text: OJ L 119, 4.5.2016, p. 1. OJ L 295, 21.11.2018, p. 39. OJ L 119, 4.5.2016, p. 89. OJ L 186, 14.7.2012, p. 4–16. OJ L 215, 11.8.2012, p. 5–14. Opinion 1/15 of the Court of Justice of 26 July 2017 pursuant to

text: Article 218(11)

text: TFEU on draft Agreement between Canada and the EU on the transfer and processing of PNR data,ECLI:EU:C:2017:592. ICAO, Doc 9944 Guidelines on Passenger Name Record (PNR) Data, First Edition — 2010. Security Council resolution 2396 (2017) on threats to international peace and security caused by returning foreign terrorist fighters, adopted by the Security Council at its 8148th meeting, on 21 December 2017, point 12. See the Explanatory Memorandum to the Recommendation for Council Decision, doc. COM(2019) 420 final from 27.9.2019. See

text: Article 3(5) of Directive (EU) 2016/681

text: Directive (EU) 2016/681

text: , Recitals 6 and 7. CJEU, Opinion 1/15, EU-Canada PNR Agreement, ECLI:EU:C:2017:592, par. 93 Commission Implementing Decision of 23 January 2019 pursuant to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council on the adequate protection of personal data by Japan, OJ L 76, 19.3.2019 See also EDPS Necessity Toolkit available at: https://edps.europa.eu/sites/edp/files/publication/17-06- 01_necessity_toolkit_final_en_0.pdf Latest in the EDPS Opinion 5/2015 on the Proposal for a Directive of the European Parliament and of the Council on the use of Passenger Name Record data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, available at: https://edps.europa.eu/sites/edp/files/publication/15-09- 24_pnr_en.pdf CJEU, Opinion 1/15, EU-Canada PNR Agreement, ECLI:EU:C:2017:592, par. 151. Ibid, par. 232(3)(c). CJEU judgments in

text: Case C-43/12

text: Commission v Parliament and Council, par. 29 and

text: Case C-263/14

text: Parliament v Council, par. 43. CJEU, Opinion 1/15, EU-Canada PNR Agreement, ECLI:EU:C:2017:592, par. 232.

text: Regulation (EU) 2016/794

text: of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and rep ealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA, OJ L 135, 24.5.2016, p. 53. CJEU, Opinion 1/15, EU-Canada PNR Agreement, ECLI:EU:C:2017:592, par. 160. Commission Implementing Decision on the adequate protection of personal data by Japan, Recital 30.

text: Article 16

text: TFEU and Article 8(3) of the Charter,

text: Article 45(2)

text: (b) GDPR CJEU judgments in

text: Case C-362/14

text: Schrems,

text: Case C-518/07

text: Commission v Germany, and

text: Case C-288/12

text: Commission v Hungary. Commission Implementing Decision on the adequate protection of personal data by Japan, point 3.2.2. of the preamble and Annex II. See EDPS Opinion 2/2019 on the negotiating mandate of an EU-US agreement on cross-border access to electronic evidence and EDPS Opinion 3/2019 regarding the participation in the negotiations in view of a Second Additional Protocol to the Budapest Cybercrime Convention, available at: https://edps.europa.eu/sites/edp/files/publication/19-04-02_edps_opinion_on_eu_us_agreement_on_eevidence_en.pdf and https://edps.europa.eu/sites/edp/files/publication/19-04-02_edps_opinion_budapest_convention_en.pdf.

identifier: EDPS yttrande 06/2019

amnesord:
International Agreements
PNR
Security
EU Passengers Name Record

title: EU-Japan Passenger Name Record Data Agreement

text: Opinion 6/2019

text: EDPS Opinion on the negotiating mandate of an Agreement between the EU and Japan for the transfer and use of Passenger Name Record data

text: 25 October 2019 1 | P a g e

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’ and under article 57(1)(g), the EDPS shall ‘advise on his or her own initiative or on request, all Union institutions and bodie s on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data’.

text: He was appointed in December 2014 together with the Assistant Supervisor with the specific remit of being constructive and proactive. The EDPS published in March 2015 a five -year strategy setting out how he intends to implement this remit, and to be accountable for doing so.

text: This Opinion relates to the EDPS' mission to advise the EU institutions on coherently and consistently applying the EU data protection principles when negotiating agreements in the law enforcement sector, in line with Action 5 of the EDPS Strategy: ‘Mainstreaming data protection into international agreements’. It builds on the general obligation that international agreements must comply with the provisions of TFEU and the respect for fundamental rights that stands at the core of EU law. In particular, compliance with Articles 8 of the Charter of Fundamental Rights of the EU and 16 TFEU must be ensured.

text: 2 | P a g e

text: Executive Summary

text: On 27 September 2019, the European Commission adopted a Recommendation for a Council Decision to authorise the opening of negotiations for an agreement between the European Union and Japan for the transfer and use of Passenger Name Record (PNR) data to prevent and combat terrorism and other serious transnational crime. The purpose of the envisaged Agreement is to lay down the legal basis and the conditions under which air carriers will be authorised to transfer to Japan the PNR data of passengers flying between the EU and Japan, in compliance with the requirements of the EU law, including the Charter of Fundamental Rights of the EU.

text: The EDPS welcomes the fact that the negotiation mandate aims at ensuring full respect for fundamental rights and freedoms enshrined in Article 7 and Article 8 of the Charter of Fundamental Rights of the EU, as well as for the principles of necessity and proportionality, as interpreted by the Court of Justice in its Opinion 1/15 on the EU-Canada PNR Agreement.

text: Given the impact of the envisaged agreement on the fundamental rights of a very large number of individuals not implicated in a criminal activity, the EDPS considers that it should contain all the necessary substantive and procedural safeguards to guarantee the proportionality of the PNR system and to limit the interference with the right to privacy and data protection only to what is strictly necessary and justified by the general interest of the Union. To this end, the EDPS makes a number of recommendations to improve the negotiating directives, such as:

text: - a strict approach with regard to the necessity and proportionality of the PNR system; - in line with the principle of purpose limitation, any further use of the transferred PNR data for other purposes should be very well justified, specified in a clear and precise manner and limited to what is strictly necessary; - the Council Decision authorising opening of negotiations should contain a reference not only to the procedural legal basis but also to the substantive legal basis, including Article 16 TFEU; - special attention should be paid to prevent the risk of indirectly revealing special categories of data about air passengers, as well as the risk of re-identification of individuals after the anonymisation of the PNR data relating to them; - the envisaged Agreement should contain clauses allowing for its suspension in case of breaches of its rules, as well as for termination of the Agreement if the non-compliance is serious and persistent.

text: Further detailed recommendations by the EDPS are provided in this Opinion.

text: The EDPS remains at the disposal of the institutions for further advice during the negotiations. He also expects to be consulted at later stages of the finalisation of the draft Agreement in accordance with

text: Article 42 of Regulation (EU) 2018/1725

text: 3 | P a g e

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular

text: Article 16

text: thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles

text: and

text: thereof, Having regard to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) , Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: , in particular

text: Articles 42(1)

text: , Having regard to

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA ,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION AND BACKGROUND

text: 1. On 27 September 2019, the European Commission adopted a Recommendation for a Council Decision to authorise the opening of negotiations for an agreement between the European Union (EU) and Japan for the transfer and use of Passenger Name Record (PNR) data to prevent and combat terrorism and other serious transnational crime. The Annex to the Recommendation (hereinafter “the Annex”) lays down the Council’s negotiating directives to the Commission, i.e. the objectives the latter should aim to achieve on behalf of the EU in the course of the negotiations.

text: 2. The Recommendation has been adopted on the basis of the procedure laid down in Article 218 of the Treaty on the Functioning of the European Union (TFEU) for agreements concluded between the EU and third countries. With this Recommendation, the Commission seeks to obtain authorisation from the Council to be appointed as the negotiator on behalf of the EU and to start the negotiations with Japan, in line with the negotiating mandate. Once the negotiations are completed, in order for the agreement to be concluded, the European Parliament will have to give its consent to the text of the agreement negotiated, after which the Council will have to adopt a decision concluding the agreement.

text: 3. The legal framework for processing PNR data in the EU is

text: Directive (EU) 2016/681

text: of the European Parliament and of the Council on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious 5 | P a g e crime (PNR Directive), adopted on 27 April 2016. Member States were obliged to bring into force the laws, regulations and administrative provisions necessary to comply with the Directive by 25 May 2018. The European Commission has to conduct the first review of the PNR Directive by 25 May 2020.

text: 4. Currently, there are two international agreements in force between the EU and third countries on the processing and transfer of PNR data - with Australia and with the United States , both from 2011. At the request of the European Parliament, pursuant to

text: Article 218(11)

text: TFEU, the Court of Justice of the EU (CJEU) adopted Opinion 1/15 of 26 July 2017 on the envisaged Agreement between the EU and Canada on the transfer and processing of PNR data, signed on 25 June 2014. The Court concluded that the Agreement is incompatible with Articles

text: and

text: and Article 52(1) of the Charter of Fundamental Rights of the EU (Charter) in so far as it does not preclude the transfer of sensitive data from the EU to Canada and the use and retention of that data. Furthermore, the Court laid down a number of conditions and safeguards for lawful processing and transfer of PNR data. Based on Opinion 1/15, new PNR negotiations with Canada have been launched in June 2018, which, according to the Commission, are in their final stage.

text: 5. At global level, the issue of PNR data is dealt with by the Convention on International Civil Aviation (the ‘Chicago Convention’) of 1947, which regulates international air transport and has established the International Civil Aviation Organization (ICAO). The Council of ICAO has adopted Standards and Recommended Practices on PNR, which are part of Annex 9 (‘Facilitation’) to the Chicago Convention. They are complemented by additional guidance, notably ICAO Document 9944 setting out ‘Guidelines on Passenger Name Record (PNR) Data’ . All EU Member States are Parties to the Chicago Convention.

text: 6. Furthermore, the United Nations Security Council Resolution 2396 (2017) on threats to international peace and security caused by returning foreign terrorist fighters, adopted on 21 December 2017, requires UN Member States to “develop the capability to collect, process and analyse, in furtherance of ICAO standards and recommended practices, passenger name record (PNR) data and to ensure PNR data is used by and shared with all their competent national authorities, with full respect for human rights and fundamental freedoms”, as well as “where appropriate, encourages Member States to share PNR data with relevant or concerned Member States to detect foreign terrorist fighters” .

text: 7. The EDPS welcomes the fact that he has been consulted following the adoption of the Recommendation by the European Commission and expects that a reference to this Opinion will be included in the preamble of the Council Decision. The present Opinion is without prejudice to any additional comments that the EDPS could make on the basis of further available information at a later stage.

text: 2. OBJECTIVES OF THE AGREEMENT

text: 8. The objective of the envisaged Agreement is to lay down the legal basis, the framework and the conditions under which air carriers will be authorised to transfer to Japan PNR data of passengers flying between the EU and Japan in a manner that is compliant with the requirements of EU law, including the Charter as interpreted by the CJEU .

text: 9. ‘Passenger Name Record’ or ‘PNR’ means a record of each passenger's travel requirements in the reservation and departure control systems, or in equivalent systems with the same 6 | P a g e functionalities, with the information necessary to enable reservations to be processed by air carriers for each journey booked . PNR may contain different types of data, such as travel dates, travel itinerary, ticket information, contact details, travel agent through which the flight was booked, means of payment used, seat number, baggage information, etc.

text: 10. In accordance with the PNR Directive, PNR data are used to prevent, detect, investigate and prosecute terrorist offences and serious crime, to gather evidence and, where relevant, to find associates of criminals. Moreover, the assessment of PNR data may allow identification of persons who were not previously suspected of involvement in terrorist offences or serious crime and who are subject to further examination by the competent authorities .

text: 11. As the purpose of the envisaged Agreement is to circumscribe the conditions under which air carriers may transfer PNR data of passengers to Japanese public authorities, the EDPS wishes to recall that the transfer of personal data, such as PNR data, from the EU to a third country is lawful only if there are rules in that country which ensure a level of protection of fundamental rights and freedoms that is essentially equivalent to that guaranteed within the EU . Furthermore, such transfer may take place only in compliance with the provisions on international transfers laid down in Chapter V of

text: Regulation (EU) 2016/679

text: (GDPR).

text: 12. The adequacy decision in relation to the transfer of personal data from the EU to Japan, adopted by the European Commission on 23 January 2019 pursuant to

text: Article 45(3) of Regulation (EU) 2016/679

text: , applies only to transfers between commercial operators and cannot be used as legal basis in the case of PNR data. Hence, the envisaged Agreement must include appropriate legally binding and enforceable safeguards, in accordance with

text: Article 46(2)

text: (a) of

text: Regulation (EU) 2016/679

text: . Moreover, the Agreement must ensure that the level of data protection of natural persons guaranteed by the EU law is not undermined in case of onward transfers to competent authorities of other third countries.

text: 3. MAIN RECOMMENDATIONS

text: 3.1. Necessity and proportionality

text: 13. The EDPS has in multiple opinions voiced its concerns in relation to the blanket collection of PNR data, which entails an interference with the fundamental rights of a very large number of air passengers, without any initial differentiation, limitation or exception being made, in the light of the objective of fighting against serious crime and terrorism.

text: 14. At the same time, the EDPS is mindful of the assessment of the CJEU that such interferences “are capable of being justified by an objective of general interest of the European Union and are not liable adversely to affect the essence of the fundamental rights enshrined in Articles 7 and 8 of the Charter” .

text: 15. In view of the policy objectives and the legal framework outlined above, the EDPS believes that a key objective of the negotiations should be to ensure that the future Agreement contains the necessary substantive and procedural safeguards, which, considered in their entirety, would guarantee the proportionality of the PNR system. To this end, the EDPS welcomes the fact that the negotiation directives in the Annex to the Recommendation are based upon the requirements laid down by CJEU in its Opinion 1/15. 7 | P a g e 3.2. Purpose limitation

text: 16. Purpose limitation is one of fundamental principles of the EU data protection legal framework and a key prerequisite for ensuring the proportionality of any interference with the rights enshrined in Articles 7 and 8 of the Charter. It is even more important in the context of PNR which involves processing by law enforcement authorities of personal data of a very large number of individuals not implicated in a criminal activity.

text: 17. The EDPS appreciates the fact that points 3 and 5 of the negotiating directives in the Annex to the draft Council Decision explicitly limit the transfer and use of PNR data to the “sole purpose of preventing and combating terrorism and other serious transnational crime”. Regarding possible further use of PNR data for other purposes, point 8(g) of the negotiating directives states that “[t]he use of PNR data by the Japanese competent authority beyond security and border control checks should be based on new circumstances and subject to substantive and procedural conditions based on objective criteria. In particular, such use should be subject to a prior review carried out either by a court or by an independent administrative body, except in cases of validly established urgency”. The EDPS acknowledges that this directive is directly derived from Opinion 1/15 of CJEU .

text: 18. Nevertheless, to the extent the future Agreement would allow for further use of the PNR data for other purposes not directly linked to “preventing and combating terrorism and other serious transnational crime”, the EDPS recommends that these new purposes should be very well justified, specified in a clear and precise manner in the envisaged Agreement, and limited to what is strictly necessary. 3.3. Substantive legal basis of the Council Decision

text: 19. The explanatory memorandum of the Recommendation states that it is based on

text: Article 218

text: TFEU. The preamble to the draft Council Decision also refers to

text: Article 218 (3)

text: and (4) TFEU. However, the preamble does not refer to any substantive legal basis for this legal act.

text: 20. In accordance with

text: Article 296 (2)

text: TFEU and the settled case law of the CJEU , the EDPS questions the fact that the citations in the preamble to the Council Decision only refer to the appropriate procedural legal basis and do not equally refer to the relevant substantive legal basis. The EDPS recalls that, in a similar law enforcement context, the CJEU found that “the Council Decision on the conclusion of the envisaged Agreement [between Canada and the European Union on the transfer and processing of Passenger Name Record] data must be based jointly on

text: Article 16(2)

text: and

text: Article 87

text: (2 )(a) TFEU” .

text: 21. It follows from the Annex on the negotiating directives that the Commission should simultaneously pursue several objectives during the negotiations of the envisaged Agreement, among which allowing the transfer of personal data and ensure respe ct for the fundamental rights enshrined in the Charter, including the rights to privacy and the protection of personal data. The envisaged Agreement would thus relate directly to the objective pursued by

text: Article 16

text: TFEU. Therefore, the EDPS recommends adding in the preamble of the Council Decision a reference to the appropriate substantive legal basis for the future Agreement, which should include

text: Article 16

text: TFEU. 8 | P a g e

text: 4. ADDITIONAL RECOMMENDATIONS

text: 4.1. Transfer of operational personal data

text: 22. Point 4 of the Annex to the Recommendation provides that the Agreement should “also acknowledge the transfer of PNR data to Japan as fostering police and judicial cooperation [...] through the transfer of analytical information flowing from PNR data” and “ensure the transfer of analytical information flowing from competent authorities of Japan to police and judicial authorities of the Member States, as well as to Europol and Eurojust within their respective competences”. The EDPS wonders whether “analytical information” in this objective of the negotiating directives would cover operational personal data and whether transfers of such data would take place from the EU, i.e. police and judicial authorities of the Member States, Europol and Eurojust, to the competent public authorities of Japan.

text: 23. In such cases, the EDPS recalls that the transfers of operational personal data from the EU to Japan should be in compliance with specific legal frameworks laid down in Chapter V of

text: Directive (EU) 2016/680

text: Article 25 of Regulation (EU) 2016/794

text: , Chapter IX of

text: Regulation (EU) 2018/1725

text: and the conditions in

text: Article 11 of Directive (EU) 2016/681

text: 24. Therefore, the EDPS recommends clarifying in the negotiating directives whether the envisaged police and judicial cooperation between the competent public authorities of Japan and the police and judicial authorities of the Member States, as well as with Europol and Eurojust, would include such transfers of operational personal data from the EU to Japan. If this is the case, references to the appropriate legal basis for transfers of operational personal data should at least be included. 4.2. Special categories of personal data (sensitive data)

text: 25. The EDPS welcomes the fact that point 8(b) of the negotiating directives explicitly envisages a prohibition of processing of sensitive data within the meaning of EU law. Nevertheless, it should be borne in mind that the above-mentioned ICAO Doc 9944 “Guidelines on PNR Data” includes as an element of PNR “general remarks including Other Supplementary Information (OSI), Special Service Information (SSI) and Special Service Request (SSR) information”. Moreover, the CJEU in its Opinion 1/15 has concluded that “it may even encompass information entirely unrelated to the purpose of the transfer of PNR data” and “cannot be regarded as being delimited with sufficient clarity and precision” .

text: 26. In those circumstances, the EDPS recommends to the Commission as EU negotiator to pay special attention to the way in which the categories of PNR data are defined for the purpose of the Agreement in order to prevent the possibility of transferring and processing of information that could indirectly reveal special categories of data about air passengers, such as religious or philosophical beliefs or health data. 4.3. Anonymisation of personal data

text: 27. Point 8(h) of the negotiating directives provides for anonymisation of PNR data as an alternative to deletion upon the expiry of the retention period. In this context, the EDPS would like to recall the finding of the Commission in the course of the negotiations with Japan on the adequacy decision that the concept of "anonymously processed personal 9 | P a g e information", as defined by the Japanese legislation, includes data for which reidentification of the individual is still possible and thus could be considered a form of "pseudonymisation" rather than "anonymisation" .

text: 28. Given this divergence in concepts, the EDPS invites the Commission to ensure that, when referring to “anonymous personal data” in the future Agreement, it is meant as anonymisation of PNR data in such a manner that the individual concerned is no longer identifiable, as stated in point 8(h) of the negotiating directives. 4.4. Independent oversight

text: 29. Both the EU legislation and the settled case law of CJEU spell out the existence and the effective functioning of one or more independent supervisory authorities as an essential guarantee of the right to data protection. The Commission adequacy decision on Japan offers an overview of the Japanese system of independent oversight in the area of law enforcement and security .

text: 30. Given the complexity of the Japanese system and the various supervisory authorities involved, the EDPS recommends the clear identification of the specific authority or authorities entrusted by Japan with the independent oversight of compliance with the rules of the PNR Agreement.

text: 31. In addition, the EDPS sees particular added value in developing international cooperation for the protection of personal data in the field of PNR data between the supervisory authorities of the EU and Japan, in line with

text: Article 50 of Regulation (EU) 2016/679

text: and

text: Article 40 of Directive (EU) 2016/680

text: . 4.5. Suspension and termination of the Agreement

text: 32. The EDPS notes that points 13 to 15 of the negotiating directives in the Annex stipulate legal possibilities for regular joint review, dispute settlement and automatic renewal of the future Agreement. However, the negotiating directives do not provide for the possibility to suspend or terminate the Agreement in case of breach of its rules by a Contracting Party.

text: 33. Similarly to the provisions of

text: Article 45(5) of Regulation (EU) 2016/679

text: and

text: Article 36(5) of Directive (EU) 2016/680

text: regarding adequacy decisions for commercial and law enforcement purposes respectively, the EDPS recommends introducing in the negotiating directives the possibility to suspend the Agreement in case of breaches of its provisions , as well as for terminating it if the non-compliance is serious and persistent.

text: 5. CONCLUSIONS

text: 34. The EDPS welcomes the fact that the negotiation mandate aims at ensuring full respect for fundamental rights and freedoms enshrined in

text: Article 7

text: and Article 8 of the Charter, as well as for the principles of necessity and proportionality, as interpreted by the CJEU in its Opinion 1/15 on the EU-Canada PNR Agreement.

text: 35. Given the impact of the envisaged Agreement on the fundamental rights of a very large number of individuals not implicated in a criminal activity, the EDPS considers that the 10 | P a g e future Agreement should contains all the necessary substantive and procedural safeguards, which, considered in their entirety, would guarantee the proportionality of the PNR system and to limit the interference with the right to privacy and data protection only to what is strictly necessary and justified by the general interest of the EU.

text: 36. To this end, as main recommendation, the EDPS stresses the need of a strict approach with regard to the necessity and proportionality of the PNR system. Furthermore, special attention should be given to the practical implementation of the principle of purpose limitation concerning the use of the transferred PNR data. In addition, the EDPS repeats its position from its previous opinions that the Council Decision authorising opening of negotiations pursuant to

text: Article 218

text: TFEU should contain a reference not only to the procedural legal basis but also to the relevant substantive legal basis, which should include

text: Article 16

text: TFEU.

text: 37. The additional recommendations of the EDPS in the present Opinion relate to the appropriate legal framework for transfer of operational personal data; the need to prevent the risk of indirectly revealing special categories of data about air passengers, as well as the risk of re-identification of individuals after the anonymisation of PNR data relating to them. The EDPS underlines also the need to clarify the independent supervision of PNR data processing by the competent Japanese authorities, which is one of the essential guarantees for the right to data protection. In addition, the EDPS recommends the introduction of clauses allowing for the suspension of the future Agreement in case of breaches of its provisions, as well as for termination of the Agreement if the noncompliance is serious and persistent.

text: 38. The EDPS remains at the disposal of the Commission, the Council and the European Parliament to provide advice at further stages of this process. The comments in this Opinion are without prejudice to any additional comments that the EDPS could make as further issues may arise and would then be addressed once further information is available. To this end, the EDPS expects to be consulted later on the provisions of the draft Agreement before its finalisation. Brussels, 25 October 2019 Wojciech Rafał WIEWIÓROWSKI 11 | P a g e

text: Notes

text: 12 | P a g e


text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), L119 of 4.5.2016.

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: , L 295, 21.11.2018. See

text: Recital 60

text: of

text: Regulation (EU) 2018/1725

text: : “In order to ensure consistency of data protection rules throughout the Union, when preparing proposals or recommendations, the Commission should endeavour to consult the European Data Protection Supervisor. A consultation by the Commission should be obligatory

text: following the adoption of legislative acts or during the preparation of delegated acts and implementing acts as

text: defined in Article

text: and

text: TFEU and following the adoption of recommendations and proposals relating to agreements with third countries and international organisations as provided for in

text: Article 218

text: TFEU which have an impact on the right to protection of personal data. In such cases, the Commission should be obliged to consult the European Data Protection Supervisor, except where the

text: Regulation (EU) 2016/679

text: provides for mandatory consultation of the European Data Protection Board, for example on adequacy decisions or delegated acts on standardised icons and requirements for certification mechanisms.” See Explanatory Memorandum of the Proposal The EDPS would like to recall that tax evasion issues in relation to digital platforms, having regard to indirect taxation, have formed the object of the EDPS Opinion 1/2019 on two legislative proposals relating to combating VAT fraud, available at: https://edps.europa.eu/sites/edp/files/publication/19-03- 15_edps_opinion_on_two_legislative_proposals_relating_to_combating_vat_fraud_en.pdf whereby the EDPS noted, among others, “In particular, we point out to that, in the context of these proposals, the data undergoing processing should not relate to the consumers (the payers) but only to the online businesses (payees). This would limit the risk of the information being used for other purposes, such as controlling purchase habits of the consumers. We appreciate the fact that the Commission followed this approach and we strongly

text: recommend that this approach is maintained in the negotiations with the co-legislators leading to the final

text: approval of the proposals.” The new Article 25(3) of the Directive provides that “Notwithstanding paragraph 1, each Member State shall ensure that its competent authority or each Reporting Financial Institution or intermediary or Reporting Platform Operator, as the case may be, whichis under its jurisdiction: (a) informs each individual concerned that information relating to this individual will be collected and transferred in accordance with this Directive; (b) provides to each individual all information that the individual is entitled to from the data controller in sufficient time for the individual to exercise his data protection rights and, in any case, before the information is reported. See https://edps.europa.eu/sites/edp/files/publication/18-05- 31_preliminary_opinion_on_privacy_by_design_en_0.pdf Available at https://edps.europa.eu/sites/edp/files/publication/15-06-17_comments_tax_rulings_en.pdf (COM (2015) 135) Sellers are defined in the Proposal, under Section I, 5, B of Annex V, as “a Platform user that is registered at any moment during the Reportable Period on the Platform and carries out the Relevant Activity. Entities may also qualify as Sellers. An “Active Seller” is any Seller that provided Relevant Activity during the Reportable Period. A “Reportable Seller” is any Active Seller, other than an Excluded Seller, that carried out a Relevant Activity during the Reportable Period while being resident in a Member State or that rented immovable property located in a Member State during the Reportable Period.” “The Commission shall develop and provide technical and logistical support for a secure central interface on administrative cooperation in the field of taxation where Member States communicate with the use of standard forms pursuant to

text: Article 20(1)

text: and (3). The competent authorities of all Member States shall have access to that interface. For the purpose of collecting statistics, the Commission shall also have access to the information which is recorded to the interface and can be extracted automatically. The access by the Commission shall be without prejudice to the obligation of Member States to provide statistics on exchanges of information in accordance with

text: Article 23(4)

text: The Commission shall, by means of implementing acts, lay down the necessary practical arrangements. Those

text: Guidelines on the protection of personal data in IT governance and IT management of EU institutions, March 2018, available at: https://edps.europa.eu/sites/edp/files/publication/it_governance_management_en.pdf https://edps.europa.eu/sites/edp/files/publication/19-03- 15_edps_opinion_on_two_legislative_proposals_relating_to_combating_vat_fraud_en.pdf EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: , available at: https://edps.europa.eu/sites/edp/files/publication/19-11- 07_edps_guidelines_on_controller_processor_and_jc_reg_2018_1725_en.pdf EDPS Opinion 1/2019 on two legislative proposals relating to combating VAT fraud, page 8, paragraph 13. Recital 25: “Reporting Financial Institutions, intermediaries, Reporting Platform Operators and the competent authorities of each Member State shall be considered to be joint data controllers and the Commission shall be considered to be data processor within the meaning of Regulation

identifier: EDPS yttrande 06/2020

amnesord:
Charter of Fundamental Rights
Article 7 - right to private life
Article 8 - right to data protection
Privacy by Design
Privacy by Default
Finance & Economy
Tax cooperation

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion on the proposal for an amendment of Council Directive 2011/16/EU relating to administrative cooperation in the field of taxation

serie: yttranden

text: Opinion 6/2020

type: rubrik

text: on a proposal for an amendment of

text: Council Directive 2011/16/EU

text: relating to administrative cooperation in the field of taxation

text: 28 October 2020 1 | P a g e

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under

text: Article 52(2) of Regulation (EU) 2018/1725

text: ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’ and under

text: Article 57(1)

text: (g), the EDPS shall ‘advise on his or her own initiative or on request, all Union institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data’.

text: He was appointed in December 2020 with the specific remit of being constructive and proactive.

text: This Opinion is issued by the EDPS, within the period of eight weeks from the receipt of the

text: regard to the impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data of the following proposal for a legislative act adopted by the Commission: Proposal for a Council Directive amending Directive

text: on administrative cooperation in the field of taxation.

text: 2 | P a g e

text: Executive Summary

text: With this Opinion, issued pursuant to

text: Article 42(1) of Regulation (EU) 2018/1725

text: , the EDPS puts forward recommendations aiming at minimizing the impact of a Commission’s legislative proposal amending Directive

text: on administrative cooperation in the field of taxation on the fundamental right to privacy and to the protection of personal data of individuals. These recommendations are intended to ensure compliance with the applicable data protection legal framework, while avoiding jeopardizing the efficacy and efficiency of the administrative action on the fight against tax evasion.

text: Whereas the EDPS acknowledges that tax compliance is an important objective of public interest, he insists that the right balance should be struck between the attainment of such goal and the right to privacy and personal data protection. In this regard, he calls for particular attention to the implementation of the principles of data protection by design and by default, data minimisation and data accuracy in the context of automatic exchanges of information between national tax authorities.

text: Concerning the management of the secure central interface on administrative cooperation in the field of taxation, the EDPS stresses the need for the Commission to ensure compliance with the provisions on security of processing under

text: Regulation (EU) 2018/1725

text: , in particular following the EDPS “Guidelines on the protection of personal data in IT governance and management of EU institutions”. Moreover, the EDPS considers that the role of the Commission with regard to the management of the secure central interface pursuant to

text: Regulation (EU) 2018/1725

text: , needs to be further ascertained in particular in the light of any further arrangement with Member States and the factual circumstances of the technical and logistical support provided within the system..

text: The EDPS also stresses that, pursuant to

text: , it expects to be consulted before its adoption by the Commission, on the implementing acts that will define the administrative arrangements to provide technical and logistical support for the secure central interface where Member States communicate with the use of standard forms pursuant to Directive

text: Finally, he recalls that in its capacity as competent supervisory authority under

text: Regulation (EU) 2018/1725

text: , the EDPS may follow up on possible updates concerning the secure central interface and, more broadly, the implications stemming from the Commission role within the processing operations in the context of the administrative cooperation on taxation.

text: 3 | P a g e

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular

text: Article 16

text: thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles

text: and

text: thereof,

text: Having regard to

text: Regulation (EU) 2016/679

text: (General Data Protection Regulation) ,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION AND BACKGROUND

text: 1. On 2 September the EDPS was consulted by the European Commission on a Proposal for a Council Directive amending Directive

text: on administrative cooperation in the field of taxation that was adopted on 15 July 2020 (hereafter, the “Proposal”). This consultation is made pursuant to Article 42 of Regulation 2018/1725.

text: 2. Previously, on 29 April 2020 and on 5 May 2020 draft versions of the Proposal were submitted to the EDPS. The EDPS welcomes and encourages the possibility to be consulted by the Commission early in the policy-making process with a view to minimising the impact of the proposals on the fundamental rights to privacy and to the protection of personal data .

text: 3. The EDPS notes that the Proposal aims at improving the existing framework for the exchanges of information and administrative cooperation for the purpose of fighting tax evasion, having regard to direct taxation and the raising importance of digital platforms used by “sellers”. In addition to reinforcing existing rules, the Proposal highlights that “the expansion of administrative cooperation to new areas is required in the EU, in order to address the challenges posed by the digitalisation of the economy and help tax administrations better collect their taxes and keep pace with new developments”.

text: 4. The EDPS acknowledges the objectives of the Proposal and, in particular, the need to address the cross-border dimension of the services offered through the use of digital platform operators. As recalled by Recital 6 of the Proposal, “tax compliance is suboptimal and the value of unreported income is significant. Member States' tax administrations have insufficient information to correctly assess and control gross income earned in their country from commercial activities performed with the intermediation of digital platforms. This is particularly problematic where the income or taxable amount flows via platforms established in another jurisdiction.” 5 | P a g e

text: 5. The present Opinion focusses on the relevant aspects of the Proposal with regard to the protection of personal data of individuals and seeks to provide a pragmatic advice on how to minimise the impact of the processing of personal data required by the Proposal for taxation purposes, while maintaining the effectiveness of the envisaged measures.

text: 2. COMMENTS AND RECOMMENDATIONS

text: 2.1 General remarks

text: 6. The EDPS acknowledges that the fight against tax evasion is an important objective of general interest whose attainment would significantly benefit from a better exchange between national administrations. By improving the exchanges of information, national tax administrations could reduce the risk of information asymmetries that represent an obstacle to complete tax collection.

text: 7. At the same time, the EDPS would like to highlight that the right balance should be struck between the achievement of tax compliance and the right to privacy and personal data protection. To this purpose, it is important that the systems created and used for the exchange of information follow an approach which respects data protection rights, including the principles of data minimisation and data accuracy.

text: 8. The EDPS welcomes that the Directive strives to respect the principle of data minimisation in line with in

text: Article 5(1)

text: (c) of the GDPR and

text: Article 4(1)

text: (c) of

text: Regulation (EU) 2018/1725

text: , which provide that personal data must be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed". In this regard, in the Explanatory Memorandum of the Proposal the Commission states that “the set of data elements to be transmitted to tax administrations are defined in a way to capture only the minimum data necessary to detect noncompliant underreporting or non-reporting, in line with the with the GDPR obligations”.

text: 9. Moreover, the EDPS welcomes also that the Proposal expressly provides for data protection safeguards within Directive

text: . In particular, Article 1(19) of the Proposal amending Article 25(3) of the Directive establishes an obligation for Member States to ensure that its competent authority or each Reporting Financial Institution or intermediary or Reporting Platform Operator, as the case may be, complies with the right of information by informing “each individual concerned that information relating to this individual will be collected and transferred in accordance with the Directive”, and providing “to each individual all information that he/she is entiled to from the data controller in sufficient time for the individual to exercise his data protection rights and, in any case, before the information is reported”.

text: 10. The EDPS notes that the Proposal is in line with the principle of storage limitation established in

text: Article 5(1)

text: (e) of the GDPR. Pursuant to this principle, personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. In this regard, the EDPS welcomes that Section IV, paragraph B, of Annex V of the Proposal specifies a minimum and a maximum retention period of retention of the records of the steps undertaken and the information relied upon for the reporting requirements. 6 | P a g e

text: 11. Regarding the systems created and used for the exchange of information within the scope of Directive

text: , the EDPS draws attention to Opinion 5/2018 on privacy by design , which provides examples of methodologies to identify privacy and data protection requirements and integrate them into privacy engineering processes in view of implementing appropriate technological and organisational safeguards.

text: 12. The EDPS draws attention to the fact that the Proposal provides for the automatic exchange of information reported by Platform Operators between Member States. In particular, the automatic exchange of information pursuant to

text: Article 8

text: s and 8ac of

text: Council Directive 2011/16/EU

text: shall be carried out using a standard computerised format adopted by the Commission that is aimed at facilitating such automatic exchange. On this point, the EDPS recalls its formal comments on the proposal for a previous amendment of Directive

text: issued on 17 June 2015, which remain relevant to the Proposal. In particular, he notes that while the Directive

text: regulated information exchange in relation to both natural and legal persons, it provides that the automatic exchange of information shall not apply in a case where an advance cross-border ruling exclusively concerns and involves the tax affairs of one or more natural persons. 2.2 Specific Remarks 2.2.1 Extent of the information to be reported by Reporting Platforms Operators to the national tax administrations

text: 13. The Proposal also puts forward new reporting rules (reporting obligations) for platform operators, laid down in particular under new

text: Article 8

text: ac of Directive

text: , and further specified in Annex V of the Proposal. The “Relevant Activity” to be reported by the “Reporting Platform Operators” include the rental of immovable property, a personal or professional service, the sale of goods, the rental of any mode of transport (by so-called “Sellers”) . The information, as collected and verified, shall be reported by the platforms operators to the national competent tax authority within one month following the end of the Reportable Period. Reporting shall only take place in one Member State (i.e. single reporting).

text: 14. According to the new

text: Article 8

text: ac of Directive

text: (as inserted by Article 1(6) of the Proposal), “each Member State shall take the necessary measures to require Reporting Platform Operators to carry out the due diligence and reporting requirements laid down in Sections II and III of Annex V”. In particular, Section III.B.2.c) of Annex V of the Proposal indicates that each Reporting Platform Operator shall report with respect to each Reportable Seller that carried out Relevant Activity, other than immovable property rental, the following information: “where different from the name of the Reportable Seller, the name of the holder of the financial account to which the Consideration is paid or credited, to the extent available to the Reporting Platform Operator, as well as any other identifying information available to the Reporting Platform Operator with respect to that account holder”.

text: 15. In this regard, the EDPS considers that the scope of this provisions is too broad, as it could involve the transfer of any type of identifying information from the Seller, even data which may be excessive for the purposes of the reporting obligation. Therefore, the EDPS recommends amending this provision to better define the “identifying 7 | P a g e information” to be reported, for instance by aligning it with the very similar one in Section III.B.3.c) of Annex V of the Proposal concerning immovable property rental services, and limiting the information required to that of financial nature, i.e. specifying “as well as any other financial identification information available to the Reporting Platform Operator with respect to the account holder” (emphasis added). Indeed, in the EDPS’s view, there is no justification for a more extensive scope of the provision only based on the type of relevant activity performed by the Reportable Seller and thus, the more limited one should be preferred. 2.2.2 On the data processing through the secure central interface on administrative cooperation in the field of taxation provided by the Commission

text: 16. A key element of the Proposal is brought forward by

text: Article 1(15)

text: , which adds

text: Article 21(7)

text: to the

text: Council Directive 2011/16/EU

text: , provides that “the Commission shall develop and provide technical and logistical support for a secure central interface on administrative cooperation in the field of taxation where Member States communicate with the use of standard forms pursuant to

text: Article 20(1)

text: and (3).” (…)” and shall “by means of implementing acts, lay down the necessary practical arrangements” .

text: 17. According to the information provided by the Commission, the secure central interface is in place since 1 January 2019. The new paragraph (7) to

text: Article 21 of Directive 2011/16/EU

text: is intended to provide a legal basis for the said secure central interface, since in practice, the Commission will continue to provide technical and logistical support to the interface as before. In this regard, the EDPS recalls that when providing such technical and logistical support, the Commission must comply with all relevant provisions of the

text: Regulation (EU) 2018/1725

text: , and that the strict respect of the provisions on security of processing are of particular importance. In this context, the EDPS draws attention to its “Guidelines on the protection of personal data in IT governance and IT management of EU institutions” . Moreover, the EDPS considers that the safeguards applicable to the management of the central database listed in its Opinion 1/2019 on two legislative proposals relating to combating VAT fraud , are also applicable in this case.

text: 18. The EDPS also notes that, according to the wording of the new

text: Article 25

text: paragraphs 2 and 3 of Directive

text: , the Commission would have the role of processor. However, the EDPS, in line with his recent Guidelines on the notion of controller 14 15 and processor as well as with previous Opinions , considers that it cannot be excluded that the Commission, contrary to the wording of the Proposal , might have the role of controller or joint controller with the Member State’s competent authorities. In the EDPS’s view, the role of the Commission pursuant to

text: Regulation (EU) 2018/1725

text: , needs to be further ascertained in particular in the light of an assessment of the Commissions’ decision-making capacity arising from the particular arrangements with the Member States and the factual circumstances of the technical and logistical support provided within the central secure interface. In other words, the EDPS invites the Commission to make an assessment as to its decision-making power over the means used for the processing of the personal data in the central secure interface, in order to exclude a potential implicit competence as controller or joint controller. Therefore, we recommend to reconsider the qualification of the Commission as “processor” in the Proposal (under the new Article

text: and

text: 8 | P a g e

text: 19. Finally, the EDPS highlights that he expects to be consulted by the Commission prior to the adoption of the implementing acts lay down the necessary practical arrangements for the secure central interface in accordance with

text: 3. CONCLUSIONS

text: 20. In the light of the above, the EDPS recommends the following: - To follow an approach which respects data protection rights, particularly the principles of data protection by design and by default, data minimisation and data accuracy in the systems created and used for the exchange of information; - To amend Section III.B.2.c) of Annex V of the Proposal to better specifying the “identifying information” to be reported and restricting it to financial identification information; - to ensure compliance of the secure central interface with the provisions on security of processing under

text: Regulation (EU) 2018/1725

text: , in particular following the EDPS “Guidelines on the protection of personal data in IT governance and management of EU institutions”; - with regard to the secure central interface, to reconsider the reference to the role of the Commission as “processor” in the Proposal (under the new

text: Article 25(2)

text: and (5) of Directive

text: as inserted by Article 1(19) of the Proposal and in Recital 25 of the Proposal); Brussels, 28 October 2020 Wojciech WIEWIÓROWSKI (e-signed) 9 | P a g e

text: Notes

text: 10 | P a g e

text: 11 | P a g e

type: vagledning

utgivare: edps


text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), L119 of 4.5.2016.

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: , L 295, 21.11.2018. Proposal for a Regulation of the European Parliament and of the Council on Markets in Crypto-assets, and amending

text: Directive (EU) 2019/1937

text: , COM/2020/593 final. Available at EUR-Lex - 52020PC0593 - EN - EUR- Lex (europa.eu) Proposal for a Regulation of the European Parliament and of the Council on Digital Operational Resilience for the Financial sector and Amending Regulations

text: (EC) No 1060/2009

text: (EU) No 648/2012

text: (EU) No 600/2014

text: and

text: (EU) No 909/2014

text: , COM/2020/595 final, available at EUR-Lex - 52020PC0595 - EN - EUR-Lex (europa.eu) Proposal for a Directive of the European Parliament and of the Council amending Directives

text: , EU/2013/36,

text: (EU) 2015/2366

text: and EU/2016/2341, COM/2020/596 final. Available at EUR-Lex - 52020PC0596 - EN - EUR-Lex (europa.eu) Article 2(3) of the Proposal “Blockchains and Data Protection in the European Union”, Michele Finck, EDPL 1/2018, available at https://edpl.lexxion.eu/data/article/12327/pdf/edpl_2018_01-007.pdf The potential impact of DLTs on securities post-trading harmonisation and on the wider EU financial market integration available at https://www.ecb.europa.eu/paym/groups/ami/shared/pdf/201709_dlt_impact_on_harmonisation_and_integration .pdf Idem, Blockchains and Data Protection in the European Union, Michele Finck, EDPL 1/2018 See

text: Article 29

text: Data Protection Working Party Opinion 05/2014 on Anonymisation Techniques, adopted 10 April 2014 Idem, Blockchains and Data Protection in the European Union, Michele Finck, EDPL 1/2018. See also “They who must not be Identified – Distinguishing Personal from Non-Personal Data under the GDPR”, Michèle Finck, Frank Pallas, Max Planck Institute for Innovation and Competition Research Paper No. 19-14. available at https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3462948 “Front-running is trading stock or any other financial asset by a broker who has inside knowledge of a future transaction that is about to affect its price substantially. A broker may also front-run based on insider knowledge that his or her firm is about to issue a buy or sell recommendation to clients that will almost certainly affect the price of an asset”. https://www.investopedia.com/terms/f/frontrunning.asp

text: European Securities and Markets Authority’s, Report with advice on Initial Coin Offerings and Crypto-Assets (

text: ), available at esma50-157-1391_crypto_advice.pdf (europa.eu) Briefing European Parliamentary Research Service (europa.eu), page 5, available at https://www.europarl.europa.eu/RegData/etudes/BRIE/2017/599348/EPRS_BRI(2017)599348_EN.pdf PR_COD_1amCom (europa.eu) DRAFT REPORT on the proposal for a regulation of the European Parliament and of the Council on a pilot regime for market infrastructures based on distributed ledger technology (COM(2020)0594 – C9-0305/2020 – 2020/0267(COD)) Committee on Economic and Monetary Affairs Rapporteur: Johan Van Overtveldt See also https://adan.eu/wp-content/uploads/2021-01-11-Adan-EUCI-Pilot-Regime-Shortcomings-andproposals-1.pdf Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679

text: Article 36

text: GDPR.

text: See CJEU ruling in Breyer v. Germany (Case 582/14),

identifier: EDPS yttrande 06/2021

title: EDPS Opinion on the Pilot regime for market infrastructures based on Distributed Ledger Technology

text: Opinion 6/2021

text: on the Proposal for a Pilot Regime for Market Infrastructures based on Distributed Ledger Technology

text: 23 April 2021 1 | P a g e

text: The European Data Protection Supervisor (EDPS) is an independent EU authority, its responsibilities are outlined under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’. Under Article 58(3)(c) of Regulation 2018/1725, the EDPS shall have the power ‘to issue on his or her own initiative or on request, opinions to Union institutions and bodies and to the public on any issue related to the protection of personal data’. Wojciech Wiewiorówski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: 2 | P a g e

text: Executive Summary

text: On 24 September 2020 the European Commission adopted its Proposal for a Regulation of the European Parliament and of the Council on a pilot regime for market infrastructures based on Distributed Ledger Technology (COM(2020)594 final). The Proposal establishes harmonised requirements for certain market participants to apply for and be granted permission to operate digital ledger technology (DLT) market infrastructures.

text: The EDPS highlights that the protection of personal data does not constitute an obstacle to innovation and in particular, for the development of new technologies in the financial sector. At the same time, he recalls that measures adopted at EU level regarding innovative technologies involving the processing of personal data must comply with the general principles of necessity and proportionality. Moreover, given the lack of full view of the of these new technologies impact on our society, the EDPS considers that the precautionary principle

text: approach should be followed.

text: The EDPS notes that depending on the DLT’s configuration, the meta or transactional data stored therein may be considered personal data, if it relates to an identified or identifiable natural person. Thus, the controllers must carefully analyse and document the DLT’s configuration in order to determine whether personal data is processed thereby and as a consequence, the operations are subject to the data protection obligations.

text: The EDPS highlights that the technology behind some digital ledgers, particularly those that are public and permissionless, rises crucial questions with regard to its compatibility with data protection requirements.

text: The EDPS notes that in case of DLT’s containing on-chain personal data, the processing operations relating thereto will likely meet the criteria for the classification of the processing operation as of high risk. Therefore, the controller shall prior to the processing of personal data, carry out a data protection impact assessment for the envisaged processing operations. Moreover, prior approval from the competent data protection authority may be required.

text: The EDPS recommends that the Proposal requests, as part of the application to operate a DLT Market Infrastructure related information, where applicable, the core information in relation to the processing operations envisaged. Moreover, he recommends that operators of DLT market infrastructures should publish the privacy notice in the same place of its operating information as required by the Proposal.

text: The EDPS highlights that IT and cyber arrangements foreseen in the Proposal for the operation of DLT Market Infrastructures must be also in line with the obligations set by Articles 22 and 32 of the GDPR.

text: Finally, in the context of reporting of operational issues by DLT Market Infrastructures’ operators, the EDPS recommends reminding in a recital that in cases of personal data breaches, these shall also be notified by the operator to the competent data protection authority, in

text: 3 | P a g e

text: accordance with Article 33 of the GDPR, and, if applicable, to the data subjects, in accordance with Article 34 of the GDPR. 4 | P a g e

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to

text: Regulation (EU) 2016/679

text: (the General Data Protection Regulation) ,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1 BACKGROUND

text: 1. On 24 September 2020 the European Commission adopted its Proposal for a Regulation of the European Parliament and of the Council on a pilot regime for market infrastructures based on Distributed Ledger Technology (COM(2020)594 final) (the “Proposal”). The Proposal establishes harmonised requirements for specific market participants, namely investment firms, market operators or central securities depositories, to apply for and be granted permission to operate digital ledger technology market infrastructures (“DLT Market Infrastructure”) in a supervised environment with the application of specific exemptions to compliance with financial regulations. In particular, the Proposal has four objectives: providing legal certainty for crypto-assets, ensuring financial stability, protecting consumers and investors and enabling innovation towards the use of blockchain, distributed ledger technology and crypto assets.

text: 2. This Proposal is part of a package that includes a proposal for a regulation to build markets 3 4 in cryptoassets (the “MICA Regulation”), a proposal for digital operational resilience (the “DORA Regulation”), and a proposal to clairfy or amend certain related EU financial services rules . The EDPS expects to be consulted also on the other regulations of the package in line with Article 42(1) of Regulation (UE) 2018/1725.

text: 3. On 26 February 2021 the European Commission requested the European Data Protection Supervisor (the “EDPS”) to issue an opinion on the Proposal, in accordance with Article 42(1) of Regulation (UE) 2018/1725. These comments are limited to the provisions of the Proposal that are relevant from a data protection perspective. 6 | P a g e 2 PRELIMINARY REMARKS REGARDING DIGITAL LEDGER TECHNOLOGIES

text: 4. The EDPS notes that, as stated in the Explanatory Memorandum, the Proposal responds to the European Union policy objective of developing and promoting the uptake of transformative technologies in the financial sector. To this purpose, the Proposal lays down a legal framework shaping the requirements of multilateral trading facilities and securities settlement systems using DLT to temporarily operate market infrastructures using this technology while being exempted from compliance with some requirements under the Union financial services legislation.

text: 5. The Proposal’s subject scope covers investment firms, market operators and central securities depositories that wish to apply for permission to operate a DLT Market Infrastructure, i.e. either a DLT multilateral trading facility or a DLT securities settlement system. In this regard, the DLT multilateral trading facility consist of a multilateral system which brings together multiple third-party buying and selling interests in DLT transferable securities (i.e. crypto-assets that qualify as financial instruments), and that may be permitted to record and settle transactions in DLT transferable securities and to provide safekeeping services related thereto . The DLT securities settlement system’s role is to settle transactions in DLT transferable securities against payment.

text: 6. The EDPS highlights that the protection of personal data does not constitute an obstacle to innovation and in particular, for the development of new technologies, both in the financial sector or in other areas. At the same time, we insist that the general principles of necessity and proportionality must guide the adoption of measures at EU level that involve processing of personal data in the financial sector. Moreover, as in any case when development and roll-out of new technologies is not supported by a full and clear view of its impact on society, the precautionary principle approach should be followed.

text: 7. The EDPS notes that the technology behind digital ledgers involves a peer-to-peer network based on a synchronised and replicated data infrastructure built upon a cryptographic system. This system uses pairs of keys, namely public keys (for identification) and private keys (for authentication and encryption) connected by means of a mathematical relationship . Multiple peers (computers) store the transations chronologically by linking each new published data block to previous blocks of transactions through a cryptographic hashing process. The peers store each a replica of the ledger .

text: 8. The EDPS acknowleges that the data categories stored through DLT systems may vary significantly from one to another, depending for example, on whether they are permissioned or permisionless, the specific technical and organisational measures applied, etc. In this regard, the data stored most commonly in DLT are “the header”, which includes the timestamp, the identity of the block’s source and the previous block hash, and “the block content” (or payload) which contains the data to be stored, i.e. the transaction . Depending on the DLT’s configuration, the meta- or transactional data stored therein may be considered personal data, if it relates to an identified or identifiable natural person. The EDPB has stated that, in principle, transactional data in encrypted form or subject to a hashing process is also considered personal data, as they are not irreversibly prevented from identification . Whereas certain DLT systems may opt for a design that stores data off-chain where the DLT merely holds validity proofs, the EDPS notes that, considering existing and forthcoming guidance of data protection authorities, controllers must carefully analyse 7 | P a g e and document whether such proofs are still personal data and thus, the processing is subject to data protection obligations .

text: 9. The EDPS highlights that the technology behind some digital ledgers, particularly those that are public and permissionless, rises crucial conceptual questions with regard to its compatibility with data protection requirements, inter alia, the difficulty in identifying the controller and the processor roles in DLT against the requirement of a clear allocation of responsibilities for personal data processing as required by Article 79 of the GDPR, the crossborder scope of the transactions or the immutability and perpetual data storage by the blocks of the ledger in relation to the data protection principle of data accuracy and the right to object. Moreover, ESMA has pointed to privacy issues in relation to clients’ data being misused to 12 13 front run transactions of others .

text: 10. The EDPS is of the view that a discussion about the compatibility of DLT systems in general with the data protection framework should take place before the Proposal enters into force. Lacking this discussion, for the purposes of this Opinion, the EDPS wishes to stress that the DLT Market Infrastructures must be able to demonstrate at least that GDPR compliance is achieved with respect to the processing operations taking place therein (accountabilty principle). 3 GENERAL COMMENTS ON THE PILOT REGIME FOR DLT MARKET INFRASTRUCTURES

text: 11. With the caveats expressed in the previous section, the EDPS welcomes the aim of the Proposal to create a supervised space for experimentation (the so-called regulatory sandbox) based on specific derogations from compliance with the Union financial legislation for the use of DLT in the trading and post-trading of crypto-assets that qualify as financial instruments. The EDPS insists that the crypto-assets traded in the DLT Market Infrastructures covered by the Proposal should be only those using a DLT configuration that complies with the European and national data protection frameworks.

text: 12. The EDPS acknowleges that the Proposal will contribute to the integration of the Capital Markets Union, and more in particular, facilitate the cross-border operation of Market Infrastructures, inter alia, by speeding the clearing and settlement by reducing the number of intermediaries involved in the process and by making the reconciliation more efficient, facilitating the recording of ownership of securities and the safekeeping of assets, or reducing the ambiguity of contract terms . These benefits have also been acknowleged in the Draft Report by the European Parliament on the Proposal . Moreover, the framework created by the Proposal will also allow financial supervisors and legislators to identify risks and the legislative gaps, while regulators and firms themselves will gain valuable knowledge about the application of DLT.

text: 13. The EDPS notes that the Proposal appears to apply only to permissioned blockchains, and not to public and permissionless ones. In this regard, the Proposal refers to the rules on the functioning of the proprietary DLT they operate (Recital 28), to the possibility of the operaters lose their permissions and exemptions where a flaw has been discovered in the underlying technology or the services or activities provided by the DLT Market Infrastructure (Recital 37), or the obligation by operators of DLT Market Infrastructure to establish rules on the functioning of the DLT that they operate (

text: Article 6.2

text: ) . Based on the aforesaid, the EDPS concludes that the operators of the DLT Market Infrastructures would be controllers 8 | P a g e under the GDPR, when recording and settling transactions in DLT transferable securities involving on-chain personal data.

text: 14. At the same time, the EDPS would like to highlight that the benefits of new technologies do not come without risks. Indeed, in case of DLT’s containing on-chain personal data, the processing operations relating thereto will likely meet two or more of the criteria introduced by the EDPB that result in the classification of the processing operation as of high risk, inter alia, data processed on a large scale, datasets that have been matched or combined, innovative use or applying technological or organisational solutions, and/or data transfer across borders outside the European Union. As a result, pursuant to Article 35 of the GDPR, the controller shall prior to the processing of personal data, carry out a Data Protection Impact Assessment (DPIA) for the envisaged processing operations. Moreover, the EDPS notes that should the processing fulfill the criteria for a high-risk processing, prior approval from the competent data protection authority may be required . 4 SPECIFIC COMMENTS 4.1 Regarding the activities and the roles for the processing of personal data within the operation of DLT market infrastructures

text: 15. The EDPS notes that the entities applying for permission to operate a DLT Market Infrastructure must provide, together with its application, a number of documents, including: a business plan, information on the functioning of its proprietary DLT, its overall IT and cyber arrangements, safekeeping arrangements and the transition strategy (

text: Article 7(2)

text: and Article 8(2) of the Proposal). In view of the risk of potential lack of clarity with regard to the controller and the processor roles within DLT Market Infrastructures, the EDPS information required in the context of the applications, the following: “where applicable, the list of the foreseen processing operations involving personal data, the allocation of roles and responsibilities of each operator pursuant to the GDPR within the DLT Market Infrastructure, as well as the main risks envisaged and mitigation strategies for what concerns data protection”. In this regard, the EDPS recalls that pursuant to Article 4(1) of the GDPR “personal data” means any information relating to an identified or identifiable natural person, for example, the name, identification number, location data, an online identifier, a private or public key, or dynamic IP addresses .

text: 16. The EDPS notes that the Proposal requires operators of DLT market infrastructures to publicly disclose up-to-date, clear and detailed information defining the rights, obligations, responsibilities and liabilities (Article 6(1) of the Proposal). For the sake of clarity, the EDPS recommends including in the same place where such documentation is published the privacy notice containing the list of the processing operations carried out within the DLT Market Infrastructure as well as the roles and responsibilities of the stakeholders involved in the processing of personal data.

text: 17. The EDPS also highlights that when the activities relating to the operation of DLT Market Infrastructures involve the processing of personal data, a legal basis for the processing as laid down under Article 6 of the GDPR will be necessary. In case of DLT market infrastrutures, the EDPS points to

text: Article 6(1)

text: (b) “processing necessary for the performance of a contract to which the data subject is party” or

text: Article 6(1)

text: (c), processing necessary for compliance with a legal obligation, as the most appropriate legal basis for such activities. 9 | P a g e 4.2 Data protection safeguards within DLT Market Infrastructures

text: 18. The EDPS welcomes Recital 30,

text: Article 6(4)

text: and Article 6(5) of the Proposal requiring the operators of DLT Market Infrastrucutres to adopt the necessary IT and cyber arrangements to ensure the continued transparency, availability, reliability and security of their services and activities, including the reliability of smart contracts used on the DLT. These arrangements shall also ensure the integrity, security and confidentiality of any data stored, and the availability and accessibility of such data. The EDPS highlights that these measures must be also in line with the obligations established under Article 32 of the GDPR regarding the implementation of appropriate technical and organisational security measures to ensure the level of security appropriate to the risk. In particular, with regard to smart contracts, the EDPS draws attention to Article 22 of the GDPR, in accordance with which the data subject shall have the right not to be subject to a decision based solely on automated processing that produces legal effects or significantly affects him or her. In this context, the controller shall implement suitable measures to safeguard the rights and freedoms and legitimate interests of data subjects.

text: 19. The EDPS notes that the Proposal requires the operators of DLT Market Infrastructures to inform the competent authorities and ESMA about certain operational issues, in particular, to notify any unauthorised access, material malfunctioning, loss, cyber-attacks or other cyber-threats, fraud, theft or other serious malpractice suffered by the DLT Market Infrastructure (Recital 38 and

text: Article 9(1)

text: (b) of the Proposal).

text: 20. In this regard, the EDPS notes that Data Protection Supervisory Authorities are not included in the definition of “competent authority” under Article 2(21) of the Proposal for the purposes of this regulation. However, Article 33 of the GDPR establishes an obligation to notify DPAs in cases of data breaches. Therefore, for the sake of clarity, the EDPS recommends reminding in a Recital that “in case of a personal data breach, the operator of DLT market infrastructures shall also notify the relevant data protection supervisory authority thereof, in accordance with the GDPR”. The EDPS would like to highlight that the notification foreseen in

text: Article 9(1)

text: (b) of the Proposal should not be understood as an alternative or substitute to the notification under Article 33 of the GDPR. 5 CONCLUSIONS In light of the above, the EDPS:  recalls that the protection of personal data does not constitute an obstacle to innovation and, in particular, for the development of new technologies, notably in the financial sector.  highlights that the technology behind some digital ledgers, particularly those that are public and permissionless, rises crucial conceptual questions with regard to data protection requirements; recommends therefore that the discussion about the possible way to ensure compatibility of DLT systems with the data protection framework should take place before the Proposal enters into force.  stresses that the crypto-assets traded in the DLT Market Infrastructures covered by the Proposal should be only those using a DLT configuration which complies with the data protection framework. 10 | P a g e  suggest to also include, as part of the information required to the operator in the context of its application to operate a DLT Market Infrastructure, where applicable, the list of the foreseen processing operations involving personal data, the allocation of roles and responsibilities of each operator pursuant to the GDPR within the DLT Market Infrastructure, as well as the main risks envisaged and mitigation strategies for what concerns data protection.  highlights that IT and cyber arrangements foreseen in the Proposal for the operation of DLT Market Infrastructures must be also in line with the obligations set by Articles 22 and 32 of the GDPR.  recommends reminding in a recital, in the context of reporting of operational issues by DLT Market Infrastructures’ operators, that in cases of personal data breaches, these shall also be notified by the operator to the competent data protection supervisory authority, in accordance with Article 33 of the GDPR, and, if applicable, to data subjects, in accordance with Article 34 of the GDPR. Brussels, 23 April 2021 Wojciech Rafał WIEWIÓROWSKI (e-signed) 11 | P a g e Notes 12 | P a g e 13 | P a g e


text: OJ L 295, 21.11.2018, p. 39.

text: Regulation (EU) 2018/1727

text: of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council Decision 2002/187/JHA, OJ L 295, 21.11.2018, p. 138.

text: Regulation (EU) 2018/1727

text: of the European Parliament and the Council and Council Decision 2005/671/JHA, as regards the digital information exchange in terrorism cases, COM(2021) 757 final, 1.12.2021.

text: In relation to that Proposal the EDPS has issued his Formal Comments on the 26 January 2022. See Explanatory Memorandum of the Proposal COM(2022) 187 final, p. 2. 4

text: See Explanatory Memorandum of the Proposal COM(2022) 187 final, p. 7.

text: See footnote 3. 5

text: See Recitals 11 and 13 of the Proposal.

text: See Article 29 of the Eurojust Regulation. 6

identifier: EDPS yttrande 06/2022

title: Opinion on the Proposal for a Regulation, as regards the collection, preservation and analysis of evidence relating to genocide, crimes against humanity and war crimes at Eurojust

text: 13 May 2022

text: Opinion 6/2022

text: on the Proposal for a Regulation of the European Parliament and of the Council amending

text: Regulation (EU) 2018/1727

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Commission Proposal for a Regulation of the European Parliament and of the Council amending

text: Regulation (EU) 2018/1727

text: of the European Parliament and the Council, as regards the collection, preservation and analysis of evidence relating to genocide, crimes against humanity and war crimes at Eurojust. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the draft Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 25 April 2022 the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council amending the Eurojust Regulation, as regards the collection, preservation and analysis of evidence relating to genocide, crimes against humanity and war crimes at Eurojust.

text: The EDPS acknowledges the urgent need to address the limitations of the Eurojust’s existing case management system (CMS) which have an impact on Eurojust’s ability to support and strengthen coordination and cooperation between national investigating and prosecuting authorities in relation to core international crimes, including those that may be committed following Russia’s military aggression against Ukraine on 24 February 2022. In that regard the EDPS notes that the Commission has already proposed to enhance the current set-up of the Eurojust’s CMS with regard to Eurojust’s activities concerning investigations and prosecutions of terrorist offences. As part of that proposal, the modernisation of the CMS and the digitalisation of the information exchange between national competent authorities and Eurojust are also envisaged.

text: The EDPS notes that the envisaged derogation under the Proposal to store data relating to genocide, crimes against humanity and war crimes outside of the Eurojust’s CMS would be of a temporary nature and the automated data management and storage facility would be integrated into the new CMS which is expected to be established under an earlier proposal. Due to the exceptional nature of the present circumstances and the novelty of the proposed solution, the EDPS will be paying particular attention to it in the course of his supervision activities regarding Eurojust.

text: This Opinion aims to provide constructive advice to the EU legislator with a view of ensuring the level of data protection as already guaranteed by the Eurojust Regulation is not undermined. Against this background, the EDPS makes several recommendations regarding:

text: - collection and exchange of evidence by Eurojust;

text: - security of the automated data management and storage facility;

text: - time limits for the data stored in the automated data management and storage facility;

text: -relationship with Article 90 of the EUDPR.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. The European Union Agency for Criminal Justice Cooperation (Eurojust) supports national investigating and prosecuting authorities in relation to serious crime with which Eurojust is competent to deal, in accordance with

text: Regulation (EU) 2018/1727

text: (‘Eurojust Regulation’). Amongst these crimes are genocide, crimes against humanity and war crimes.

text: 2. On 25 April 2022 the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council amending the Eurojust Regulation, as regards the collection, preservation and analysis of evidence relating to genocide, crimes against humanity and war crimes at Eurojust (‘the Proposal’).

text: 3. The Commission has previously proposed to enhance the current set-up of the Eurojust’s case management system (“CMS”) with regard to Eurojust’s activities concerning investigations and prosecutions of terrorist offences and improving the functioning of the European Judicial Counter-Terrorism Register at Eurojust . In that context, the modernisation of the CMS and the digitalisation of the information exchange between national competent authorities and Eurojust are also envisaged .

text: 4. The objective of the Proposal is to allow Eurojust to collect, preserve and analyse evidence in relation to genocide, crimes against humanity, war crimes and related criminal offences and, when necessary and appropriate, enable its exchange or otherwise make it available to the competent judicial authorities, national or international, in particular following the unprecedented military aggression by Russia against Ukraine on 24 February 2022 .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 6 May 2022, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 18 of the Proposal.

text: 2. General remarks

text: 6. Personal data gathered in the context of a criminal investigation are liable to have a significant impact on the lives of the individuals concerned. In order to ensure that the processing of personal data is done in a transparent manner, Article 23(6) of the Eurojust Regulation prescribes that for the processing of operational personal data, Eurojust may not establish any automated data file other than the CMS.

text: 7. However, according to the Proposal, the current Eurojust’s CMS does not have the technical capacity to centralise evidence on core international crimes in an efficient and secure 6 7 manner . The EDPS takes note that therefore the Proposal aims to derogate from Article 23(6) of the Eurojust Regulation, by providing that Eurojust may process operational personal data for the performance of the tasks referred to in the Proposal in an automated data management and storage facility outside the CMS.

text: 8. While acknowledging its necessity, the EDPS considers that this derogation should be of a temporary nature and that the automated data management and storage facility should be integrated into the new CMS which is expected to be established under the Proposal for a Regulation on the digital information exchange in terrorism cases , currently under consideration by the EU legislator. Due to the exceptional nature of the circumstances and the novelty of the proposed solution, the EDPS will be paying particular attention to it in the course of his supervision activities regarding Eurojust.

text: 9. To this regard, the EDPS stresses the importance of ensuring that this new automated data management system operates in a secure technical environment, taking into account state of the art technical and organizational measures on security and data protection. This system should follow the standards of privacy by design and by default as provided by Article 85 of Chapter IX of the EUDPR.

text: 3. Collection and exchange of evidence by Eurojust

text: 10. Pursuant to Article 2 of the Eurojust Regulation, Eurojust shall support and strengthen coordination and cooperation between national investigating and prosecuting authorities in relation to serious crime which Eurojust is competent to deal with, on the basis of operations conducted and information supplied by the Member States’ authorities, Europol, EPPO and by OLAF.

text: 11. The EDPS understands that the Proposal does not aim to change the supportive role of Eurojust in relation to national authorities . Consequently, the proposed new point (j) in Article 4(1) of the Eurojust Regulation and in particular the “collection of evidence” by Eurojust should be interpreted strictly in accordance with

text: Article 85

text: TFEU, including paragraph 2 thereof, according to which “formal acts of judicial procedure shall be carried out by the competent national officials”.

text: 12. In addition, while welcoming the clarification in the Explanatory Memorandum that the Proposal does not aim to introduce any obligation on national authorities to share information and evidence with Eurojust, the EDPS suggests adding a statement to that effect in the preamble.

text: 13. Furthermore, the EDPS notices that the inclusion of the wording "where necessary and 12 13 appropriate" in

text: Article 4(1)

text: (j) and in some of the recitals of the Proposal would grant a degree of discretion to Eurojust in its handling of the data. The EDPS points out that this wording is currently not used in

text: Article 4(1)

text: (a) to (i) of the Eurojust Regulation. What is more, there is no guidance in the Proposal at all as to when it might be necessary and appropriate to share this evidence. The EDPS therefore suggests including relevant guidance in the Proposal on the interpretation of this wording, for instance by providing examples in the preamble.

text: 4. Security of the automated data management and storage facility

text: 14. The EDPS welcomes Article 1(2) of the Proposal stating that the automated data management and storage facility should comply with the highest standards of cyber security and data protection. Although recital 13 of the Proposal already clarifies that these standards shall be designed in accordance with Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, the EDPS suggests also to include in the same recital a reference to the security provisions of Article 91 of Chapter IX of the EUDPR.

text: 5. Time limits for the data stored in the automated data management and storage facility

text: 15. The EDPS recalls that the Eurojust Regulation provides for specific data protection provisions, including time limits for the storage of operational personal data . The Proposal in its

text: Article 1(2)

text: specifies that access right and time limits for the data stored in the automated data management and storage facility shall be linked to the access to the temporary work files, in support of which the data is stored. In this regard, the EDPS fails to see the link between the access to the temporary work files and the time limits for the data stored. He suggests therefore to clarify this issue by linking the time limits for the storage with the storage limits already provided for in Article 29 of the Eurojust Regulation.

text: 6. Relationship with Article 90 of the EUDPR

text: 16. The EDPS notices that the Proposal would also introduce a new paragraph 8 in Article 80 of the Eurojust Regulation , which would make the operation of the automated data management and storage facility subject to prior consultation of the EDPS. While the EDPS welcomes the reference to such a prior consultation, he points out that Chapter IX of the EUDPR is fully applicable to the processing of operational personal data by Eurojust. Thus, the same effect could be achieved by including a reference to

text: Article 90

text: EUDPR in the Proposal.

text: 7. Conclusions

text: 17. In light of the above, the EDPS makes the following recommendations: (1) To add a statement in the preamble that the Proposal does not aim to introduce any obligation on national authorities to share information and evidence with Eurojust. (2) To include guidance in the Proposal on the interpretation of the wording "where necessary and appropriate". (3) To include in recital 13 of the Proposal a reference to the security provisions of Article 91 of Chapter IX of the EUDPR. (4) To link the time limits for the storage of data with the storage limits already provided for in Article 29 of the Eurojust Regulation. (5) To clarify the relationship between the newly introduced paragraph 8 of Article 80 of the Eurojust Regulation and Article 90 of the EUDPR. Brussels, 13 May 2022 [e-signed] Wojciech Rafał WIEWIÓROWSKI