they ‘shall in transparent manner determine their respective responsibilities for compliance with their data protection obligations, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information (...)’. In case of joint controllers, the distribution of tasks between them has to be specified by means of an arrangement between them.

text: 12. The EDPS recommends clarifying in the Proposal whether controllers mentioned in Article 4 of the Proposal should be considered as ‘joint controllers’ or not. If so, the EDPS recommends to provide for an arrangement as envisaged by

text: Articles 28

text: EUDPR and/or

text: Article 26

text: 13. A further clarification of the roles may be particularly relevant in relation to the ‘direct registration’ procedure foreseen in Article 15 of the Proposal, where applications from a producer group of a Member State for registration, cancellation or amendment of a product specification of a geographical indication can be addressed directly to the EUIPO. In such cases, the Member State may be requested by the EUIPO to provide assistance ‘in particular for the examination process’ .

text: 3.2 The Union register of geographical indications for craft and industrial products

text: 14. The EDPS notes that a publicly accessible electronic Union register of geographical indications for craft and industrial products shall be developed, kept and maintained by the EUIPO. According to the Proposal, the registered name and the class of the product, as well as the reference to the instrument registering the name and the indication of the country or countries of origin shall be registered . The Commission may also adopt implementing acts defining the content and presentation of the register . However, the EDPS recommends to further specify in the Proposal itself the different categories of data that the Union register will contain as well as the purposes for the processing of personal data. Given potential data protection implications, the EDPS recalls the need to be consulted on such implementing acts.

text: 15. Article 26(7) of the Proposal provides for the retention of documentation related to the registration of geographical indications for the period of validity of the geographical indication and, in case of cancellation, for 10 years thereafter. The EDPS recalls that pursuant to storage limitation principle, personal data can be kept ‘for no longer than is necessary for the purposes for which the personal data are processed’. The EDPS considers that a justification is needed to substantiate the proportionality of the chosen retention period, in particular as regards the retention of documentation related to the cancellation of the registration in respect of GIs. Absent further justification, the envisaged retention period of 10 years does not seem to comply with the requirement of storage limitation insofar as the processing of personal data is concerned.

text: 4. Conclusion

text: 16. In light of the above, the EDPS:  welcomes the explicit designation of controllers in relation to the processing of personal data in the procedures laid down by the Proposal;  recommends clarifying whether or not the controllers should be considered as ‘joint controllers’ within the meaning of

text: Articles 28

text: EUDPR and 26 GDPR;  recommends to specify in the Proposal any categories of data to be included in the Union register of geographical indications for craft and industrial products;  considers that the proposed retention period for documentation related to the cancellation of GIs registration should be further justified or reduced insofar as it concerns personal data. Brussels, 02 June 2022 Wojciech Rafał Wiewiórowski (e-signed) 7