text: Article 42 of Regulation (EU) 2018/1725

text: requires the EDPS to be consulted on proposals for legislative and other acts with an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data. The purpose of this guidance is to offer practical advice to the Commission, European Parliament and Council on the main elements to consider with regards to legislative proposals and other acts that imply the processing of personal data. Any legislative measure that implies the processing of personal data must comply with the Charter of Fundamental Rights of the European Union, including the right to respect for private and family life and the right to protection of personal data. The measure must be clear, precise and foreseeable and should ensure effective protection of personal data against the risk of misuse. Where the interference is serious, there is a greater need for clear and precise rules governing the scope and application of the measure as well as accompanying safeguards. When considering a proposal for a legislative or other act that would entail the processing of personal data, the following key elements should be carefully considered: • whether the proposal defines the objective(s) and the purpose(s) of the processing in a manner that is specific, explicit and legitimate; • whether the roles and responsibilities of actors involved in the processing of personal data are clearly defined; • whether the necessity and proportionality of the proposed measures is clearly demonstrated; • whether the categories of personal data that would be processed and the categories of data subjects concerned are clearly delineated; • whether the duration for which personal data would be processed is specified or easily ascertainable; • whether any disclosure of personal data to public authorities or third parties is envisaged; and • whether the proposal would entail a restriction to the rights of data subjects. The EDPS considers that decisions on essential principles and modalities that impact fundamental rights should in principle be taken at the level of legislative proposals (“basic acts”) so as to ensure that such decisions are taken within a full legislative procedure. For legislative proposals that do not give rise to a serious interference, the EDPS considers that certain elements, such as the categories of personal data, categories of data subjects concerned and storage duration can be defined either at the level of the basic act or (further) specified at the implementation stage through implementing and/or delegated acts. The guidance included in this document is indicative of the approach taken by the EDPS in the majority of cases, having regard to his advisory practice to date. For this reason, the guidance should not be applied in a formalistic manner, but rather used as a tool to help ensure that a legislative measure meets the conditions of Article 52 of the Charter. In any event, a case-by-case assessment remains necessary and different approaches may be called for in light of the specific subject matter or nature of the proposal. Finally, it should be noted that the guidance applies specifically to opinions and formal comments delivered by the EDPS to the co-legislator and the Commission prior to the final adoption of legislative acts or delegated or implementing acts. It incorporates policy considerations and should not be considered as a checklist for supervisory purposes, i.e. when the EDPS exercises his powers pursuant to

text: Article 58 of Regulation (EU) 2018/1725

text: 4 (iv) are necessary and proportionate .

text: Article 7

text: generally corresponds to Article 8 of the European Convention on Human Rights (ECHR).

text: With regard to the fundamental rights to privacy and data protection, see for example judgment of 8 April 2014, Digital Rights Ireland and Seitlinger and others ,

text: and

text: , EU:C:2014:238.

text: Article 52(1)

text: follows Article 8(2) of the ECHR which establishes that there shall be no interference by a public authority with the exercise of the right to privacy except such as is in accordance with the law and if necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others. See also the EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data, and the EDPS Necessity toolkit on assessing the necessity of measures that limit the fundamental right to the protection of personal data.

text: See for instance, judgment of 9 November 2010, Volker und Markus Schecke and Eifert,

text: and

text: , EU:C:2010:662, par. 55-64 and judgment of 24 November 2011, Joined Cases Asociación Nacional de Establecimientos Financieros de Crédito (ASNEF) and Federación de Comercio Electrónico y Marketing Directo,

text: and

text: , EU:C:2011:777, par. 41-42. The CJEU held only in one case that there was no limitation on the right to private life when the personal data related to salaries were processed by the employers for their original purpose, see judgment of 20 May 2003, Österreichischer Rundfunk and others,

text: and

text: , EU:C:2003:294, par. 74.

text: See Österreichischer Rundfunk , note 5, par. 75 and Digital Rights Ireland, note 2, par. 33; EDPS, Assessing the necessity of measures that limit the fundamental right to the protection of personal data: A Toolkit, p.7 Article 4(1) of the GDPR-An ‘identifiable’ natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier (e.g., an identification number, location data, an online identifier) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. The CJEU has clarified that the use of the expression ‘any information’ in the definition of the concept of ‘personal data’ reflects the aim of the EU legislature to assign a wide scope to that concept, which potentially encompasses all kinds of information, not only objective but also subjective, in the form of opinions and assessments, provided that it ‘relates’ to the data subject. Information relates to an identified or identifiable natural person where, by reason of its content, purpose or effect, it is linked to an identifiable person. See for instance, judgment of 4 May 2023, Österreichische Datenschutzbehörde and CRIF,

text: , EU:C:2023:369, par. 23 and 24, judgment of 7 March 2024, OC/Commission,

text: P, ECLI:EU:C:2024:215, paragraph 45; judgment of 9 November 2023, Gesamtverband Autoteile-Handel,

text: , ECLI:EU:C:2023:837, para 45; judgment of 7 March 2024, IAB Europe,

text: , ECLI:EU:C:2024:214, para 37. See also

text: Article 29

text: Data Protection Working Party, Opinion 4/2007 on the concept of personal data.

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (OJ L 295, 21.11.2018, p. 39.).

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89). Directive

text: of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ L 201, 31.7.2002, p. 37). See CJEU judgment of 13 May 2014, Google Spain and Google, ECLI:EU:C:2014:317, para 68-69. For a discussion of a particular role that Article 16 of the TFEU, and by extension the GDPR, play in the EU legal order, see Advocate General Szpunar Opinion in Case C- 33/22 Österreichische Datenschutzbehörde, at para. 63 et seq. Article 6(3) of the GDPR;

text: Article 5(2)

text: of the EUDPR and Article 8(1) of the LED. See also Recital 41 of the GDPR and Recital of the 23 of the EUDPR. These provisions complement the requirements of Article 7 and 8 of the Charter, as interpreted by the CJEU, according to which any interference must be provided for by law which is clear, precise and foreseeable.

text: See judgment of 6 October 2015, Schrems,

text: , ECLI:EU:C:2015:650, para. 91.

text: For more information see also section 6.

text: Judgment of 1 August 2022, Vyriausioji tarnybinės etikos komisija,

text: , EU:C:2022:601, par. 98. See further Section 5.

text: Judgment of 24 September 2019, GC and Others,

text: , EU:C:2019:773, par. 44; judgment of 25 January 2018, Bevándorlási és Állampolgársági Hivatal,

text: ; EU:C:2018:36, par. 59-63; judgment of 22 June 2021, Latvijas Republikas Saeima,

text: , EU:C:2021:504, par. 74-75.

text: Judgment of 11 December 2019, Asociaţia de Proprietari bloc M5A-ScaraA,

text: , EU:C:2019:1064, par. 57-63; Vyriausioji tarnybinės etikos komisija, note 17, par. 99.

text: Vyriausioji tarnybinės etikos komisija, note 17, par. 99.

text: Judgment of 2 October 2018, Ministerio Fiscal,

text: , EU:C:2018:788, par. 54-61; judgment of 21 December 2016, Joined Cases Tele2 Sverige and Watson and Others,

text: and

text: , EU:C:2016:970, par. 99; judgment of 5 April 2022, Commissioner of An Garda Síochána e.a,

text: ; EU:C:2022:258, par. 44-45; Google Spain and Google, note 12, par. 80; Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592, par. 128.

text: Tele2 Sverige and Watson and Others, note 21 and Digital Rights Ireland, note 2.

text: Digital Rights Ireland, note 2, and judgment of 6 October 2020, Joined Cases La Quadrature du Net and Others,

text: and

text: , EU:C:2020:791.

text: Digital Rights Ireland, note 2.

text: Google Spain and Google, note 12; Vyriausioji tarnybinės etikos komisija, note 17, par. 99-105.

text: La Quadrature du Net and Others,, note 23.

text: See Opinion 1/15 (EU-Canada PNR Agreement), note 21, and judgment of 21 June 2022, Ligue des droits humains,

text: Case C-817/19

text: , EU:C:2022:491, par. 194-195.

text: See

text: Article 29

text: Data Protection Working Party, Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679, p. 9-11.

text: In other words : while every legislative measure constituting a “serious interference” with the right to the protection of personal data also has an “impact” on the protection of individuals’ rights and freedoms with regard to the processing of personal data, the opposite is not always true. A legislative measure may have an impact on the protection of individuals rights and freedoms with regard to the processing of personal data (e.g., by providing for an exchange of information between competent authorities), without constituting a serious interference with the rights of the individuals concerned (e.g., by only enabling the exchange of a very limited set of personal data which is not sensitive in nature, among a limited number of authorities).

text: This is the so-called purpose limitation principle, currently set out in

text: Article 5(1)

text: (b) of the GDPR;

text: Article 4(1)

text: (b) of the EUDPR and

text: Article 4(1)

text: (b) of the LED. See also Article 72(2) of the EUDPR, which requires that “Specific Union legal acts regulating processing within the scope of this Chapter shall specify at least the objectives of processing, (…) the purposes of the processing (…).” Similarly, Article 8(2) of the LED specifies that “Member State law regulating processing within the scope of this Directive shall specify at least the objectives

text: of processing, (…) and the purposes of the processing.”

text: See

text: Article 29

text: Data Protection Working Party, Opinion 03/2013 on purpose limitation, p. 15.

text: Idem.

text: See also judgment of 26 January 2023, V.S.,

text: , ECLI:EU:C:2023:49, para. 124.

text: See

text: Article 29

text: Data Protection Working Party, Opinion 03/2013 on purpose limitation, p. 16.

text: For example by using wording: “personal data collected ... shall be processed for the purpose of ...” or similar wording to this effect.

text: Article 6(3) of the GDPR explicitly states that when the processing of personal data is necessary for compliance with a legal obligation to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, the purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of par. 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. See also judgment of 24 February 2022, Valsts ieņēmumu dienests,

text: , EU:C:2022:124, par. 69.

text: When assessing whether the processing envisaged by a draft implementing act is sufficiently supported by the basic act, one should also take into account the nature of the interference with the rights to data protection and privacy. If the interference is serious, the scope and application of the measure (as well as the accompanying measures) should have already been clearly provided for in the basic act.

text: EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: (hereinafter the EDPS GLS on C/P) and EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR (hereinafter the EDPB GLS on C/P). The LED contains the same distinction. However, no guidelines are available to date.

text: Under the GDPR, the “entity” can be a “natural or legal person, public authority, agency or other body” (Article 4(7) of the GDPR). Under the EUDPR, an entity can be “Union institution or body or the directorate-general or any other organisational entity” (Article 3(8) of the EUDPR). Article 3(10) of the EUDPR defines Union institutions and bodies as “the Union institutions, bodies, offices and agencies set up by, or on the basis of, the TEU, the TFEU or the Euratom Treaty”. Under the LED, a “controller” shall be a “competent authority” (

text: Article 3(8)

text: , as defined by Article 3 (7) of the LED.

text: EDPS GLS on C/P, p. 8.

text: Where it is not possible to do so (e.g., the basic act has already been adopted), the designation can also be done by way of an implementing or delegated act.

text: See in particular at pages 27 and 28 of EDPS GLS on C/P and par. 162 onwards of EDPB GLS on C/P.

text: It should be recalled that the obligation for joint controllers to put in place an arrangement in any event exists by virtue of direct applicability of the GDPR, the EUDPR or the LED, so including an empowering provision is not a legal requirement and may not be appropriate in all cases.

text: See further also at page 19 of the EDPS GLS on C/P and par. 113 onwards of EDPB GLS on C/P.

text: It should be recalled that the obligation to put in place a contract or legal act that is binding on the processor with regard to the controller in any event exists by virtue of direct applicability of the GDPR, the EUDPR or the LED, so including an empowering provision is not a legal requirement and may not be appropriate in all cases.

text: According to Article 52(3) of the Charter, the rights contained therein which correspond to rights guaranteed by the ECHR are to have the same meaning and scope as those laid down by that Convention. Consequently, as recalled by the CJEU in La Quadrature du Net and others, note 23, par. 124, the jurisprudence of the European Court of Human Rights (ECtHR) concerning rights which are also foreseen in the Charter must be taken into account, as a minimum threshold of protection to interpret corresponding rights in the Charter. According to the last sentence of Article 52(3) of the Charter, however, “[t]his provision shall not prevent Union law providing more extensive protection”.

text: See however also the judgment of 22 June 2021, Latvijas Republikas Saeima,

text: , EU:C:2021:504, par. 114 (where for the Court it is even questionable whether the legislation at issue in the main proceedings is appropriate for achieving the aim it pursues).

text: Vyriausioji tarnybinės etikos komisija, note 17, par. 85. Establishing necessity implies establishing the “suitability” of the envisaged measure: if the measure cannot be considered as reasonably effective to achieve its objective, it also cannot be considered as necessary.

text: Judgment of 16 December 2008, Satakunnan Markkinapörssi and Satamedia,

text: , EU:C:2008:727, par. 56, Volker und Markus Schecke, note 5, par. 77 and 86. Within these constraints, the EU legislator remains free to make political choices. However, judicial review of any exercise of that discretion is likely to be particularly strict in the context of mass data processing affecting a very large number of persons, as well as the access to and use of such data by law enforcement authorities. See in particular, Digital Rights Ireland, note 2, par. 57-61, Tele2 Sverige and Watson and others, note 21, judgment of 6 October 2020, Privacy International, C-623-17, EU:C:2020:790, La Quadrature du net and others, note 23 and Commissioner of An Garda Síochána, note 21, par.52.

text: See also Commissioner of An Garda Síochána, note 21, par. 52-53 and La Quadrature du Net and others, note 23, par. 130 -131.

text: Vyriausioji tarnybinės etikos komisija, note 17, par. 98 and following. See also section 2 above.

text: Privacy International, note 54, par 68.

text: Idem.

text: Volker und Markus Schecke, note 5, par. 81.

text: See for example Ligue des droits humains, note 27, par. 194-195, regarding the possible implications of the use of artificial intelligence in the context of Passenger Name Record (PNR) matching.

text: For instance, in the area of law enforcement, the CJEU stated in Ministerio Fiscal, note 21, par. 56-61, that, in accordance with the principle of proportionality, serious interference can be justified, in areas of prevention, investigation, detection and prosecution of criminal offences, only by the objective of fighting crime which must also be defined as “serious”.

text: See for instance Article 72 (2) of the EUDPR, which requires that “Specific Union legal acts regulating processing within the scope of this Chapter shall specify at least the (…) operational personal data to be processed, (…).”Similarly, Article 8(2) of the LED specifies that “Member State law regulating processing within the scope of this Directive shall specify at least the (…) personal data to be processed, (…).” Conversely, there may be circumstances in which it may not be necessary or appropriate to specify the categories of personal data in detail, for example in cases where a competent authority should be able to request and access any information necessary to an assess an infringement, based on its tasks carried out in the public interest. See e.g. judgment of 24 May 2023,

text: , Meta Platforms Ireland Ltd, ECLI:EU:T:2023:277 in the field of competition law and Valsts ieņēmumu dienests, note 36 in the field of VAT. In such cases, however, the proposal should still lay down clear and precise rules so that the persons whose personal data are affected have sufficient guarantees that those data will be effectively protected against the risk of abuse. In particular, the proposal should indicate in what circumstances and under which conditions a measure providing for the processing of such data may be adopted by the competent authority, thereby ensuring that the interference is limited to what is strictly necessary (

text: , paragraph 83). In cases where the proposal would give rise to a serious interference, however, a clear specification of the categories of personal data may be necessary to ensure compliance with the principles of necessity and proportionality.

text: In the same vein, it may not be possible to provide for a detailed categorisation of each category of personal data in cases where the proposal would impose the adoption of technical measures that must be able to evolve in light of the state of the art, such as cybersecurity tools or tools to prevent or detect security incidents. In such cases, it may be sufficient to outline the categories of data in more broad terms (e.g., network data, metadata, logs, content data, etc.), provided that the proposal still complies with the overarching requirement of foreseeability and contains sufficient safeguards to ensure that the processing of personal data would remain limited to what is strictly necessary and individuals are effectively protected against risks of misuse.

text: Article 4(1)

text: (e) of the EUDPR;

text: Article 5(1)

text: (e) of the GDPR and Article (4)(1)(e) of the LED. Article 72 (2) of the EUDPR explicitly requires that “Specific Union legal acts regulating processing within the scope of this Chapter shall specify at least the (…) time limits for storage of the operational personal data or for periodic review of the need for further storage of the operational personal data.” Article 5 of the LED explicitly requires Member States to provide for appropriate time limits to be established for the erasure of personal data or for a periodic review of the need for the storage of personal data. See also

text: Article 25(2)

text: (f) of the EUDPR and

text: Article 23(2)

text: (f) of the GDPR.

text: Digital Rights Ireland, note 2, par. 64.

text: Digital Rights Ireland, note 2, par. 63.

text: In the EDPS Opinion on the Commission proposal for a Directive of the European Parliament and of the Council amending Directive

text: on the recognition of professional qualifications and Regulation […] on administrative cooperation through the Internal Market Information System, the EDPS stated that “[t]he proposed reference to deletion when ‘no longer required’ is helpful but — in our view — not sufficient to ensure consistency and legal certainty. The EDPS therefore recommends that the Proposal specify a sufficiently short retention period for the information exchanged.” (par. 39) “Alternatively, if legislators opt for ‘long-term’ storage in the IMI-file of the prohibition, the EDPS recommends that the Proposal should, at a minimum, clearly require that the issuing authority deletes any reference to the prohibition once the prohibition is no longer in effect (for instance, as the result of an appeal or because the prohibition was limited in time).” (par. 41).

text: As regards Article 8 of the ECHR, see judgement of 26 March 1987, Leander v. Sweden, no. 9248/81, CE:ECHR:1987:0326JUD000924881, par. 48; judgement of 4 May 2000, Rotaru v. Romania [GC], no. 28341/95, CE:ECHR:2000:0504JUD002834195, par. 46 and judgement of 29 June 2006, Weber and Saravia v. Germany no. 54934/00, CE:ECHR:2006:0629DEC005493400, par. 79. For Article 7 of the Charter, see CJEU, Digital Rights Ireland, note 2, par. 35.

text: The legislation providing for the exchange or communication of data may be the one on which the third parties base themselves to process the data in question.

text: It is not excluded, however, that an implementing or delegated act identifies more specially the relevant entities to whom the personal data shall be disclosed, provided the disclosure is authorised by the basic act (e.g., the basic act makes reference to “the competent authority in the Member States” and the implementing or delegated act establishes a list of the specific authorities in question).

text: Tele2 Sverige and Watson and others, note 21, par. 119 and the case law cited.

text: Digital Rights Ireland, note 2 and Valsts ieņēmumu dienests, note 36, par. 83-84.

text: See for example

text: Article 65 of Regulation (EU) 2018/1862

text: (SIS),

text: Article 31 of Regulation (EC) No 767/2008

text: (VIS),

text: Article 41 of Regulation (EU) 2017/2226

text: (EES),

text: Article 65 of Regulation (EU) 2018/1240

text: (ETIAS) and others.

text: Valsts ieņēmumu dienests, note 36, par. 52 onwards, in relation to the GDPR.

text: Additional information on implementing and delegated acts can be found at https://webgate.ec.europa.eu/fpfis/wikis/pages/viewpage.action?spaceKey=REGISTRY&title=Comitology. See also ‘Understanding delegated and implementing acts’, EPRS briefing, July 2021.

text: Judgment of 11 May 2017, Dyson/Commission,

text: P, EU:C:2017:357, par. 61.

text: Judgment of 5 September 2012, Parliament/Council,

text: , EU:C:2012:516, par. 64, 65 and 76; judgment of 26 July 2017, Czech Republic/Commission,

text: P, EU:C:2017:595, par. 78; Dyson/Commission, note 78, par. 61 and 62.

text: Dyson/Commission, note 78, par. 65. See also Council Non-Binding Criteria for the application of Articles 290 and 291 of the Treaty on the Functioning of the European Union — 18 June 2019.

text: Recital 41 of the GDPR. On the notion of “provided for by law” under Article 52(1) of the of the Charter, the criteria developed by the ECtHR should be used as suggested in several CJEU Advocates General Opinions, see for example the Opinions in Tele2 Sverige and Watson and Others, Joined Cases

text: and

text: , EU:C:2016:572, par. 137-154 and the Opinion of Advocate General of 14 April 2022, Scarlet Extended,

text: , EU:C:2011:255, par. 88- 114. Hence, reference can be made, among others, to the ECtHR ruling in Weber and Saravia v Germany, note 70, par. 84: “The Court reiterates that the expression “in accordance with the law” within the

text: meaning of

text: Article 8

text: § 2 [of the ECHR] requires, firstly, that the impugned measure should have some basis in domestic law; it also refers to the quality of the law in question, requiring that it should be accessible to the person concerned, who must, moreover, be able to foresee its consequences for him, and compatible with the rule of law.” See also judgment of 27 April 2022 from the General Court, Robert Roos v. European Parliament, Joined Cases

text: et

text: , EU:T:2022:262, par. 64 onwards.

text: Opinion of the European Data Protection Supervisor on the Communication from the Commission on an Action Plan for the Deployment of Intelligent Transport Systems in Europe and the accompanying proposal for a Directive of the European Parliament and of the Council laying down the framework for the deployment of Intelligent Transport Systems in the field of road transport and for interfaces with other transport modes, par. 24.

text: Needless to say, nothing prevents the legislator from introducing all the requisite safeguards in the basic act itself, even if the interference is not serious.

text: As a result, empowerment provisions should in principle not extend to purely administrative decisions (e.g. decisions to be adopted by the board of directors of an EUI acting as controller).

text: See Digital Rights Ireland and Seitlinger and Others, note 2; Ligue des droits humains, note 27 and judgment of 22 November 2022,

text: and

text: , Luxembourg Business Registers, ECLI:EU:C:2022:912.

text: For example, the identification of which specific public body shall act as controller can in principle be left to Member States as part of the transposition of a Directive in situations where there is a specific need to allow for flexibility during the implementation in this regard.

text: See section 5.1.

identifier: EDPS riktlinjer (2025)

publisher: Europeiska datatillsynsmannen

sprak: en

title: Guidance for co-legislators on key elements of legislative Proposals

serie: riktlinjer

text: 07 May 2025

type: rubrik

text: Guidance for co-legislators on key elements of legislative proposals

type: stycke

text: EXECUTIVE SUMMARY

text: 1. Introduction

text: 1. A proposed legislative or other measure that implies the processing of personal data must comply with primary EU law, and in particular with Articles 7 (respect for private and family life ) and Article 8 (protection of personal data) of the Charter of Fundamental Rights of the European Union (“Charter”).

text: 2. Personal data may only be processed, by the State or any other actor, if the standards set out in paragraphs 2 and 3 of Article 8 of the Charter are met, i.e. (i) the processing is fair and lawful, for specified purposes; (ii) transparency is ensured by giving the individuals rights to access and rectification; and (iii) control by an independent authority is ensured.

text: 3. Both Articles 7 and 8 of the Charter must be read in conjunction with Article 52(1) of the Charter , which allows limitations to fundamental rights, provided that such limitations: (i) be provided for by law; (ii) respect the “essence” of the right(s); (iii) genuinely meet objectives of general interest recognised by the EU or the need to protect the rights and freedoms of others; and

text: 4. The Court of Justice of the European Union (CJEU) has held, in the vast majority of cases dealing with legislative acts, that the processing of personal data limited both the right to the protection of personal data and the right for respect of private life as guaranteed by the Article 7 and 8 of the Charter . The CJEU has also held that for the establishment of a limitation “it does not matter whether the information in question relating to private life is 3 sensitive or whether the persons concerned have been inconvenienced in any way” . In this regard, it is important to recall that the concept of personal data has a wide scope, encompassing any information relating to an identified or identifiable individual .

text: 5. The requirements of Article 8 of the Charter are further reflected in various instruments of EU data protection law, in particular those adopted pursuant to Article 16 of the Treaty of the Functioning of the European Union (“TFEU”), including Regulation 2016/679 (“GDPR”), Regulation 2018/1725 (“EUDPR”),

text: Directive (EU) 2016/680

text: (“LED”) and Directive

text: (“ePrivacy Directive”). Compliance with Article 8 of the Charter should be assessed by specific reference to the system of safeguards laid down in those instruments . These are rules of general application which therefore constitute the benchmark for the legislator, and any derogations from those rules should in general be avoided or, at the very least, appropriately justified.

text: 6. Processing of personal data that is deemed necessary for the fulfillment of a legal obligation and/or for the performance of a task carried out in the public interest or in the exercise of official authority entrusted to the controller must have a legal basis in Union or Member State law .

text: 7. A legislative or other act that entails processing of personal data must first and foremost be clear and precise and its application must be foreseeable to persons subject to it . The CJEU has made clear that EU legislation involving interference with the fundamental rights guaranteed by Articles 7 and 8 of the Charter must lay down clear and precise rules 4 governing the scope and application of a measure and imposing minimum safeguards, so that the persons whose personal data are concerned have sufficient guarantees enabling their data to be effectively protected against the risk of abuse and against any unlawful access to and use of those data .

text: 8. The following sections of this guidance provide an overview of the main elements to consider with regards to a legislative or other measure that implies the processing of personal data. Each of these elements should be carefully considered by the co-legislators in the light of the conditions for lawful limitation of the rights pursuant to Article 52 of the Charter, notably the requirement for clear and precise rules and that the necessity and proportionality can be properly assessed on the basis of clear and precise rules.

text: 9. It is important to keep in mind that the guidance provided in the following sections is indicative of the approach taken by the EDPS in the majority of cases, having regard to his advisory practice to date. For this reason, the guidance should not be applied in a formalistic manner, but rather used as a tool to help ensure that a legislative measure meets the conditions of Article 52 of the Charter. In any event, a case-by-case assessment remains necessary and different approaches may be called for in light of the specific subject matter or nature of the proposal, having regard also to the seriousness of the interference that a particular legislative measures would entail.

text: 10. When addressing the main data protection elements of a legislative proposal, care should be taken not to simply repeat provisions that are already reflected in the applicable data protection legislation (e.g., by simply repeating that “personal data shall be limited to what is necessary in relation to the purposes for which they are processed”). The fact that certain instruments of EU data protection law are applicable (e.g., the GDPR, the EUDPR, the LED or the ePrivacy Directive) can and should be appropriately recalled by way of a recital. Instead, the safeguards included in the legislative proposal help operationalise the relevant data protection requirements (e.g., by specifying precisely which categories of personal data are necessary to achieve the purposes of the processing as defined by the proposal).

text: 11. Finally, when applying this guidance in practice, it is important to take into account whether the act is: (1) a basic legislative act (a Regulation or a Directive) (“basic act”) or (2) an implementing or delegated act (Commission Implementing Decision, Commission Implementing Regulation, Commission Delegated Regulation, ... ) (“implementing or delegated act”) ; or (3) a recommendation or proposal to the Council pursuant to Article 218 of the TFEU (i.e. agreements between the Union and third countries or international organisations). 5

text: 2. Assessing the seriousness of interference

text: 12. Proposals that give rise to a serious interference with the fundamental rights to data protection and privacy should be distinguished from others. Where the interference is serious, there is an even greater need for clear and precise rules governing the scope and application of the measure as well as accompanying safeguards. In other words: the greater the interference entailed by the proposed act, the most robust and detailed the rules and the safeguards should be.

text: 13. Assessing the seriousness of the interference is also an integral part of the proportionality assessment. Such an assessment involves measuring the seriousness of the interference with the fundamental rights to respect for private life and to the protection of personal data which that processing involves and then determining whether the importance of the objective of general interest pursued by the processing is proportionate to the seriousness of the interference .

text: 14. The CJEU has advanced several criteria to determine the seriousness of an interference with the right to the protection of personal data and the right for respect of private life. In particular, it has considered the following elements as relevant when qualifying an interference as (particularly) serious or significant: • Nature of the personal data at issue, in particular of any processing of special categories 18 19 of data or data which is otherwise sensitive ; • Nature of, and specific methods for, the processing of the data at issue, in particular of the number of persons having access to those data and the methods of accessing them ; • The ability to draw precise conclusions concerning the private lives of the individuals concerned (profiling) ; • The lack of awareness of the data processing on the part of the person concerned ; • The large-scale nature of the processing of personal data ; 6 • The ability to monitor individuals’ behaviour (likely to generate feeling of constant surveillance) ; • Public accessibility of the information ; • Likely adverse effect on other fundamental rights ; • Automated processing of data involving pre-established models and criteria .

text: 15. The examples above are not exhaustive and a case by case assessment remains relevant. As a rule of thumb, the criteria developed by the WP29/EDPB to determine whether the processing is “likely to result to high risk” can (also) help to assess the seriousness of the interference (e.g. processing of special categories of data or data of a highly personal nature, matching or combining of datasets, etc.) . In most cases, processing meeting two or more criteria should be considered as likely amounting to a serious interference.

text: 16. It should be noted that the concept of “seriousness of an interference” is different from the notion of “impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data”, as referred to in Article 42 of the EUDPR. The mere existence of an impact on the right to the protection of personal data does not necessarily imply the existence of a serious interference with such a right, which should be assessed in light of the specific characteristics of the proposed legislative measure .

text: 3. Objective and purpose

text: 17. The objective(s) and purpose(s) of the processing that would result from a legislative proposal should be specified, explicit and legitimate . To make sure this is the case, the following questions should be considered: • Is the objective of the proposed measure sufficiently clear? 7 • Is the purpose of the processing explicitly and specifically described in the enacting terms (operative text) of the proposal?

text: 18. Purpose specification lies at the core of EU data protection framework. A clear identification of purpose is not only required by Article 8(2) of the Charter, it is a necessary precondition to determine whether data processing complies with the law. Purpose specification sets limits on the purposes for which controllers may use the personal data collected and also helps to establish the necessary data protection safeguards .

text: 19. In order to fulfil its role, the purpose of the collection must be identified with sufficient precision: it must be detailed enough to (1) determine what kind of processing would (or would not) result from the legislative measure and (2) enable an assessment of whether the envisaged processing is necessary to achieve the objectives pursued . The degree of detail in which a purpose should be specified requires a case-by-case assessment. In some clear cases, simple language will be sufficient to provide appropriate specification, while in other cases more detail may be required . Generally speaking: the greater the interference entailed by the proposed act, the more robust and detailed the rules and the safeguards should be.

text: 20. To be considered “explicit”, the purpose of the processing should be clearly specified in the basic act, by either: • explicitly indicating the purpose of the processing as such ; or • resulting unambiguously from the explicit wording of the proposal, provided that the wording does not leave any possible doubt regarding the purpose(s) for which the personal data may be processed .

text: 21. The purposes of the processing should be established in the enacting terms (operative text) of the proposal of the basic act. It is not sufficient that the purpose of the processing is only explicitly indicated in (or results unambiguously from) the Explanatory Memorandum or recitals accompanying the enacting terms of the proposal.

text: 22. An implementing or delegated act should not introduce processing operations for a purpose which is not sufficiently supported by the basic act . Where an implementing or delegated act concerns the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, the implementing or delegated act may provide greater specificity to the purpose of the processing (and should do so if the provisions of 8 the basic act do not articulate the purpose(s) of the processing with sufficient precision). An implementing or delegated act should not, however, introduce an entirely new or unrelated purpose. Example: EDPS Opinion 1/2019 on two legislative proposals relating to combating VAT fraud The Commission’s proposals on the fight against VAT fraud in the context of “ecommerce” included recitals specifying the purpose of the processing operations envisaged by them. However, EDPS recommended specifying the purpose in the operative text of the Proposals to avoid any risk of function-creep and the use of information for other purposes, such as controlling purchase habits of the consumers.

text: 4. Roles and responsibilities

text: 4.1. Roles

text: 23. Both the GDPR and the EUDPR distinguish among different types of actors involved in the processing of personal data: controller, processor and joint controllers . These concepts provide the very basis upon which responsibility for compliance with EU data protection law is allocated. • A “controller” is any entity which, alone or jointly with others, determines the purposes and means of the processing of personal data . • Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers . • A “processor” is defined as a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller .

text: 24. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law . Although not explicitly confirmed by the GDPR, the LED or 9 the EUDPR, the EDPS considers that similar considerations apply in case of joint controllers and/or processors.

text: 25. Ensuring clarity of the role of each actor involved in the processing of personal data is important to promote transparency of processing and the effective exercise of data subject rights. Moreover it is key to enable a determination of who will be responsible for what (see further section 4.2 below). Determining the role of controller from the outset also helps to avoid any possible problems of interpretation in assessing that role .

text: 26. The EDPS recommends assigning the role of controller already in the basic act if possible . The same applies for any joint controllers or processors who may be involved in the processing (where applicable).

text: 27. When a proposal establishes a legal obligation or a task in the public interest that requires processing of personal data involving multiple actors (e.g., a proposal requiring exchange of personal data between national public authorities an EU bodies, a provision that requires setting up a common repository at EU level, etc.), the proposal should as a rule identify the roles of the entities that will be involved in the processing. The designation of an entity as controller, joint controller or processor should take place in the enacting terms (operative text) of the proposal rather than in the recitals accompanying the enacting terms of the proposal. Example: EDPS Formal comments on the Proposal for a Regulation of the European Parliament and of the Council establishing a collaboration platform to support the functioning of Joint Investigation Teams and amending

text: Regulation (EU) 2018/1726

text: . The Proposal for a Regulation establishing a collaboration platform to support the functioning of Joint Investigation Teams specified that the competent national and Union authorities shall be considered as “controllers” with regard to the processing of personal data in the platform. To avoid ambiguity, the EDPS recommended to clarify whether the identified controllers should be considered as “joint controllers” and, if so, to provide for the arrangement envisaged by Article 21 of the LED. While detailed arrangements to ensure compliance with data protection requirements may be further defined by way of an implementing act if necessary, the EDPS considered that the Proposal should in any case unambiguously identify the roles of each entity involved as controller, joint controller or processor respectively.

text: 4.2. Responsibilities

text: 28. The GDPR, the LED and the EUDPR each require controllers, joint controllers and/or processors to clearly establish their respective obligations. When a proposal establishes a legal obligation or a task in the public interest that entails processing of personal data 10 involving joint controllers and/or processors, it may be appropriate to specify the respective obligations of the entities involved, possibly by way of a delegated or implementing act. a) Joint controllers

text: 29. Joint controllers are obliged to determine the respective responsibilities for compliance with their data protection obligations by means of an arrangement between them, in particular as regards the exercising of the rights of the data subject and their respective duties.

text: 30. The arrangement between joint controllers may take the form of an implementing or delegated act, but may of course also be included in the basic act (e.g. in the form of an Annex). While detailed arrangements to ensure compliance with data protection requirements may be further defined by way of an implementing or delegated act, it may be appropriate to also include certain elements and safeguards in the basic act itself, taking into account the nature of the interference. Example: EDPS Formal comments on a Proposal for a Regulation of the European Parliament and of the Council establishing the European Union Single Window Environment for Customs and amending

text: Regulation (EU) No 952/2013

text: The Proposal for a Regulation establishing the European Union Single Window Environment for Customs and amending

text: Regulation (EU) No 952/2013

text: specified that the Commission was a joint controller within the meaning of Article 28(1) of the EUDPR and customs authorities and partner competent authorities were joint controllers within the meaning of Article 26(1) of the GDPR. The EDPS welcomed that Article 7(3) of the Proposal provided for a minimum list of responsibilities by the joint controllers to ensure that the joint processing is compliant and that implementing acts would provide for a joint controllership arrangement.

text: 31. Additional recommendations concerning the elements to be addressed by the joint controller arrangement (e.g. handling of requests and informing data subjects, management of security incidents...) can be found in the applicable EDPS and EDPB guidelines .

text: 32. If the basic act itself does not provide for a comprehensive arrangement, an empowering provision (i.e. a provision of the basic act empowering the European Commission to adopt implementing or delegated acts) may be useful . b) Processor(s)

text: 33. Where the processing is to be carried out on behalf of a controller, it shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject matter and duration 11 of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller .

text: 34. The GDPR, the LED, the EUDPR specify additional elements that must be incorporated in the legal act between the controller and processor .

text: 35. The legal act that is binding on the processor with regard to the controller may take the form of an implementing or delegated act, but may of course be part of the basic act (e.g. in the form of an Annex). If the basic act itself does not yet address all the required elements as stipulated in the GDPR, the LED or the EUDPR, and if the processing on behalf of the controller should still be regulated in a legal act as opposed to a contract, an empowering provision may be useful .

text: 5. Necessity and proportionality

text: 36. A limitation of the exercise of a fundamental right guaranteed by the Charter must, in addition to being “provided by law”, also satisfy the requirements of necessity and proportionality. The criteria provided under Article 52(1) of the Charter and

text: Article 8(2)

text: European Convention on Human Rights (“ECHR”) for a lawful limitation on the right to the respect for private life are similar in this regard .

text: 37. First, it must be established that the measure is intended to meet objectives of general interest recognised by the European Union, within the meaning of Article 52(1) of the Charter. If that is the case, it should first be determined whether the envisaged measure is appropriate, i.e. is capable of attaining the objective pursued. Very often, this is not a difficult test to pass .

text: 38. Second, the measure should be necessary to achieve these objectives. The necessity test involves determining whether the objective of general interest pursued cannot reasonably be achieved just as effectively by other means less restrictive of the fundamental rights of data subjects . In this regard, it should be noted that case law of the CJEU applies 12 a strict necessity test for any limitations on the exercise of the rights to personal data protection and respect for private life with regard to the processing of personal data .

text: 39. Once it is established that the envisaged measure may be considered as “necessary”, the next step is to assess its proportionality in the strict sense. Assessing proportionality in the strict sense involves assessing the seriousness of the interference with the fundamental rights to respect for private life and to the protection of personal data and determining whether the importance of the objective of general interest pursued by the processing is proportionate to the seriousness of the interference. An objective of general interest may not be pursued without having regard to the fact that it must be reconciled with the fundamental rights affected by the measure, by properly balancing the objective of general interest against the rights at issue .

text: 40. In order to assess the seriousness of that interference, account must be taken, inter alia, of the nature of the personal data at issue, in particular of any sensitivity of those data, and of the nature of, and specific methods for, the processing of the data at issue, in particular of the number of persons having access to those data and the methods of accessing them .

text: 41. Once the seriousness of the inference has been determined, it should be assessed whether a fair balance has been struck between the importance of the objectives of general interest pursued and the individuals’ fundamental rights to privacy and data protection. Taking into account safeguards that reduce the risks to the rights and freedoms of individuals forms an integral part of this assessment.

text: 42. It should be noted that the case law of the CJEU often integrates considerations of clarity and foreseeability (“quality of law”) when assessing the necessity and proportionality of legislation.

text: 43. For example, in order to satisfy the requirement of proportionality, the CJEU considers that “the legislation must lay down clear and precise rules governing the scope and application of the measure in question and imposing minimum safeguards, so that the persons whose personal data is affected have sufficient guarantees that data will be effectively protected against the risk of abuse. That legislation must be legally binding and, in particular, must indicate in what circumstances and under which conditions a measure providing for the processing of such data may be adopted, thereby ensuring that the interference is limited to what is strictly necessary” .

text: 44. As further clarified by the CJEU, the need for such safeguards is all the greater where personal data is subjected to automated processing and where the protection of the particular category of personal data that is sensitive data is at stake . 13

text: 45. Given the crucial importance of necessity and strict proportionality to data protection, the EDPS published relevant guidance: “Assessing the necessity of measures that limit the fundamental right to the protection of personal data: a toolkit” and Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data. See also the EDPS quick-guide to necessity and proportionality.

text: 46. The replies to the following questions can additionally help to guide the assessment of necessity and proportionality: • Are the rules governing the scope and application of the measure sufficiently clear and precise? Is there sufficient legal clarity and certainty about the scope and extent of the interference (e.g., in terms of definitions, processing activities, actors involved etc.)? • Is it explicitly specified what categories of data will be collected or exchanged, by whom, and for how long? • Is the data processing envisaged by the measure adequate, relevant and not excessive in relation to the purposes for which they are collected or further processed? • Could any other, less intrusive measure achieve the desired outcome with less interference with the fundamental right at stake ? • Are there any specific concerns related to processing of special categories of personal data (e.g. biometric data or data concerning health) or personal data which is otherwise sensitive (e.g. traffic and location data, financial data, etc.) or the categories of data subjects concerned (e.g. vulnerable persons)? • Are there any specific concerns related to the use of automated decision-making, profiling, or new technologies like Artificial Intelligence ? • Where a measure aims at protecting other public interests or fundamental rights, how are those interests or rights balanced with privacy and data protection ? Which safeguards are in place to reduce the risks to the rights and freedoms individuals? 14 Example: EDPS Opinion 4/2022 on the Proposal for a Regulation on automated data exchange for police cooperation (“Prüm II”) The European Commission adopted a Proposal for a Regulation on automated data exchange for police cooperation (“Prüm II”), amending Council Decisions 2008/615/JHA and 2008/616/JHA and Regulations

text: (EU) 2018/1726

text: , 2019/817 and 2019/818 of the European Parliament and of the Council (the so-called “Prüm Decisions”). The EDPS noted that the proposed new Prüm framework does not clearly lay down essential elements of the exchange of data, such as the types of crimes, which may justify a query, and is not sufficiently clear about the scope of data subjects affected by the automatic exchange of data, e.g. whether the databases, subject to a query, contain data only of suspects and/or convicted persons, or also data of other data subjects, such as victims or witnesses. The EDPS considered in particular that the automated searching of DNA profiles and facial images should be possible only in the context of individual investigations into serious crimes, instead of any criminal offence, as provided for in the Proposal. Furthermore, the EDPS considered it necessary to introduce in the Proposal common requirements and conditions concerning the data in the national databases that are made accessible for automated searches, taking due account of the obligation under Article 6 of the LED to make a distinction between different categories of data subjects (i.e. convicted criminals, suspects, victims, etc.). The EDPS also considered that the necessity of the proposed automated searching and exchange of police records data was not sufficiently demonstrated. If such a measure is nevertheless adopted, even on voluntary basis, then additional strong safeguards would be required to comply with the principle of proportionality. In particular, given the data quality challenges, the future Regulation should, inter alia, explicitly define the types and/or the seriousness of crimes that may justify an automated query in the national police records.

text: 47. Without being exhaustive, the following subsections will highlight specific points of attention that should be considered when assessing whether a proposed measure complies with the requirements of necessity and proportionality, in particular as regards: (i) the categories of personal data concerned; (ii) the categories and the number of data subjects concerned; (iii) the duration of storage; (iv) disclosure of personal data to public authorities or third parties; and (v) restrictions the rights of data subjects. 15

text: 5.1. (Categories of) personal data

text: 48. The EDPS considers that the basic act should, as a general rule, specify the (categories of) personal data in a comprehensive manner, especially if the proposal is likely to entail a serious interference with the rights to data protection and privacy . In some cases, the specification of the personal data to be processed stems from an explicit legal obligation .

text: 49. When a proposal specifies (the categories of) personal data involved, it should be ensured that the specified categories of data are necessary and proportionate to the objective pursued.

text: 50. Where a proposal envisages processing of special categories of personal data or personal data relating to criminal convictions and offences, it should additionally be ensured that the conditions of Article 9-10 of the GDPR, Article 10-11 of the EUDPR and/or Article 10 of the LED are met.

text: 51. Where the proposal specifies the categories of personal data involved, these categories should in principle be described in an exhaustive manner: • Open-ended formulations (e.g., “any other relevant data”, “at least”, ...) should be avoided; • Only more detailed data fields (sub-categories of data) falling under the already defined categories of data should be added through the adoption of implementing or delegated acts (the introduction of entirely new data categories by way of implementing act should be avoided, especially if the processing would constitute a serious interference with the rights and freedoms of individuals). 16 Example: EDPS Opinion 3/2022 on the Proposal for amending the Directive on the framework for the deployment of Intelligent Transport Systems in the field of road transport The Proposal to amend the ITS Directive would empower the Commission to adopt specifications laying down the categories of traffic, travel or road data that are personal data. In his opinion, the EDPS considered that the categories of personal data as well as the purposes for the processing of personal data in the context of the deployment of ITS services should be specified directly in the Proposal. The EDPS recognised that given the diversity of ITS and the variety of potential use cases, it could not be possible to fully detail each possible data category . However, only more detailed data fields (subcategories of data) falling under the already defined categories of data should be added through the adoption of delegated acts. Moreover, the EDPS underlined that the purposes for which the categories of personal data may be processed should be clearly set out in the Proposal itself.

text: 5.2. Categories of data subjects

text: 52. Where the proposal entails a serious interference with the rights to data protection and privacy, the categories of data subjects should be specified in the basic act or appear unambiguously from the text.

text: 53. In any event, it should be verified that the categories of data subjects affected appear as necessary and proportionate to the objective pursued. Example: EDPS Formal comments on a Proposal for a Commission Implementing Decision amending Implementing Decision

text: (EU) 2017/253

text: as regards alerts triggered by serious cross-border threats to health and for the contact tracing of passengers identified through Passenger Locator Forms. The comments concerned the draft Commission Implementing Decision amending Implementing Decision

text: (EU) 2017/253

text: as regards alerts triggered by serious crossborder threats to health and for the contact tracing of passengers identified through Passenger Locator Forms (PLF). While Recital 16 of the draft Implementing Decision referred to the processing of personal data of “cross-border passengers”, Recital 17 stated that the processing of personal data would concern “infected passengers”. From the draft Implementing Decision, the EDPS understood that all cross-border passengers’ data would be processed and transmitted within the PLF exchange platform. Thus, the EDPS recommended explicitly clarifying in the aforementioned recitals whether the categories of data subjects would be limited to infected passengers only or might also concern other cross-border passengers for the purpose of SARS-CoV- 2 contact tracing. 17

text: 5.3. Storage duration

text: 54. According to the storage limitation principle, the GDPR, the EUDPR and the LED provide for personal data to be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed”.

text: 55. In accordance with the CJEU case law , the determination of a storage duration must be based on objective criteria. Different storage duration should be set for the different categories of data stored “on the basis of their possible usefulness for the purposes of the objective pursued or according to the persons concerned” .

text: 56. Despite the objective nature of the determination of storage duration periods, in practice the legislator enjoys a certain margin of appreciation in defining an appropriate retention period, because no mathematical formula can determine with absolute precision the duration of storage which is necessary to achieve a given objective. Thus, the defined period must be reasonably defined, having regard to the purposes of the processing. The period of time should be closely put in relation to the purpose pursued and must be justified so as to ensure that the storage is limited to what is strictly necessary for the purposes pursued, and in practice it should be as short as possible. Sufficient evidence should be produced to that effect, for example by including the necessary justification in the impact assessment accompanying the proposal.

text: 57. When assessing the relevance of the storage, attention should be drawn on whether the data stored could become outdated and irrelevant to serve the purposes (such as health data stored for public health purposes). Where the level of quality of the stored data cannot be ensured during the same length of time, it is recommended to evaluate if a shorter data storage duration would be more suitable.

text: 58. The envisaged storage duration should be specified unambiguously. The mere reference to the deletion of data when “no longer required” is not sufficient to ensure consistency and legal certainty. A storage duration may be specified: o by indicating the exact number of months/years for which the data shall be retained (e.g., “for five years”); 18 o by indicating the maximum number of months/years for which the data may be retained, provided that it does not prejudice the application of the general principle of storage limitation (e.g., “no longer than necessary for the purpose of XYZ and in any event no longer than five years”); o alternatively, in particular in the context of the LED, indicating the time period (months/years) for conducting a periodic review of the need for further storage of the personal data.

text: 59. Where the proposal entails a serious interference with the rights to data protection and privacy, the storage duration of the personal data should be specified in the basic act. While the criteria allowing the determination of the storage duration shall be laid down in the basic act, the concrete duration may be further defined by implementing or delegated acts, on the basis of these objective criteria. Example: EDPS Formal comments on a Proposal for a Regulation establishing a European single access point (ESAP) providing centralised access to publicly available information of relevance to financial services, capital markets and sustainability The Proposal determined that information referred to in

text: Article 1(1)

text: thereof remained available to the European single access point (ESAP) for at least 10 years, unless it was stated otherwise in the relevant legal act that required the information to be made public. In terms of personal data, it should not be retained and made available for longer than 5 years, unless stated otherwise in the relevant legal act. Finally, the Proposal specified that the collection bodies shall take appropriate technical and organisational measures to ensure that the information is not retained or made available for longer than provided for in

text: Article 5(1)

text: (f). The EDPS welcomed the introduction of a clear maximum duration for the storage of personal data by the collection bodies. He regretted, however, that neither the Proposal nor the explanatory memorandum provided objective reasons for justifying the established duration. In order to avoid interpreting the Proposal as defining by default “the period necessary” under certain existing acts as 5 years and thus potentially leading to an extension of the maximum storage periods beyond the period necessary, the EDPS recommended specifying that the collection bodies must ensure that personal data submitted to them “shall not be retained and made available for longer than necessary and in any event not for longer than 5 years, unless stated otherwise in the legal acts referred to in

text: Article 1(1)

text: , point (a)” of the Proposal.

text: 5.4. Disclosure of personal data to public authorities or third parties

text: 60. The GDPR, the EUDPR and the LED require personal data to be collected for specified purposes and not further processed in a manner that is incompatible with those purposes (purpose limitation). If a proposal foresees access of the competent national authorities 19 to the data processed, such access constitutes a further interference with the fundamental right to respect for private life.

text: 61. Each time a proposal entails the sharing of data with public authorities or third parties, it should be clearly specified . Any legislative measure authorising the exchange, communication or access to personal data by third parties should clearly designate the third parties who may have such access or to whom the data may be communicated, as well as the purpose for which the data shall be disclosed.

text: 62. The public authorities or third parties to whom the personal data shall be disclosed must be specified in the basic act. An implementing or delegated act may not introduce a new disclosure of personal data to a public authority or third party which is not sufficiently supported by the basic act .

text: 63. The legislative act should lay down objective criteria in order to define the circumstances and conditions under which the competent national authorities are to be granted access to the data at issue and by which to determine the limits of data sharing with the public authorities and their subsequent use. It should also specify the substantive and procedural conditions relating to such sharing and subsequent use. In particular, the legislation providing for access by competent authorities should: • impose minimum safeguards, so that the persons whose personal data is affected have sufficient guarantees that data will be effectively protected against the risk of abuse. • be legally binding under domestic law and, • in particular, must indicate in what circumstances and under which conditions a measure providing for the processing of such data may be adopted, thereby ensuring that the interference is limited to what is strictly necessary . 20 Example: EDPS Opinion 1/2021 on the Proposal for a Digital Services Act Article 21 of the Proposal for a Digital Services Act required online platforms to promptly inform the law enforcement or judicial authorities as they become aware of any information giving rise to a suspicion that a serious criminal offence involving a threat to the life or safety of persons has taken place, is taking place or is likely to take place. In his opinion, the EDPS welcomed the delineation of the criminal offences which may give rise to a reporting obligation, i.e. “serious criminal offences involving a threat to the life or safety of persons”. However, the EDPS recommended further specifying, by listing in an Annex, any other criminal offences (other than child sexual abuse mentioned in Recital 48) that meet this threshold and may give rise to a notification obligation, as well as clearly defining what “relevant information” is in order to ensure legal certainty for all parties involved, including the platforms themselves.

text: 5.5. Disclosure of personal data involving international transfers

text: 64. Where a proposal indicates that there may be international transfers of personal data to third countries, due regard should also be given to the conditions for transfers pursuant of Chapter V of the GDPR, Chapter V and Article 94 of the EUDPR and Chapter V of the LED.

text: 65. Furthermore, it should be born in mind that most of the legal acts establishing Union largescale IT systems in the field of Title V of the TFEU (Area of Freedom, Security and Justice) lay down a prohibition of the transfer of the data stored in them to third countries or international organisations, with some clearly defined exceptions .

text: 5.6. Restrictions on data subject rights

text: 66. Where the proposed legislative act entails restrictions on data subject rights, such restriction must comply with the criteria above laid down in Article 52(1) of the Charter. In addition: • Restrictions by European Union Institutions and bodies (“EUIs”) are regulated under Article 25 of the EUDPR: any restriction has to be either based on a legal act adopted on the basis of the Treaties or, in the absence of such legal basis, in matters relating to the operation of EUIs, on the internal rules of the EUIs.

text: 67. Any restrictions under the GDPR and the LED must be provided for by law, which implies, in particular, that the legal basis which permits the interference with those rights must itself define the scope of the limitation on the exercise of the right concerned. It shall be clear, precise and its application foreseeable to the persons whose personal data is affected. 21 This means that the latter shall be able to identify the circumstances and conditions of such restrictions .

text: 68. For more information on restrictions under Article 25 of the EUDPR and Article 23 of the GDPR, see EDPS Guidance on Article 25 of Regulation 2018/1725 and EDPB Guidelines 10/2020 on restrictions under Article 23 of the GDPR.

text: 6. Basic acts vs implementing or delegated acts

text: 69. When assessing a proposal that would entail the processing of personal data, it is very important to bear in mind whether the proposed act is a basic act or an implementing or delegated act .

text: 70. A significant number of consultations under Article 42(1) of the EUDPR concern draft implementing or delegated acts (Articles 290 and 291 of the TFEU). Many of these acts are technical in nature and are often interrelated (e.g. several implementing and/or delegated acts may define specific aspects and functionalities of the same large-scale IT system).

text: 71. In that regard it should also be born in mind that delegated acts may delegate to the Commission the power to adopt non-legislative acts of general application to supplement or amend certain non-essential elements of the legislative act (e.g. to further specify or amend the categories of data). On the other hand, implementing acts can only implement in more detail the elements already listed in the legally binding Union acts.

text: 72. Article 290 of the TFEU specifies that the “essential elements” of an area shall be reserved for the legislative act (i.e. the basic act). The CJEU has further clarified that “essential elements” of basic legislation are those which, in order to be adopted, require political choices falling within the responsibilities of the EU legislature . For example, the adoption of rules requiring conflicting interests at issue to be weighed up on the basis of a number of assessments, may not be conferred on the Commission . When it exercises delegated or implementing powers, the Commission must fully respect the essential elements of the enabling act .

text: 73. In accordance with the GDPR, the legal basis for the processing does not necessarily require a legislative act adopted by a parliament . Nevertheless, the EDPS considers that decisions 22 on essential principles and modalities that impact fundamental rights should be taken at the level of the basic act so as to ensure that such decisions are taken within a full legislative procedure, which ensures more democratic control and includes the appropriate checks and balances . Decisions that have a major impact on the privacy and data protection of individuals should be decided by the European Parliament and Council, particularly for proposals that may entail a serious interference with data protection and privacy rights.

text: 74. If the proposal concerns a basic act which does not entail a serious interference with the right to data protection, the EDPS considers that it is possible to delegate the determination of certain modalities of the processing to the Commission (for more details see the table under section 8) . If the proposal does not provide for any implementing or delegated act, however, the requisite safeguards will in any event need to be included in the basic act or an empowering provision should be added.

text: 75. In any event, if an empowering provision is provided for, it should clearly define the scope of the delegation as regards data protection elements (e.g. in terms of categories of data, storage periods, etc.) that would be delegated pursuant to the proposed basic act. This will help to ensure clarity regarding the mandate conferred, as well as provide further assurance that those elements will be addressed at the level of Union law.

text: 76. Since only very technical (practical) details should be left to be decided under the administrative autonomy of the EU body involved in the processing of personal data (e.g. by the Management Board of a decentralised Agency), explicit empowerment to administrative bodies to lay down provisions that regulate the interference with fundamental rights should be avoided, as this matter should be reserved to the legislator and, at most, to the Commission .

text: 77. When dealing with a proposal for a delegated or implementing act, it is also important to assess its legal basis and scope. In that regard, the following questions should be considered: • What would be the legal basis of the implementing or delegated act? • Would the draft implementing or delegated act be within the scope laid down in the basic act?

text: 78. In addition, it is recommended to check whether there has been an EDPS Opinion on the basic act providing for the legislative delegation for the adoption of the implementing or 23 delegated act, or previous EDPS formal comments on related matters, e.g. formal comments on other implementing or delegated acts envisaged by the same basic act.

text: 7. Interferences further specified at national level

text: 79. Under the principle of subsidiarity, in areas which do not fall within its exclusive competence, the Union shall act only if and in so far as the objectives of the proposed action cannot be sufficiently achieved by the Member States, either at central level or at regional and local level, but can rather, by reason of the scale or effects of the proposed action, be better achieved at Union level.

text: 80. Especially when it comes to a basic act, it is important to consider whether Member States will further specify the interference or the details of its regime under their national law. Where this is the case, the details in the proposed act may be more limited than in case where the interference is governed exclusively (or primarily) by rules promulgated at EU level. Example: EDPS Formal Comments on the Proposal for a Directive of the European Parliament and of the Council on combating violence against women and domestic violence The Proposal for a Directive of the European Parliament and of the Council on combating violence against women and domestic violence aimed at establishing minimum rules concerning the definition of criminal offences and penalties in the areas of sexual exploitation of women, and children and computer crime. While the Proposal envisaged collection of personal data that may be deemed particularly sensitive, the processing of data would mainly be taking place in the framework of the relevant criminal procedures and the rules on data protection transposed at national level from the LED.

text: 81. Conversely, there may also be instances where a proposal envisages that Member States shall further specify the interference or the details of its regime under national law, whereas it would be more appropriate to include additional elements directly in the proposal itself. Example: Opinion 2/2023 on the Proposals for Directives on standards for equality bodies in the field of equal treatment Two proposals for Directives on standards for equality bodies in the field of equal treatment envisaged that the choice of the legal basis for the processing of personal data by equality bodies should be left to the national transposition of the future directives. The EDPS recommended enhancing legal certainty for the equality bodies by considering Article 18 of the Proposals as the legal basis for the data processing and to make an explicit link to Article 9 of the GDPR with regard to special categories of personal data. He also recommended clarifying the scope of Article 18(1) of the Proposals to cover not only the collection but also the subsequent processing of personal data by equality bodies, as necessary, by exhaustively listing all special categories of personal data within the meaning of the GDPR that may be processed on the basis of the Proposals as well as clarifying the suitable and specific measures to safeguard the fundamental rights and the interests of the data subject required in

text: Article 9(2)

text: (g) of the GDPR. 24

text: 82. In cases where the proposal would give rise to a significant interference, it is particularly important to already incorporate relevant safeguards at EU level . In such cases, the degree of discretion left to Member States to define certain elements should not be such as to have an impact on the assessment of the necessity and the proportionality of the envisaged measure .

text: 8. Checklist prior to the adoption of legislative acts or delegated or implementing acts

text: a) Elements to be found in the legal act where it does not constitute a serious interference with the rights to data protection and privacy of data subjects

text: (Essential) elements of In the EU basic act In the implementing or the processing delegated acts

text: Objective(s) and purpose(s) Yes [but the purpose(s) Additional specifications are may stem from the general possible provided that they comply economy of the act, if there with the purposes identified in the is no ambiguity] basic act (even if implicitly but surely).

text: Identification of the Yes [whenever possible/ Yes (if not already in the basic act controller(s) appropriate] and unless it would clearly exceed the delegation of powers)

text: (Categories of) processed Yes OR empowering Yes (if not already in the basic act personal data provision and unless it would clearly exceed the delegation of powers) Not mandatory, unless explicitly provided for under secondary EU law

text: Categories of data subjects Yes OR empowering Yes (if not already in the basic act provision and unless it would clearly exceed the delegation of powers)

text: b) Elements to be found in the legal act where it constitutes a serious interference with the rights to data protection and privacy of data subjects

text: Objective(s) and purpose(s) Yes [but the purpose(s) No may stem from the general economy of the act, if there is no ambiguity]

text: Identification of the Yes [whenever Yes (if not already in the basic act controller(s) possible/appropriate] and unless it would clearly exceed the delegation of powers)

text: (Categories of) processed Yes Depending on the intrusiveness of personal data the measures, the Commission may receive the power to specify further the processed data.

text: Categories of data subjects Yes [but the categories of No data subjects can be deduced from other provisions of the act, provided that there is no ambiguity]

text: Max duration of the data Yes The Commission may be storage or, at least, criteria authorised to (further) determine for determining such the storage duration based on duration criteria defined by the legislators and to reduce the storage duration of data.