text: COM(2023) 258 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 258 final. 4 COM(2023) 257 final, p. 4. Article 1(1) of the Proposal. 6 COM(2023) 258 final, p. 1. 7 COM(2020) 581 final. 8 Ghiran, A., Hakami, A., Bontoux, L. and Scapolo, F., The Future of Customs in the EU 2040, Publications Office of the European Union, Luxembourg, 2020. 4

text: COM(2023) 257 final, p. 4. 10 COM(2023) 257 final, p. 11. 11 Ibid. 12 Article 29(1) of the Proposal. 13 See EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data, 19 December 2019. 14 See also Recital 41 GDPR and Recital 23 EUDPR. These provisions complement the requirements of Article 7 and 8 of the Charter, as interpreted by the CJEU, according to which any interference must be provided for by law which is clear, precise and foreseeable. 15 Recital 29, Articles

text: to 35, and 244 of the Proposal. 5

text: EDPS formal comments on a Proposal for a Regulation of the European Parliament and of the Council establishing the European Union Single Window Environment for Customs and amending

text: Regulation (EU) No 952/2013

text: issued on 20 November 2020, EDPS Formal comments on the draft Implementing Regulation on technical arrangements for developing, maintaining and employing electronic systems for the exchange of information and for the storage of such information under the Union Customs Code issued on 11 December 2020, EDPS Formal comments on the draft Commission Implementing Regulation on technical arrangements for developing, maintaining and employing electronic systems for the exchange and storage of information under

text: Regulation (EU) No 952/2013

text: of the European Parliament and the Council issued on 20 March 2023. 17 See in particular EDPS Formal comments of 20 March 2023 on the draft Commission Implementing Regulation on technical arrangements for developing, maintaining and employing electronic systems for the exchange and storage of information under

text: Regulation (EU) No 952/2013

text: of the European Parliament and the Council, p. 4 (calling for a more comprehenisive legal at the level of the basic act,

text: Regulation (EU) No 952/2013

text: , for the electronic systems under the UCC, with clearly defined purposes, roles and responsibilities, categories of personal data, categories of data subjects and storage duration). 18

text: Article 31(2)

text: a of the Proposal specifies that a customs authority may process (any) personal data in the EU Customs Hub ‘to carry out its tasks in relation to the implementation of customs legislation or other legislation applied by the customs authorities, including determining the liability of any person for duty, fees and taxes that may be due in the Union and verifying compliance with that legislation’ 6

text: Article 31(4)

text: provides that EPPO might access data ‘stored or otherwise available’ in the EU Customs Data Hub exclusively and to the extent necessary for carrying out the tasks of the EPPO pursuant to Article 4 of the

text: Council Regulation (EU) 2017/193

text: , ‘insofar as the conduct investigated by EPPO concerns customs and under the conditions determined in an implementing act adopted pursuant to paragraph 14 of this Article’. Similarly, Europol might access data ‘stored or otherwise available’ exclusively and to the extent necessary to perform its tasks in accordance with

text: Article 4 of Regulation (EU) 2016/794

text: of the European Parliament and of the Council ‘as long as those tasks concern customs-related matters and under the conditions determined in an implementing act adopted pursuant to paragraph 14 of this Article’. In both cases, the reference to ‘otherwise available’ data does not give a clear indication of the categories of data which might be processed by these authorities. Moreover, references to conducts concerning ‘customs’ on the one hand, and to ‘customs-related matters’ on the other do not delineate precisely the scope of data processing operations led by EPPO and Europol, in the context of the EU Customs Data Hub. 7

text: See the Opinion 1/15 of the Court (Grand Chamber), PNR Canada, 26 July 2017, ECLI:EU:C:2017:592, 172." [...] the extent of the interference which automated analyses of PNR data entail in respect of the rights enshrined in Articles 7 and 8 of the Charter essentially depends on the pre-established models and criteria and on the databases on which that type of data processing is based. Consequently, [...], the pre-established models and criteria should be specific and reliable, making it possible, as the Advocate General has observed at point 256 of his Opinion, to arrive at results targeting individuals who might be under a ₕreasonable suspicionₖ of participation in terrorist offences or serious transnational crime and should be non-discriminatory. [...]” 10

text: Judgment of the Court of Justice of 8 April 2014, Joined Cases Digital Rights Ireland,

text: , ECLI:EU:C:2014:238, paragraphs 63 and 64. 25 EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: and EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR. 26 See

text: Article 31(2)

text: a of the Proposal. 11

identifier: EDPS yttrande 31/2023

title: EDPS Opinion 31/2023 on the Proposal for a Regulation establishing the Union Customs Code and the European Union Customs Authority

text: 11 July 2023

text: Opinion 31/2023

text: on the Proposal for a Regulation establishing the Union Customs Code and the European Union Customs Authority

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council establishing the Union Customs Code and the European Union Customs Authority, and repealing

text: Regulation (EU) No 952/2013

text: .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: Regulation (EU) No 952/2013

text: The Proposal aims to revise the current Union Customs Code in order to strengthen the capacity of customs to supervise and control which goods enter and leave the Customs Union. It should also simplify the customs legislation by reducing formalities and compliance costs for businesses and administrations. A new EU Customs Authority is created, together with a single online environment, the EU Customs Data Hub, which over time would replace the existing customs IT infrastructure in EU Member States.

text: The EDPS acknowledges the essential role that the EU Customs Hub is expected to play in the new architecture, by enabling the processing of large amounts of data, including personal data, for customs purposes. In this context, the EDPS welcomes the reference to the EU data protection law in the Proposal, as well as the inclusion of requirements relating to the processing of personal data.

text: At the same time, the EDPS considers that the Proposal lacks precision regarding the different categories of data subjects whose personal data may be processed in the EU Customs Data Hub, the categories of personal data concerned, as well as the purposes of the processing. Further consideration should also be given to the automated processing of personal data in the context of risk analysis, and to the storage period of personal data which should be limited to what is strictly necessary for the purposes pursued. Finally, the Proposal should ensure that the roles and responsibilities of each of the entities processing personal data in the context of the EU Customs Data Hub are clearly defined.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 17 May 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council establishing the Union Customs Code and the European Union Customs Authority, and repealing

text: Regulation (EU) No 952/2013

text: (‘the Proposal’).

text: 2. The objective of the Proposal is to ‘bring a step change to the Customs Union’ , by establishing the European Union Customs Authority (‘the EU Customs Authority’), as well as the European Union Customs Data Hub (‘EU Customs Data Hub’) . The reform aims to strengthen the capacity of customs to supervise and control which goods enter and leave the Customs Union .

text: 3. This reform follows up on the 2020 Customs Action Plan of the Commission, and the foresight exercise engaged by the Commission with stakeholders, academia and international partners on the future of customs in the EU 2040 .

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 17 May 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 30 of the Proposal.

text: 2. General remarks

text: 5. The EDPS notes that the Proposal constitutes ‘the most ambitious and comprehensive reform of the Customs Union since its birth in 1968’ . The reform is based on a new partnership among EU customs authorities and between customs and business, with two overarching objectives: reducing compliance costs for administrations and businesses through simplified and modernised procedures, and enabling EU Customs to better protect the financial and non-financial interest of the EU and its Member States as well as the Single Market, based on common, EU-wide risk management and more harmonised controls.

text: 6. The reform is expected to have important consequences on the way data, including personal data, are processed for customs purposes. According to the Commission, ‘the EU Customs Authority will pool customs expertise at central level to carry out EU risk management, exploiting for risk analysis purposes the wealth of constantly updated data in the EU Customs Data Hub’ . Moreover, The EU Customs Authority should also be the ‘central customs interlocutor for non-customs authorities’ tasked with preserving the integrity of the Single Market, and should ensure operational cooperation and coordination with relevant entities, ‘including EU Agencies such as Europol and Frontex’ .

text: 7. The EU Customs Data Hub would entail processing of large amounts of data, supporting risk analysis, economic analysis and data analysis, including through the use of artificial intelligence systems, and support cooperation with other electronic systems, by means of interoperability .

text: 8. Processing of personal data by the EU Customs authority and through the EU Customs Hub constitutes an interference with the fundamental rights to privacy and to the protection of personal data. Such interference must be necessary and proportionate . In order to satisfy the requirement of proportionality, the legislation must lay down clear and precise rules governing the scope and application of the measures in question and imposing minimum safeguards, so that the persons whose personal data is affected have sufficient guarantees that data will be effectively protected against the risk of abuse. It should be clear, precise and its application foreseeable to the persons whose personal data is affected . In order to ensure that the interference remains limited to what is strictly necessary, the Proposal should clearly indicate which categories of personal data may be used by which competent authority and for which specific purposes.

text: 9. The EDPS notes positively the reference in the Proposal to the EU data protection law, as well as the inclusion of provisions relating to the purposes, categories and retention periods of personal data processed in the EU Customs Data Hub, the roles and responsibilities for personal data processed and the restriction of data subject rights . At the same time, the EDPS considers that the content of several provisions should be developed further in order to ensure respect for fundamental rights.

text: 10. The EDPS notes that the implementation of the new Union Customs code would be rolled out in steps over the coming 10 to 15 years. In the meantime, the IT deployment of the 2013 Customs Reform establishing the current Union Customs Code (UCC) Regulation, in force since May 2016, is still ongoing and is expected be completed by the end of 2025. In this regard, the EDPS recalls all his previous formal comments on delegated or implementing acts linked to

text: Regulation (EU) 952/2013

text: , and especially his call for a more comprehensive legal basis , which also remain fully relevant during the implementation of the 2013 Customs Reform.

text: 3. Purpose limitation and user access

text: 11. According to

text: Article 5(1)

text: (b) of the GDPR and

text: Article 4(1)

text: (b) of the EUDPR, personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. The principle of purpose limitation is designed to establish the boundaries within which personal data collected for a given purpose may be processed and may be put to further use.

text: 12. Article 31 of the Proposal is entitled ‘Purposes of the processing of personal data and other data in the EU Customs Data Hub’. The article is organised along 11 different categories of users and defines the purposes of the processing of personal data through a broad justification for each user category’s access rights to the Data Hub.

text: 13. The EDPS considers that not all purposes listed in Article 31 of the Proposal provide the required degree of specificity on the purposes of the processing of personal data. In particular,

text: Article 31(2)

text: (a) contains a generic reference to all possible different legal bases for activities by customs authorities, without providing any details as regards the specific legislation in question .

text: 14. The EDPS considers that this purpose definition, based on a general reference to ‘the implementation customs legislation or other legislation’ is too broad. Absent further specification, it does not provide a clear indication of which purposes are being pursued or to determine which categories of personal data would be relevant, necessary and proportionate to the purpose.

text: 15. In the same vein,

text: Article 31(2)

text: (c) of the Proposal would authorise customs authorities to process personal data in the EU Customs Data Hub to carry out the tasks necessary for ‘the cooperation under the conditions provided for in Title XIII’. Article 239(1) of the Proposal, however, refers in very general terms to cooperation among customs authorities and with other authorities, without referring to specific provisions of legislation that would require the processing and exchange of personal data among those authorities.

text: 16. The EDPS notes that the processing of personal data stored in the future EU Customs Data Hub would correspond to a broad range of purposes, including police and judicial activities with access to the Hub by the European Union Agency for Law Enforcement Cooperation (Europol) and the European Public Prosecutor’s Office (EPPO) . Bearing in mind the diversity of uses to be offered by the Hub, the EDPS considers that further efforts are needed to ensure that the new structure should not lead to a weakening of the fundamental rights and freedoms of natural persons, and in particular of their rights to privacy and data protection.

text: 17. The EDPS considers that the Proposal should refer to the specific provisions of ‘customs legislation or other legislation applied by the customs authorities’ that would justify the processing and exchange of personal data. Where Union law is concerned, relevant provisions could be listed in an Annex to the Proposal. Where national law would provide the legal basis for the processing of personal data in the Customs Data Hub, Member States should be required by the Proposal to notify these provisions to the Commission and to make them publicly available.

text: 18. The EDPS recognizes that the Proposal aims to mitigate some of these shortcomings by providing in

text: Article 31(13)

text: that the Commission is empowered to adopt delegated acts to amend paragraphs 2 to 4 to clarify and complement the purposes laid down therein, in light of the evolving needs in implementing customs legislation or other legislation. Moreover, Article 31(14) of the Proposal requires the Commission to lay down, by means of implementing acts, a number of safeguards, in order to ensure that the personal data stored or otherwise available in the EU Customs Data Hub should be processed in compliance with the EU data protection law. The EDPS considers, however, that the purposes of the processing should be clearly established in the Proposal itself. At a minimum, Article 31 of the Proposal should make reference to the specific provisions of Union customs legislation or other Union legislation that would justify the processing of personal data in the EU Customs Data Hub.

text: 4. Categories of data subjects and of personal data

text: 19. Paragraphs 1 and 2 of Article 32 of the Proposal provide indications on both categories of data subjects whose personal data might be processed, and of categories of personal data that would be processed. Paragraph 3 of the same article states that delegated acts might be adopted to amend or supplement those categories ‘to take into account of developments in information technology and in the light of the state of progress in the information society’.

text: 4.1 Categories of data subjects

text: 20. The EDPS recalls that, in line with the data minimisation principle laid down in

text: Article 5(1)

text: (c) of the GDPR and

text: Article 4(1)

text: (c) of the EUDPR, the collection of personal data should be limited to what is necessary to fulfil the purposes for which they are processed. Consequently, the EDPS considers that the different categories of data subjects and personal data that are necessary to achieve the purposes of the processing as set out in the Proposal should be sufficiently specified, in order to avoid overly broad categories.

text: 21. Against this background, the EDPS notes that, among the categories of data subjects, one of them is defined as ‘data subjects who are occasionally involved in activities covered by the customs legislation or by other legislation applied by the customs authorities’ . It seems that such a category could potentially concern any person. The EDPS underlines the importance of clearly defining the categories of data subjects, in particular where there is a need to limit processing to specific categories of data subjects due to the particularly intrusive nature of the measure. Thus, the EDPS recommends explicitly clarifying which individuals would belong to this category and whether specific safeguards should be envisaged for those data subjects who are only ‘occasionally’ involved in activities covered by legislation applied by customs authorities.

text: 22. Similarly, another category of data subjects is defined as ‘data subjects whose personal data is contained in the data collected for risk management purposes pursuant to

text: Article 50(3)

text: , point (a)’ . However,

text: Article 50(3)

text: , point (a) simply refers to the collection, processing, exchange and analysis of ‘relevant data available in the EU Customs Data Hub and from other sources, including relevant data from authorities other than customs authorities’. It seems that the description of the categories of data subjects is circular, without providing any foreseeability as regards the individuals affected. Here again, the EDPS considers necessary to further clarify which persons might be affected by the processing.

text: 4.2 Categories of personal data

text: 23. As regards categories of personal data which might be processed in the EU Customs Data Hub, the EDPS considers that two of the three categories are not sufficiently specified in the Proposal.

text: Article 31(2)

text: refers to ‘personal data in the EU Customs Data model referred to in

text: Article 36

text: ’ of the Proposal. According to

text: Article 36

text: , the determination of data required for the fulfilment of the purposes referred to in

text: Article 31 (1)

text: to (4) should be achieved by means of delegated acts adopted by the Commission. The EDPS considers that the different categories of personal data that are necessary for the purposes of the processing as set out in the Proposal should be laid down in the Proposal itself, and not relegated to implementing provisions. The EDPS understands that it may not be possible, given the number of purposes and the evolution of IT systems processing data, to specify each data category in full detail in the Proposal itself. The EDPS considers, however, that only more detailed data fields (sub-categories of data) falling under the already defined categories of data should be specified through the adoption of delegated acts.

text: 25. It is also the case of personal data included in the data collected for risk management purposes pursuant to

text: Article 50(3)

text: , point (a), which refers to the collection, processing, exchange and analysis of ‘relevant data available in the EU Customs Data Hub and from other sources, including data from authorities other than customs authorities’. The choice of open-ended formulations, such as ‘relevant data available’, ‘other sources’, “other authorities”, does not provide a sufficiently clear indication category of data to be made available pursuant to the Proposal, nor does it provide a clear indication as to their source. As a result, the Proposal does not provide persons whose personal data is affected with sufficient guarantees that data will be effectively protected against the risk of abuse.

text: 26. Against this background, the EDPS considers that the Proposal should further specify those two categories of personal data, so as to provide a comprehensive overview of the categories of personal data concerned. Moreover, the Proposal should clearly specify the purpose(s) for which each category of personal data may be processed.

text: 5. Customs risk management

text: 27. According to Article 29 of the Proposal, the EU Customs Data Hub should, among other tasks, ‘enable risk analysis, economic analysis and data analysis, including through the use of artificial intelligence systems, in accordance with (the future Artificial Intelligence Act)’.

text: 28. Article 50 of the Proposal further provides that ‘economic operators’ , namely persons who, in the course of their business, are involved in activities covered by customs legislation, may be selected on the basis of an automated risk analysis and subject to customs controls. These economic operators can be natural persons.

text: 29. According to the case law of the CJEU, the risk criteria to be used to select persons by means of an automated processing, when resulting in individual decisions, should: (1) be based on circumstances that are reliable and directly linked to objective factors; (2) not entail a (direct or indirect) risk of discrimination (such as race, ethnic origin, religion, political orientation, sexual orientation); and (3) not be excessively broad . Such criteria should apply in the context of customs controls.

text: 30. As indicated above, the EDPS considers that the Proposal is insufficiently clear and precise as to the categories of personal data and their source. A clear specification of the categories of personal data and the sources with which those personal data may be combined (or compared) is necessary in order to establish that the processing of personal data in the context of customs risk management is limited to what is strictly necessary.

text: 31. The EDPS recommends a careful assessment and appropriate mitigation of potential adverse effects on the persons subject of control, in particular having regard to any possible stigmatisation or prejudice against affected persons.

text: 6. Storage period

text: 32. The EDPS welcomes the introduction, in Article 33 of the Proposal of a maximum retention period for the storage of personal data in the EU Customs Data Hub. This period of 10 years is duly justified in Recital 27 ‘in light of the possibility for customs authorities to notify the customs debt up to 10 years after having received the necessary information about a consignment, as well as to ensure that the Commission, the EU Customs Authority, OLAF, customs and authorities other than customs can cross-check the information in the EU Customs Data Hub against the information stored in and exchanged with other systems’. He regrets however the possibility to suspend the retention period in cases of post-release controls, investigations launched by OLAF, EPPO or by Member States’ authorities, infringement procedures launched by the Commission and administrative and judicial proceedings involving personal data. Such suspensions may potentially lead to an extension of the maximum storage period beyond the period necessary and create a legal uncertainty as regards the final duration for the storage of personal data. Thus, the EDPS recommends to envisage, prior to the expiry of the global retention period, periodical reviews of the need for the continued storage of the personal data in the EU Customs Data Hub, including in the context of situations having a suspensive effect on the retention period. In addition, the EDPS recommends to limit to the strict minimum the use of periods of suspension for the calculation of retention periods.

text: 33. Moreover, personal data may be retained for law enforcement purposes, in accordance with Article 33(1) of the Proposal. In such cases, the determination of a storage duration must, in accordance with the CJEU case law, be based on objective criteria, and different storage duration should be set for the different categories of data stored on the ‘basis of their possible usefulness for the purposes of the objective pursued or according to the persons concerned’. The EDPS invites the co-legislators to specify which categories of personal data should be retained in the context of criminal investigations launched by EPPO, or Member States’ authorities.

text: 7. Roles and responsibilities

text: 34. The EDPS welcomes Article 34 of the Proposal, which is dedicated to the ‘roles and responsibilities for personal data processed in the EU Customs Data Hub’. The EDPS notes, however that,

text: Article 34

text: does not explicitly define the roles of the actors involved for each of the purposes listed in Article 31 of the Proposal. In particular, it is not clear which authority should be the controller for the personal data processing referred to in Article 31(1) of the Proposal. Similarly, the designation of the controllers for the personal data processing referred to in

text: Article 31(3)

text: (b) and

text: Article 31(4)

text: (b) and (h), 31(7), (8), (9) and (10) is missing. The EDPS considers that for every purpose of the processing established by the Proposal, there should be at least one or more (joint) controller(s) 25 26 identified . In cases where customs authority is designated as sole controller , it should be clarified whether or not the Commission would be acting as processor. If so, an empowering provision for a controller-processor arrangement should be considered (similar to what is provided as regards the arrangement for joint controllers in Article 34(6) of the Proposal).

text: 35. In addition,

text: Article 29(3)

text: provides for the establishment, by the Commission, of a ‘data quality framework’. While welcoming such an initiative in order to support the accuracy principle laid down in the EU data protection law, the EDPS recommends to determine the authorities responsible for its implementation.

text: 8. Conclusions

text: 36. In light of the above, the EDPS makes the following recommendations: (1) to further specify the purposes for which the personal data available in the EU Data Customs Hub should be processed; (2) to make reference the specific provisions of Union customs legislation or other Union legislation that justify the processing of personal data in the EU Customs Data Hub; (3) to require Member States to notify which provisions of national legislation that justify the processing of personal data in the EU Customs Data Hub and to make these notifications publically available; (4) to specify which individuals are considered to be ‘occasionally’ involved in activities covered by a legislation applied to customs authorities within the meaning of

text: Article 32(1)

text: (b) of the Proposal; (5) to specify the data subjects whose personal data shall be processed for risk management purposes within the meaning of

text: Article 50(3)

text: (a) of the Proposal; (6) to provide a comprehensive overview of the categories of personal data concerned and the purpose(s) for which each category of personal data may be processed; (7) to specify the categories of personal data and the sources with which those personal data may be combined (or compared) for the purposes of customs risk management; (8) to provide for periodical reviews of the need for the continued storage of the personal data in the EU Customs Data Hub and to limit to the strict minimum the use of periods of suspension for the calculation of retention periods; (9) to clearly define which entities should be considered as controllers and/or processors for the processing of personal data for each of the purposes referred to in Article 31 of the Proposal. Brussels, 11 July 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 12


text: COM(2023)281 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023)281 final. 4 Currently, Monaco, Switzerland and the United Kingdom. Strategy for the Rights of Persons with Disabilities 2021-2030 6 Study on the cross-border legal protection of vulnerable adults in the Union, 4

text: See Commission Work Programme 2022, page 10. 8 See explanatory memorandum, pages 2-5. 9 COM(2023)280 final. See EDPS Opinion 33/2023 on the Proposal for a Regulation in matters relating to the protection of adults. 10

text: Article 46(2)

text: (a) GDPR. 11

text: Article 46(1)

text: GDPR. 12 European Data Protection Board (EDPB) Guidelines 2/2020 on

text: articles 46(2)

text: (a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, issued on 15 December 2020. The same guidance also clarifies the safeguards required to be put in place by provisions to be inserted into administrative arrangements between public bodies, subject to authorisation from the competent supervisory authority. 13 See Annex to the Proposal. 5

identifier: EDPS yttrande 32/2023

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 32/2023 on the Proposal for A Council Decision authorising Member States to become or remain parties to the Convention on the International Protection of Adults

serie: yttranden

text: 18 July 2023

type: rubrik

text: Opinion 32/2023

text: on the Proposal for a Council Decision authorising Member States to become or remain parties to the Convention on the International Protection of Adults

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Commission Proposal for a Council Decision authorising Member States to become or remain parties, in the interest of the European Union, to the Convention of 13 January 2000 on the International Protection of Adults .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal hat are relevant from a data protection perspective.

text: Executive Summary

text: On 31 May 2023, the European Commission issued a Proposal for a Council Decision authorising Member States to become or remain parties, in the interest of the European Union, to the Convention of 13 January 2000 on the International Protection of Adults.

text: The Proposal is part of a package together with the Commission proposal for a Regulation of the European Parliament and of the Council on jurisdiction, applicable law, recognition and enforcement of measures, authentic instruments and powers of representation and cooperation in civil matters relating to the protection of adults, which, in addition to providing for the application of some of the rules of the Convention of 13 January 2000 in Member States, lays down complementary rules to facilitate an even closer intra EU cooperation in this area.

text: The EDPS supports the objective of the Proposal, which complements the Proposal for a Regulation on jurisdiction, applicable law, recognition and enforcement of measures and cooperation in matters relating to the protection of adults.

text: The EDPS recommends inserting in the future Decision a recital referring to this consultation.

text: Contents

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 31 May 2023, the European Commission issued a Proposal for a Council Decision authorising Member States to become or remain parties, in the interest of the European Union, to the Convention of 13 January 2000 on the International Protection of Adults (‘the Proposal’).

text: 2. The objective of the Proposal is to authorise those Member States not yet Party to the Convention on the International Protection of Adults adopted under the auspices of the Hague Conference on Private International Law on 13 January 2000 (‘the Conventionʼ) to ratify or accede to it, as well as to authorise those Member States already parties to the Convention to remain parties.

text: 3. The Convention provides a comprehensive body of rules on jurisdiction, applicable law, recognition and enforcement of protective measures, and provisions on the law applicable to powers of representation which give effect to such powers in a cross-border context. It also establishes mechanisms of cooperation between the competent authorities of Contracting States and between Central Authorities of Contracting States. It is the only international instrument dealing with private international law issues concerning the cross-border protection of adults. It would be applicable vis-à-vis non-EU States that are Contracting States to the Convention .

text: 4. Only 12 EU Member States are currently party to that Convention. Ratification of and accession to the Convention by all Member States is a long-standing EU objective. In March 2021, the Commission adopted the Strategy for the Rights of Persons with Disabilities 2021-2030 which explicitly stated that the Commission will work with Member States to 5 6 implement the Convention . It also carried out a legal study which reached the conclusion that the ratification of the Convention by all Member States would address some of the problems linked to the significant gaps and inconsistencies, which exist in the cross-border protection of adults. Reference to this initiative is made in the Commission Work Programme 2022 .

text: 5. There is currently no EU legislation on cross-border protection of adults. However, the Proposal is part of a package with a Commission proposal for a Regulation of the European Parliament and of the Council on jurisdiction, applicable law, recognition and enforcement of measures, authentic instruments and powers of representation and cooperation in civil matters relating to the protection of adults. The latter proposal provides for the application in Member States of some of the rules of the Convention and lays down complementary rules to facilitate an even closer intra EU cooperation in this area .

text: 6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 1 June 2023, pursuant to

text: Article 42(1)

text: EUDPR.

text: 2. General remarks

text: 7. The EDPS supports the objective of the Proposal, which complements the Proposal for a Regulation on jurisdiction, applicable law, recognition and enforcement of measures and cooperation in matters relating to the protection of adults .

text: 8. The EDPS recalls that in the absence of an adequacy decision, transfers of personal data to a third country may be based on a legally binding and enforceable instrument between public authorities or bodies . In such a case, such instrument should provide appropriate safeguards and ensure that enforceable data subject rights and effective legal remedies for data subjects are available .

text: 9. The EDPB has clarified what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies .

text: 10. Among those requirements, the EDPS points out in particular to the obligation to provide for redress mechanisms, supervision mechanisms, data subjects rights or restrictions on onward transfers and sharing of data.

text: 11. The EDPS notes that the Convention contains certain safeguards in relation to the processing of personal data and in particular their purpose limitation (

text: Article 39

text: ) and confidentiality (

text: Article 40

text: ) as well as a prohibition for an authority to request or transmit any information in the framework of the cooperation set out by the Convention, if to do so, would, in its opinion, be likely to place the adult’s person or property in danger, or constitute a serious threat to the liberty or life of a member of the adult’s family (

text: Article 35

text: 12. In view of the above, it is however apparent that the Convention does not meet all the requirements to be considered, within the meaning of the GDPR, as a legally binding and enforceable instrument between public authorities or bodies on which the transfer of personal data could be based. The EDPS therefore draws attention to the fact that any transfer in the context of the Convention has to take place in accordance with the GDPR, in particular Chapter V, and the Charter of fundamental rights of the EU.

text: 13. Finally, the EDPS recommends inserting in the future Decision a recital referring to his consultation.

text: 3. Conclusions

text: 14. In light of the above, the EDPS makes the following recommendation: (1) to insert in the future Decision a recital referring to his consultation. Brussels, 18 July 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 6

type: vagledning

utgivare: edps


text: COM(2023)280 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023)280 final. 4 See page 1-2 of the explanatory memorandum. 12 Member States are already party to it. Another Commission Proposal proposes a Council Decision authorising Member States to become or remain parties to the Convention, in the interest of the Union. See EDPS Opinion 32/2023 on the Proposal for a Council Decision authorising Member States to become or remain parties to the Convention on the International Protection of Adults. 6 Proposal for a Regulation of the European Parliament and of the Council on the digitalisation of judicial cooperation and access to justice in cross-border civil, commercial and criminal matters, and amending certain acts in the field of judicial cooperation, COM(2021) 759 final. 7 See page 1-2 of the explanatory memorandum. 4

text: According to

text: Article 3(9)

text: , ʽcompetent authorityʼ would mean ʽa public authority of a Member State with responsibilities in matters of protection of adultsʼ. 9 See Article 45(2) of the Proposal. 10

text: Article 49(2)

text: . 11 See also pages 2-5 and 10 of the explanatory memorandum, recitals 44-60. 5

text: Regulation (EU) 2022/850

text: of the European Parliament and of the Council of 30 May 2022 on a computerised system for the crossborder electronic exchange of data in the area of judicial cooperation in civil and criminal matters (e-CODEX system), and amending

text: Regulation (EU) 2018/1726

text: , OJ L 150, 1.6.2022, p. 1. 13

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: , OJ L 119, 4.5.2016, p. 1. 14 Directive

text: of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector, OJ L 201, 31.7.2002, p. 37. 15 See Articles

text: . 16 See

text: Article 53(1)

text: . 17 See recital 57 of the Proposal. 6

identifier: EDPS yttrande 33/2023

title: EDPS Opinion 33/2023 on the Proposal for a Regulation in matters relating to the protection of adults

text: 18 July 2023

text: Opinion 33/2023

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation on the European Parliament and of the Council on jurisdiction, applicable law, recognition and enforcement of measures and cooperation in matters relating to the protection of adults .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 31 May 2023, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on jurisdiction, applicable law, recognition and enforcement of measures, authentic instruments and powers of representation and cooperation in civil matters relating to the protection of adults, which, in addition to providing for the application of some of the rules of the Convention of 13 January 2000 on the International Protection of Adults in Member States, lays down complementary rules to facilitate an even closer intra EU cooperation in this area.

text: The Proposal is part of a package together with the Commission Proposal for a Council Decision authorising Member States to become or remain parties, in the interest of the European Union, to the Convention of 13 January 2000 on the International Protection of Adults.

text: While supporting the objective of the Proposal, the EDPS still recommends clarifying under Article 48(2) of the Proposal that access by requesting authorities to information recorded in a protection register shall be provided only where necessary for one or several of the purposes (to be determined) listed in

text: Article 53(1)

text: in relation to the vulnerable adult concerned by the ongoing proceedings before the requesting authorities.

text: Finally, he recommends clarifying under Article 49(2) of the Proposal that any other means of communication may be used only ʽwhere the use of the decentralised IT system is not appropriate in view of the specific circumstances of the communication in questionʼ.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 31 May 2023, the European Commission issued a Proposal for a Regulation on the European Parliament and of the Council on jurisdiction, applicable law, recognition and enforcement of measures and cooperation in matters relating to the protection of adults (‘the Proposal’).

text: 2. The objective of the Proposal is to adopt the first legal instrument at Union level governing judicial cooperation between the Member States in cross-border cases in the field of the protection of adults who, by reason of an impairment or insufficiency of their personal faculties, are not in a position to protect their interests .

text: 3. The Proposal builds on the Hague Convention of 13 January 2000 on the International Protection of Adults and on the Commission Proposal on digitalisation of judicial cooperation (ʽfuture Digitalisation Regulationʼ) .

text: 4. In particular, the Proposal aims at harmonising the Member States’ rules in cross-border situations, on jurisdiction, applicable law, recognition and enforcement of protection measures and acceptance of authentic instruments. It would also set out rules giving effect to powers of representation in all Member States and create a European Certificate of Representation, to allow representatives to easily demonstrate the nature and extent of their powers across borders .

text: 5. The Proposal would simplify and modernise the cooperation between Member States and strives to improve the provision of information concerning the protection of an adult to competent authorities within the Union with a view to ensuring that measures taken in another Member State or powers of representation granted by the adults in another Member State are respected within the Union. The objective is to ensure that the protection of adults is continuous in cross-border cases, and that their fundamental right to self-determination is respected when they move within the Union. The Proposal would therefore require Member States to establish one or more register(s) of protection measures taken by their authorities to protect an adult and of powers of representation where their national law provides for the confirmation of such powers by their authorities. The Proposal would also provide for the mandatory information concerning these powers and measures to be recorded in these registers and in electronic registers provided under national law recording information concerning other powers of representation which are registered by a competent authority, and where national law does not provide for the confirmation of such powers of representation (Articles

text: and

text: ). The Proposal would not preclude Member States from including additional documents or information in their protection registers, such as the name of the representative or the nature and extent of the representation (

text: Article 45(4)

text: 6. In order to facilitate access by Member States’ authorities, the Proposal would then require the interconnection of the registers. The decentralised system for the interconnection would be composed of the Member States’ protection registers and of a central electronic access point to the information and provide a search service in all the official languages of the Union (

text: Article 47

text: ). The information that would be accessed are both the mandatory information defined in Article 45(2) of the Proposal and any other documents or information included in the registers which the Member States would choose to make available through the system of interconnection (

text: Article 47(2)

text: ). Access to the information would not be public but would be provided only to the authorities of the Member States, which also have access under their national law to the mandatory information defined in the Proposal and ʽhave a legitimate interest in accessing this informationʼ (

text: Article 48(2)

text: ). Member States would have to communicate to the Commission the authorities having such access (

text: Article 69(1)

text: (m)).

text: 7. As far as written communication between authorities is concerned, the Proposal would additionally provide for the use, as a rule, of electronic communications via a secure and reliable decentralised IT system to be established by the Commission, while allowing, for direct communication between authorities , the use of any other means of communication (Articles

text: and

text: 8. The Proposal would also provide for the optional use of electronic communication between natural and legal persons and competent authorities and issuing authorities, through the European electronic access point established on the European e-Justice Portal pursuant to the future Digitalisation Regulation (

text: Article 50

text: 9. The Commission would be responsible for the creation, maintenance and development of a reference implementation software which Member States may choose to apply as their back-end system (instead of a national IT system) for the purposes of the electronic communications (

text: Article 61

text: 10. Implementing powers would be conferred on the Commission to ensure uniform conditions for the implementation of the future Regulation as regards the establishment of the decentralised IT system and the interconnection system for registers (

text: Article 60

text: ). According to recital 48, the access points of the decentralised IT system should be based on the e- CODEX system established by

text: Regulation (EU) 2022/850

text: 11. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 1 June 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in recital 59 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 12. The EDPS welcomes the clear references to

text: Regulation (EU) 2016/679

text: (‘the GDPR’), the EUDPR and the Directive

text: in recitals 53 and 56 of the Proposal.

text: 13. He also welcomes the specifications of the purposes of the processing of personal data and the roles and responsibilities of Member States’ authorities and the Commission regarding the processing of personal data . In particular, the EDPS notes that both Member States' competent authorities and Central Authorities would process personal data for the purposes set out in the Proposal and that they are all regarded as controllers in Article 53(3) of the Proposal, while, under Article 53(4) of the Proposal, the Commission is deemed the controller with respect to personal data processing by the European electronic access point pursuant to

text: Article 50

text: for the purposes of providing for electronic communications means with Member States’ competent authorities that natural and legal persons may use in connection with specific proceedings and applications under the future Regulation.

text: 14. Additionally, it is clear from the Proposal that, in order to fulfil their tasks, national authorities would inevitably need to process personal data, including special categories of personal data, in particular health data of the adults concerned by the Proposal . The EDPS would like to recall in this regard that the GDPR and the EUDPR in principle prohibit the processing of special categories of personal data except where the processing takes place in accordance with

text: Article 9(2)

text: GDPR or

text: Article 10(2)

text: EUDPR. Even in the cases covered under

text: Article 9(2)

text: (f) and (g) GDPR or 10(2)(f) or (g) EUDPR, the processing of such categories of personal data has to be necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity or for reasons of substantial public interest. With regard to the latter, such processing must be carried out on the basis of Union or Member State law, which must be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. The EDPS therefore welcomes recitals 56 and 57, which clarify that, on the one hand, the future Regulation should provide for the legal basis for processing of personal data by Member States’ competent authorities and Central Authorities under

text: Article 6(1)

text: and (3) GDPR as well as by the Commission pursuant to

text: Article 5(1)

text: and (2) EUDPR and on the other hand, that such special category of data will be processed in conformity with

text: Article 9(2)

text: (f) or (g) GDPR and

text: Article 10(2)

text: (f) or (g) EUPR.

text: 15. He also welcomes that recitals 57 and 58 clarify the special category of personal data within the meaning of the GDPR and the EUDPR that may be processed on the basis of the Proposal as well as the measures to safeguard the fundamental rights and the interests of the data subject required in

text: Article 9(2)

text: (g) GDPR and

text: Article 10(2)

text: (g) EUDPR.

text: 16. Finally, the EDPS notes that under Article 47 of the Proposal, the Commission must establish a system for the interconnection of the national registers by means of implementing acts, composed of the registers and of a central electronic access point to the information in the system. He welcomes that it is clarified in recital 46 that the Proposal should provide legal basis for that interconnection.

text: 3. Purposes of the processing of personal data by national authorities

text: 17. While the EDPS acknowledges that Article 53(2) of the Proposal recalls that the processing of personal data under the future Regulation must be limited to the extent necessary for its purposes, he recommends introducing a similar clarification in

text: Article 48(2)

text: on the access by requesting authorities to information recorded in a protection register: instead of referring to the ‘legitimate interest’ of the authority - which might then lead to confusion with the GDPR legal basis under

text: Article 6

text: (f) - the provision should state that access shall be provided only where necessary for one or several of the purposes (to be determined) listed in

text: Article 53(1)

text: 4. Direct communications between authorities

text: 18. It stems from

text: Article 49(2)

text: that for direct communications between authorities, any other means of communication may be used instead of the decentralised IT system. Recital 50 explains that in certain cross-border procedures for the protection of adults, other means of communication than communication through the decentralised IT system could be more appropriate, in particular where direct personal communication is needed so that less formal communication means, such as email, could be used.

text: 19. The EDPS notes in this regard that

text: Article 49(1)

text: does not make the use of decentralised IT system mandatory for any communications but only for written ones. As far as the latter are concerned, the EDPS recommends, to both ensure the security of the data and take account of the potential needs on the ground, that the enacting terms of the Proposal better reflect the subsidiary nature of these other means of communications, for instance by using the 7 following wording: ʽWhere the use of the decentralised IT system is not appropriate in view of the specific circumstances of the communication in question, any other means of communication may be usedʼʼ.

text: 5. Conclusions

text: 20. In light of the above, the EDPS makes the following recommendations: (1) to clarify under Article 48(2) of the Proposal that access by requesting authorities to information recorded in a protection register shall be provided only where necessary for one or several of the purposes (to be determined) listed in

text: Article 53(1)

text: in relation to the vulnerable adult concerned by the ongoing proceedings before the requesting authorities; (2) to clarify under Article 49(2) of the Proposal that any other means of communication may be used only ʽwhere the use of the decentralised IT system is not appropriate in view of the specific circumstances of the communication in questionʼ. Brussels, 18 July 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8


text: COM(2023) 279 final

text: OJ L 295, 21.11.2018, p. 39. 3 The Proposal for a Directive regarding the strengthening of Union retail investor protection rules is part of the Retail Investment Package, which also includes a Proposal for a Regulation amending

text: Regulation (EU) No 1286/2014

text: as regards the modernisation of the key information document, COM (2023) 0278 final. The present Opinion focuses exclusively on the Proposal for a Directive regarding the strengthening of Union retail investor protection rules, since the Proposal for a Regulation on the modernisation of the key information document does not entail an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data. 4 COM(2023) 279 final, p. 1-4 as well as Recitals 1 and 2 of the Proposal. European Commission, Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions. A Capital Markets Union for people and businesses-new action plan, issued on 24.9.2020, COM (2020)590 final.

text: https://commission.europa.eu/strategy-and-policy/priorities-2019-2024_en. 7 Directive

text: of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive

text: and Directive

text: (recast) Text with EEA relevance, OJ L 173, 12.6.2014, p. 349. 8

text: Directive (EU) 2016/97

text: of the European Parliament and of the Council of 20 January 2016 on insurance distribution (recast), OJ L 26, 2.2.2016, p. 19. 9 COM(2023) 279 final, p. 3. 10 European Commission, Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions on a Digital Finance Strategy for the EU, 24.09.2020, COM(2020) 591 final. 11 Proposal for a Regulation of the European Parliament and of the Council on a framework for Financial Data Access and amending Regulations

text: (EU) No 1093/2010

text: (EU) No 1094/2010

text: (EU) No 1095/2010

text: and

text: (EU) 2022/2554

text: , 28.06.2023, COM(2023) 360 final. 12 COM(2023) 279 final, p. 3-4. 13 Directive

text: of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), OJ L 201, 31.7.2002, p. 37–47.

text: Recital 31 of the Proposal. 15 Article 1(13) of the Proposal which introduces a new

text: Article 24

text: c(3) to Directive

text: (MiFID), and Article 2(42) of the Proposal which introduces

text: Article 26

text: a(3) to Directive 2016/97 (IDD). 16 Article 1(13) of the Proposal which introduces a new

text: Article 24

text: c(7) to Directive

text: (MiFID). 17 Article 2(42) of the Proposal which introduces

text: Article 26

text: a(7) to Directive 2016/97 (IDD). 18 See also WP29 Guidelines (endorsed by EDPB) on automated individual decision-making and profiling for the purpose of

text: Regulation (EU) 2016/679

text: , issued on 25 May 2018, p. 22 (“Automated decision-making that results in differential pricing based on personal data or personal characteristics could also have a significant effect if, for example, prohibitively high prices effectively bar someone from certain goods or services.” Another example of decisions having a significant effect concerns “decisions that affect someone’s financial circumstances”). 20

text: Directive (EU) 2016/97

text: Directive (EU) 2016/97

text: of the European Parliament and of the Council of 20 January 2016 on insurance distribution (recast), OJ L 26, 2.2.2016, p. 19–59. 21 See COM(2023) 279 final, p. 17 “

text: Article 24

text: c(7) MIFID and

text: Article 26

text: a(7) IDD extend the existing record keeping obligation to all marketing communications which are directly or indirectly made by the investment firms, insurance undertakings and insurance intermediaries. The obligation covers a period of 5 years, allowing for a derogation of up to 7 years at the request of competent authorities.” 22

text: Article 5(1)

text: (e) GDPR. 23 Judgment of the Court of Justice of 8 April 2014, Digital Rights Ireland (

text: ) and Seitlinger (

text: ), Joined cases

text: and

text: , ECLI:EU:C:2014:238, paragraph 64. 24 Recital 23 of the Proposal.

identifier: EDPS yttrande 34/2023

title: EDPS Opinion 34/2023 on the Proposal for a Directive amending Directives (EU) 2009/65/EC, 2009/138/EC, 2011/61/EU, 2014/65/EU and (EU) 2016/97 as regards the Union retail investor protection rules.

text: 18 July 2023

text: (EU) 2009/65

text: /EC,

text: and

text: (EU) 2016/97

text: as regards the Union retail investor protection rules

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to Proposal for a Directive of the European Parliament and of the Council amending Directives

text: (EU) 2009/65

text: /EC,

text: and

text: (EU) 2016/97

text: as regards the Union retail investor protection rules .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: (EU) 2009/65

text: /EC,

text: and

text: of the European Parliament and of the Council as regards the strengthening of Union retail investor protection rules (‘the Proposal’). The objective of the Proposal is to strengthen the legislative framework to ensure that retail investors are empowered to take more informed investments decisions that better correspond to their needs and objectives and are adequately protected in the single market.

text: The EDPS acknowledges that the use of influencers, social media and behavioural data to advertise financial products and services impacts the protection of consumers and, consequently, recognises the need to better protect retail investors. In this respect, the EDPS welcomes the introduction of the obligation on investments firms, insurance undertakings and insurance distributors to keep records on all marketing communications carried out by them or by third parties on their behalf, including information related to selected targeted retail client/customer segment(s) or profiling determinants as well as the identity of any third party involved in the dissemination of the marketing communication.

text: Profiling can pose significant risks for individuals’ rights and freedoms, particularly where it is used to advertise riskier financial products to vulnerable consumers. Investment firms, insurance undertakings or distributors carrying out profiling for the purpose of tailoring marketing communications should fully comply with the GDPR, including its rules on the principles relating to the processing of personal data, lawful basis, transparency, data subject rights and automated decision-making.

text: As regards the retention of the records of marketing communications to be held by investment firms, insurance undertakings and insurance intermediaries, the EDPS recommends further justifying the proposed retention periods.

text: Finally, the EDPS understands that the exchange of information in the context of the collaboration platforms to be set up by the European Securities and Markets Authorities (ESMA) and the European Insurance and Occupational Pensions Authority (EIOPA) would not involve processing of personal data. Should these platforms be meant to enable the processing of personal data, then such processing should be made explicit, together with the relevant categories of personal data, purpose(s) of processing, relevant retention period and roles and responsibilities, according to data protection law.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 24 May 2023, the European Commission issued a Proposal for a Directive of the European Parliament and of the Council amending Directives

text: (EU) 2009/65

text: /EC,

text: and

text: 2. The objective of the Proposal is to ensure that the legal framework for retail investments sufficiently empowers consumers, encourages improved and fairer market outcomes and ultimately creates the necessary conditions to grow retail investor participation in capital markets. The Proposal aims to increase consumers’ trust in capital markets by empowering them to take more informed investment decisions that better correspond to their needs and objectives and adequately protect them in the single market by a coherent regulatory framework .

text: 3. The Proposal is in line with the new Capital Markets Union action plan issued by the Commission in September 2020. In this context, the Commission announced its intention to put forward a strategy for retail investments in Europe, aimed at ensuring that retail investors can take full advantage of capital markets and that they are supported by rules 4 that are coherent across all relevant legal instruments. The Proposal is also in line with the European Commission’s objective of “an economy that works for people” .

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 25 May 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 39 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to Recital 60 of EUDPR in relation to a draft version of the Proposal.

text: 2. General remarks

text: 5. The EDPS welcomes the objective of the Proposal, which aims to ensure a sufficient degree of investor protection as well as fairness, integrity and efficiency in the provision of investment and insurance-based investment services to retail investors. These objectives are in line with those of existing legislation governing retail investor protection at EU level, which consists of the Markets in financial instruments Directive (MiFID ) and the Insurance 8 9 Distribution Directive (IDD ) . In particular, given its focus on the increasing digitalisation of investment services and marketing, the Proposal is aligned with the Commission’s work on consumer protection in the context of digital finance , which aims at ensuring that consumers enjoy the benefits of digitalisation while being sufficiently protected from the risks arising from it. The Proposal is also relevant in context of the Proposal on financial data sharing as it provides a standardised report on suitability or appropriateness assessment, which should promote data sharing and re-use of such information by other firms selected by the client .

text: 6. The EDPS welcomes the reference to the applicability of the GDPR and the EUDPR to all personal data processing pursuant to the Proposal in Recital 40. As the communications and marketing practices mentioned in the Proposal should also abide by the rules on unsolicited communications and confidentiality of communications contained Directive

text: on privacy and electronic communications (‘ePrivacy Directive) , the EDPS also welcomes the reference to the ePrivacy Directive in Recital 40 of the Proposal. 5

text: 3. Marketing communications and practices

text: 7. The EDPS acknowledges that the use of influencers, social media and behavioral data to bolster and tailor advertising of financial products and services impacts advertising and the protection of consumers. Consequently, the EDPS recognises the need to address the changes brought by such practices to better protect retail investors, as highlighted by the Proposal .

text: 8. The EDPS welcomes that the Proposal would introduce an obligation for Member States to ensure that “[...] marketing practices are developed and used in a manner that is fair and not misleading [...]” for recipients, and that they are also appropriate for the target audience .

text: 9. The EDPS also welcomes the introduction of the obligation on investments firms , insurance undertakings and insurance distributors to keep records on all marketing communications carried out not only by them, but also by any third party remunerated or incentivised through non-monetary compensation by the investment firm. In particular, the EDPS welcomes the requirement to keep records of information related to targeted retail client/customer segment(s) or profiling determinants, as well as the identity of any third party involved in the dissemination of the marketing communication. The requirement to make such records available upon request to the competent supervisory authority could enhance the transparency and accountability of investments firms’ marketing practices towards competent supervisory authorities.

text: 10. While transparency and accountability are basic principles of data protection, compliance with Article 1(3) of the Proposal does not equal compliance with the GDPR. The EDPS recognises that companies may wish to rely on profiling to segment markets and tailor services and products to align with individual needs. Profiling can, however, pose significant risks for individuals’ rights and freedoms, particularly where it is used to advertise riskier financial products to vulnerable consumers . From a data protection perspective, many risks relate to the possible lack of transparency and effective control of individuals regarding the processing of their personal data, as the underlying processing of personal data resulting in the delivery of a targeted marketing message, pricing or contractual conditions is often opaque . Therefore, the EDPS recalls that investment firms, insurance undertakings or distributors carrying out profiling of individuals for the purpose of tailoring marketing communications should fully comply with the GDPR, including its 6 rules on the principles relating to the processing of personal data, lawful basis, transparency, data subject rights and automated decision-making.

text: 11. Additionally, the EDPS welcomes that Article 1(13) of the draft Proposal - which would introduce a new

text: Article 24

text: c(7) to Directive

text: - and

text: Article 2(42)

text: - which would introduce a new

text: Article 26

text: a(7) to Directive 2016/97 (IDD) - proposes a maximum retention period to be applied to investment firms, insurance undertakings and insurance intermediaries’ records of marketing communications .

text: 12. The EDPS acknowledges the attempt to justify this retention period in Recital 32, which refers to the fact that “[...] issues with financial products and services may arise several years after the investment”. At the same time, the EDPS recalls that one of the basic principles of data protection is that personal data is not kept in a form that permits identification of data subjects for longer than necessary for the purpose(s) for which the data were collected . In accordance with the Court of Justice of the European Union (CJEU) case law, the determination of the storage duration must be based on objective criteria, in order to ensure that it is limited to what is strictly necessary . In this regard, the EDPS is of the view that the justification for the chosen retention period, which refers in a broad manner to the fact that issues may arise several years after the investment, is not sufficiently precise and, therefore, recommends further substantiating it.

text: 4. Publication of administrative decisions containing personal data

text: 13. Article 1(4) and 2(24) of the Proposal, which would introduce respectively a new

text: Article 5

text: a MiFID and

text: Article 35

text: a IDD, would require the European supervisory authorities (ESMA) and the European Insurance and Occupational Pensions Authority (EIOPA) to publish on their websites warning lists in the form of decisions about unauthorised investment services or activities which would include the description of the natural or legal persons concerned . The provisions further specify that “As regards natural persons, this list shall not lead to the publication of more personal data of those natural persons than that published by the competent authority pursuant to the first subparagraph, and in accordance with

text: Article 71(1)

text: [of Directive

text: ].” 7

text: 14. As stated in Recital 23 of the Proposal, “[...] When those actions concern a natural person, the publication of the decision made by the competent authority should remain subject to the case-by-case assessment of the proportionality of the publication of personal data provided under

text: Article 71(1)

text: ”. The same Recital further specifies that “[...] to avoid the disclosure of personal information deemed disproportionate by a competent authority when publishing the consolidated list of all decisions issued by competent authorities, ESMA and EIOPA should abstain from disclosing any additional information compared to that disclosed by the competent authority itself”.

text: 15. The EDPS welcomes this limitation, as he considers that the publication of personal data with the decisions of competent authorities should indeed be the exception, to be decided following a case-by-case assessment as prescribed in Article 1(4) and 2(24) of the Proposal. This would leave the option, following such assessment, to competent authorities to publish said personal data in cases of serious infringements and where strong dissuasive effects are needed. The EDPS notes that the publication of personal data of persons involved in European supervisory authorities’ decisions about unauthorised investment services or activities should only occur in duly justified exceptional cases, as making such types of personal data available to the general public could be considered as a serious interference with their fundamental rights enshrined in Articles 7 and 8 of the Charter.

text: 5. Collaboration platforms by the European Securities and Markets Authorities (ESMA) and the European Insurance and Occupational Pensions Authority (EIOPA)

text: 16. Articles 1(21) and 2(7) of the Proposal would introduce the new

text: Article 87

text: a MiFID and

text: Article 12

text: b IDD, with the possibility for - respectively - the ESMA and EIOPA to set up and coordinate a collaboration platform, to strengthen the exchange of information and to enhance collaboration between the relevant supervisory authorities.

text: 17. The EDPS understands, based on the text of the Proposal, that the exchange of information that would take place in the context of this platform would not entail processing of personal data. If, however, the platforms in question are meant to allow European supervisory authorities to exchange personal data, the EDPS advises the co-legislators to specify explicitly whether personal data would be processed and if so, to define the relevant categories of personal data, the purpose(s) for which such personal data would be processed, the relevant retention period, as well as roles and responsibilities according to data protection law of the actors involved. 8

text: 6. Conclusions

text: 18. In light of the above, the EDPS makes the following recommendations: (1) to further justify the retention period for the records of marketing communications to be held by investment firms, insurance undertakings and insurance intermediaries, in line with the principle of storage limitation enshrined in

text: Article 5(1)

text: (e) GDPR; and (2) to the extent that the collaboration platforms to be set up by ESMA and EIOPA would entail the processing of personal data, to define the categories of personal data to be processed in this context together with the relevant purpose(s), retention period, as well as the roles and responsibilities of the actors involved. Brussels, 18 July 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 9


text: COM(2023) 273 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 273 final. 4 COM(2023) 273 final, p. 9. COM(2023) 273 final, p. 2. 6 Annexes to the International Convention for the Prevention of Pollution from Ships, 1973 as modified by the Protocol of 1978 (“Marpol 73/78”). 4

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: , OJ L 119, 4.5.2016, p. 1.

text: Article 10

text: a(2) letters a), b) and c) of the Proposal. 5

text: See also recital 19 of the Proposal. 10 OJ L 305, 26.11.2019, p. 17. 11 In that regard, see EDPS Guidelines on processing personal information within a whistleblowing procedure, issued on December 2019. 12 See

text: Article 4(1)

text: (e) EUDPR and 5(1)(e) GDPR. 13 See to that effect EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: , issued on 7 November 2019. Doing so would not only promote legal certainty, but would also serve to address the requirement of

text: Article 25(2)

text: (e) EUDPR. 6

text: See EDPS Guidance on Article 25 of the new Regulation and internal rules, issued on December 2018. 15 See EDPS Guidelines - 'Assessing the necessity of measures that limit the fundamental right to the protection of personal data: A Toolkit', issued on 25 February 2019; EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data, issued on 19 December 2019; EDPS quick-guide to necessity and proportionality, issued on 28 January 2020. See in addition also the EDPB Guidelines 10/2020 on restrictions under

text: Article 23

text: GDPR, issued on 13 October 2021. 16 See EDPS Guidance on Article 25 of the new Regulation and internal rules, issued on December 2018. paragraph 4. 17 See

text: Article 25(2)

text: EUDPR. 7

identifier: EDPS yttrande 35/2023

title: EDPS Opinion 35/2023 on the Proposal for a Directive on ship-source pollution and on the introduction of penalties, including criminal penalties, for pollution offences

text: 25 July 2023

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Directive of the European Parliament and of the Council amending Directive

text: on ship-source pollution and on the introduction of penalties, including criminal penalties, for pollution offences .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: on ship-source pollution and on the introduction of penalties, including criminal penalties, for pollution offences.

text: The EDPS welcomes that the Proposal would require Member States to anonymise information relating to penalties when reporting on actions undertaken by their competent authorities. As other categories of reporting information listed in the Proposal might also contain personal data, the EDPS recommends extending the obligation to anonymise personal data to those additional categories.

text: As regard the reporting of potential infringements, the EDPS welcomes the fact that the Proposal would require the Commission to ensure the protection of the whistle-blowers when putting in place a centralised online external reporting channel.

text: While the Proposal does not explicitly state that the Commission acts as a controller for the processing of personal data, this follows implicitly from the competence and tasks of the Commission as regards the centralised online external reporting channel. The EDPS recommends explicitly clarifying in the Proposal that the Commission acts as a controller in relation the centralised online external reporting channel. In addition, he recommends establishing the maximum storage period for any personal data collected.

text: The Proposal states that the Commission may restrict the application of data subject rights in relation to data subjects who are part of or mentioned in the report submitted through the centralised online external reporting channel and who are not the data subjects submitting this report. In this regard, the EDPS recalls that certain data subject rights and EUI obligations may be restricted only when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society, aim to safeguard one of the objectives specifically listed in

text: Article 25

text: EUDPR, and be in line with other requirements laid down in that provision. Against this background, the EDPS recommends re-assessing certain restrictions envisaged by the Proposal and ensuring that those restrictions are limited to what is both necessary and proportionate.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 1 June 2023, the European Commission issued the Proposal for a Directive of the European Parliament and of the Council amending Directive

text: on ship-source pollution and on the introduction of penalties, including criminal penalties, for pollution offences (‘the Proposal’).

text: 2. According to its Explanatory Memorandum, the general objective of the Proposal is to ensure that persons responsible for discharges of polluting substances into sea are subject to effective, proportionate and dissuasive penalties, in order to improve maritime safety and to enhance protection of the marine environment from pollution by ships.

text: 3. The specific objectives of the Proposal are to: • incorporate international standards into EU law by aligning the Directive with Marpol Annexes on discharges into the sea; • support Member States by building their capacity to detect pollution incidents, verify, collect evidence and effectively penalise identified offenders in a timely and harmonised manner; • ensure that persons (natural and legal) responsible for illegal discharges from ships are subject to effective, proportionate and dissuasive penalties; and • ensure simplified and effective reporting on ship-source pollution incidents and follow-up activities.

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 1 June 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 20 of the Proposal.

text: 2. General remarks

text: 5. The EDPS welcomes the objectives of the Proposal, namely ensuring that persons responsible for discharges of polluting substances into sea are subject to effective, proportionate and dissuasive penalties, in order to improve maritime safety and to enhance protection of the marine environment from pollution by ships.

text: 6. The EDPS notes that the Proposal would entail processing of personal data, notably personal data relating to reports of potential infringements as well as relating to the electronic reporting tool.

text: 7. Having this in mind, the EDPS welcomes Recital 23 of the Proposal stating:“[t]his Directive respects the fundamental rights and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union, including the protection of personal data (...)”. The EDPS recommends including an additional recital in the Proposal recalling that the EUDPR and the General Data Protection Regulation (‘GDPR’) apply to any processing of personal data carried out under the Proposal.

text: 3. Anonymisation of personal data

text: 8. According to

text: Article 10

text: a(1) of the Proposal, the Commission shall establish an electronic reporting tool, for the purposes of collection and exchange of information between the Member States and the Commission on the implementation of the enforcement system provided by the Proposal. Paragraph 2 of the same Article lists the information that should be reported by the Members States through the electronic reporting tool.

text: 9. The EDPS welcomes

text: Article 10

text: a(2)(d) of the Proposal providing for the anonymisation of information relating to penalties that include personal data. As the other categories reporting information listed in the Proposal might also contain personal data, the EDPS recommends extending the obligation to anonymise personal data to those additional categories.

text: 4. Protection of persons who report potential infringements

text: Article 10

text: d of the Proposal would require the Commission to make available a confidential online external reporting channel for receiving reports on potential illegal discharges and to relay such reports to the Member State or Member States concerned . The centralised reporting channel, which would complement existing reporting channels provided at national level, should ensure the protection of the confidentiality of the identity of reporting persons in accordance with

text: Directive (EU) 2019/1937

text: of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (‘

text: Directive (EU) 2019/1937

text: 11. The EDPS welcomes that the Proposal would require the Commission to ensure the protection of the whistle-blowers . At the same time, the EDPS recalls that personal data must not be kept in a form which permits identification of data subjects for longer than is necessary for the purposes for which the data are collected and/or further processed . Therefore, the EDPS recommends establishing the maximum storage period for processing of personal data in the Proposal.

text: 12. While the Proposal does not explicitly state that the Commission acts as a controller for the processing of personal data, this follows implicitly from the competence and tasks of the Commission in relation to the centralised online external reporting channel. Therefore, the EDPS recommends specifying in the Proposal that the Commission acts as controller in relation the centralised online external reporting channel .

text: 13. Pursuant to

text: Article 10

text: d(3), the Commission may restrict the application of

text: Articles 14

text: to 22, 35, and 36, as well as

text: Article 4

text: EUDPR for the data subjects who are part of or mentioned in the report submitted through the centralised online external reporting channel and who are not the data subjects submitting this report. According to recital 19 of the Proposal, the restrictions are meant to ensure the protection of the confidentiality of the identity of reporting persons as well as to prevent and address attempts to hinder reporting or to impede, frustrate or slow down follow-up of investigations.

text: 14. The EDPS recalls that data subject rights and EUI obligations that may be restricted under

text: Article 25(1)

text: are exclusively those provided by

text: Articles 14

text: to 22 EUDPR as well as Articles

text: and

text: EUDPR and

text: Article 4

text: EUDPR (in so far as its provisions correspond to the rights and obligations provided for in

text: Articles 14

text: to 22), when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society and aim to safeguard one of the objectives specifically listed under the EUDPR . As a result, restrictions to data protection rights need to be duly justified and targeted, following a necessity and proportionality test .

text: 15. The EDPS recommends re-assessing the restrictions mentioned in

text: Article 10

text: d(3) and ensuring that any restrictions to data subject rights are both necessary and proportionate. For example,

text: Article 10

text: d(3) indicates that the Commission may restrict the application of

text: Article 15

text: EUDPR.

text: Article 15

text: EUDPR concerns information to be provided where personal data are collected from the data subject. As

text: Article 10

text: d(3) of the Proposals relates to personal data regarding individuals "who are not the data subjects submitting this report",

text: Article 15

text: EUDPR would in any event not be applicable and therefore no restriction should be provided for.

text: 16. In addition, the EDPS recalls that restrictions on data subject rights should as a general rule be provided for by legal acts and it is only in these matters and in absence of such legal act that restrictions may be provided for by internal rules . Consequently, the EDPS is of the view that restrictions on data subject rights, to the extent they are demonstrably necessary and proportionate, should be provided by the Proposal itself. The EDPS recalls that, in line with

text: Article 25(2)

text: EUDPR, such clauses restricting data subject rights must contain specific provisions including the specification of the controller (or categories of controllers), the categories of personal data and the relevant storage periods . Each of these elements should be clearly set out in the enacting terms of the Proposal.

text: 5. Other specific comments

text: 17. The EDPS notes that, under

text: Article 10

text: a(3) of the Proposal, the Commission would be empowered to adopt implementing acts laying down detailed rules on the procedure for reporting the information mentioned in paragraph 2 of this Article.

text: 18. In this regard, the EDPS recalls that such draft implementing act can be expected to have an impact on the protection of personal data, and are therefore subject to the consultation obligation set out in

text: Article 42(1)

text: EUDPR.

text: 6. Conclusions

text: 19. In light of the above, the EDPS makes the following recommendations: (1) to include a recital in the Proposal recalling the applicability of the EUDPR and the GDPR to any processing of personal data carried out under the Proposal; (2) to extend the obligation to anonymise personal data to letters a), b) and c) of

text: Article 10

text: a (2); (3) to establish the maximum storage period for processing of personal data in the Proposal under

text: Article 10

text: d; (4) to specify the role of the Commission as controller regarding the centralised online external reporting channel under

text: Article 10

text: d; (5) to ensure that the restrictions envisaged in

text: Article 10

text: d (3) are limited to what is necessary and proportionate and to specify, in the enacting terms of the Proposal, each of the relevant elements listed in

text: Article 25(2)

text: EUDPR. Brussels, 25 July 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8