text: OJ L 119, 4.5.2016, p. 1. OJ L 295, 21.11.2018, p. 39. OJ L 119, 4.5.2016, p. 89. COM 2020 66 final https://ec.europa.eu/info/sites/info/files/communication-european-strategy-data- 19feb2020_en.pdf. COM(2020) 67 final, https://ec.europa.eu/info/strategy/priorities-2019-2024/europe-fit-digital-age/shapingeuropedigital-future_en COM(2020) 65 final, https://ec.europa.eu/info/strategy/priorities-2019-2024/europe-fit-digital-age/excellencetrustartificial-intelligence_en COM (2020) 66 final https://eur-lex.europa.eu/legalcontent/EN/TXT/PDF/?uri=CELEX:52020DC0066&from=EN, p.2. EDPS Opinion 3/2020 on the European Strategy for Data https://edps.europa.eu/sites/edp/files/publication/20- 06-16_opinion_data_strategy_en.pdf . COMM 2020 66 final https://ec.europa.eu/info/sites/info/files/communication-european-strategy-data- 19feb2020_en.pdf, p. 22. See https://data.consilium.europa.eu/doc/document/ST-13-2020-INIT/en/pdf . EDPS Opinion 3/2020 on the European Strategy for Data https://edps.europa.eu/sites/edp/files/publication/20- 06-16_opinion_data_strategy_en.pdf . EDPS Preliminary Opinion on data protection and scientific research https://edps.europa.eu/sites/edp/files/publication/20-01-06_opinion_research_en.pdf . EDPS Opinion on the 'Open-Data Package' of the European Commission including a Proposal for a Directive amending Directive

text: on re-use of public sector information (PSI), a Communication on Open Data and

text: Commission Decision 2011/833/EU

text: on the reuse of Commission documents, https://edps.europa.eu/sites/edp/files/publication/12-04-18_open_data_en.pdf . EDPS Opinion 4/2020 EDPS on the European Commission’s White Paper on Artificial Intelligence– A European approach to excellence and trust https://edps.europa.eu/sites/edp/files/publication/20-06- 19_opinion_ai_white_paper_en.pdf . EDPS Opinion 5/2018 on the proposal for a recast of the Public Sector Information (PSI) re-use Directive https://edps.europa.eu/sites/edp/files/publication/18-07-11_psi_directive_opinion_en.pdf . Directive

text: of the European Parliament and of the Council of 9 March 2011 on the application of patients’ rights in cross-border healthcare OJ L 88, 4.4.201. See https://ec.europa.eu/health/ern_en . See https://ec.europa.eu/health/ehealth/policy/network_en . See https://ec.europa.eu/cefdigital/wiki/display/EHOPERATIONS/eHDSI+GOVERNANCE . See also EDPB- EDPS Joint Opinion 1/2019 on the processing of patients’ data and the role of the European Commission within the eHealth Digital Service Infrastructure (eHDSI), https://edps.europa.eu/sites/edp/files/publication/19-07- 15_edpb_edps_joint_opinion_ehealth_en.pdf . See https://ec.europa.eu/health/ern_en . See https://ec.europa.eu/health/sites/health/files/ern/docs/cpms_ps_en.pdf . See Commissions’ Data Strategy, page 30 EDPB Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak, 21.04.2020, https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202003_healthdatascientificresearchcovid19_ en.pdf. EDPS preliminary Opinion on Data Protection and Scientific Research https://edps.europa.eu/sites/edp/files/publication/20-01-06_opinion_research_en.pdf. Reference and link! EDPS Opinion 3/2020 on the European Strategy for Data https://edps.europa.eu/sites/edp/files/publication/20- 06-16_opinion_data_strategy_en.pdf, p. 29 Article Working Party 29 Opinion 03/2013 on purpose limitation https://ec.europa.eu/justice/article- 29/documentation/opinion-recommendation/files/2013/wp203_en.pdf. See Peek N. and Rodrigues Pereira P., “Three controversies in health data science”, 07 March 2018, Springer https://link.springer.com/article/10.1007/s41060-018-0109-y. See WP29 Opinion 05/2014 on Anonymisation Techniques, 0829/14/EN

text: , https://ec.europa.eu/justice/article-29/documentation/opinionrecommendation/files/2014/wp216_en.pdf

text: Guidelines 4/2019 on

text: Article 25

text: Data Protection by Design and by Default, 13.11.2019, https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_201904_dataprotection_by_design_and_by _default.pdf . Guidelines 4/2019 on

text: Article 25

text: Data Protection by Design and by Default, 13.11.2019, https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_201904_dataprotection_by_design_and_by _default.pdf . EDPS preliminary Opinion on Data Protection and Scientific Research https://edps.europa.eu/sites/edp/files/publication/20-01-06_opinion_research_en.pdf p. 25. EDPS Opinion 3/2020 on the European Strategy for Data https://edps.europa.eu/sites/edp/files/publication/20- 06-16_opinion_data_strategy_en.pdf . See https://www.health-data-hub.fr/faq . See https://edps.europa.eu/sites/edp/files/publication/2020-10-29_edps_strategy_schremsii_en_0.pdf . Judgement of the Court (Grand Chamber) of 16 July 2020 in case

text: Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems. EDPB Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data https://edpb.europa.eu/our-work-tools/public-consultations-art- 704/2020/recommendations-012020-measures-supplement-transfer_en. COM (2020) 66 final, p.29 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52020DC0066&from=EN COM (2020) 66 final, https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52020DC0066&from=EN COM (2020) 66 final, https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52020DC0066&from=EN. See https://www.digitaleurope.org/wp/wp-content/uploads/2020/05/WEB28APR2020_The-role-of-a-health- Data-Space-in-a-pandemic_slides-Ioana.pdf

text: Article 29

text: WP Guidelines on the right to data portability, 13.12.2016, as revised and adopted on 5 April 2017, https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=611233 and endorsed by the EDPB on 25 May 2018. Idem. Schneider G., Health Data Pools under European Policy and Data Protection Law: Research as a New Efficiency Defence?, 11 (2020) JIPITEC 49 para 1, available at https://www.jipitec.eu/issues/jipitec-11-1- 2020/5082/schneider_pdf.pdf .

identifier: EDPS yttrande 08/2020

title: Preliminary Opinion 8/2020 on the European Health Data Space

text: 17 November 2020

text: The European Data Protection Supervisor (EDPS) is an independent EU authority, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’. Under article 58(3)(c) of Regulation 2018/1725, the EDPS shall have the power ‘to issue on his or her own initiative or on request, opinions to Union institutions and bodies and to the public on any issue related to the protection of personal data’.

text: Wojciech Wiewiorówski was appointed Supervisor on 5 December 2019 for a term of five years.

text: 1 | P a g e

text: Executive Summary

text: On 19 February 2020, the European Commission presented its Communication on “A European strategy for data”. This communication envisages the creation of a common space in the area of health, namely the European Health Data Space (‘EHDS’), presented as an essential tool for the prevention, detection and cure of diseases as well as for the taking of evidencebased decisions and to enhance effectiveness, accessibility and sustainability of the healthcare systems.

text: Whereas the EDPS strongly supports the objectives of promoting health-data exchange and fostering medical research, it underlines the necessity for data protection safeguards to be defined at the outset of the creation of the EHDS. Thus, with this preliminary opinion the EDPS highlights the essential elements that should be considered in the development of the EHDS from the data protection perspective.

text: The EDPS calls for the establishment of a thought-through legal basis for the processing operations under the EHDS in line with Article 6(1) GDPR and also recalls that such processing must comply with Article 9 GDPR for the processing of special categories of data.

text: Moreover, the EDPS highlights that due to the sensitivity of the data to be processed within the EHDS, the boundaries of what constitutes a lawful processing and a compatible further processing of the data must be crystal-clear for all the stakeholders involved. Therefore, the transparency and the public availability of the information relating to the processing on the EHDS will be key to enhance public trust in the EHDS.

text: The EDPS also calls on the Commission to clarify the roles and responsibilities of the parties involved and to clearly identify the precise categories of data to be made available to the EHDS. Additionally, he calls on the Member States to establish mechanisms to assess the validity and quality of the sources of the data.

text: The EDPS underlines the importance of vesting the EHDS with a comprehensive security infrastructure, including both organisational and state-of-the-art technical security measures to protect the data fed into the EHDS. In this context, he recalls that Data Protection Impact Assessments may be a very useful tool to determine the risks of the processing operations and the mitigation measures that should be adopted.

text: The EDPS recommends paying special attention to the ethical use of data within the EHDS framework, for which he suggests taking into account existing ethics committees and their role in the context of national legislation.

text: The EDPS is convinced that the success of the EHDS will depend on the establishment of a strong data governance mechanism that provides for sufficient assurances of a lawful, responsible, ethical management anchored in EU values, including respect for fundamental rights. The governance mechanism should regulate, at least, the entities that will be allowed to make data available to the EHDS, the EHDS users, the Member States’ national contact points/ permit authorities, and the role of DPAs within this context.

text: 2 | P a g e

text: The EDPS is interested in policy initiatives to achieve ‘digital sovereignty’ and has a preference for data being processed by entities sharing European values, including privacy and data protection. Moreover, the EDPS calls on the Commission to ensure that the stakeholders taking part in the EHDS, and in particular, the controllers, do not transfer personal data unless data subjects whose personal data are transferred to a third country are afforded a level of protection essentially equivalent to that guaranteed within the European Union.

text: The EDPS calls on Member States to guarantee the effective implementation of the right to data portability specifically in the EHDS, together with the development of the necessary technical requirements. In this regard, he considers that a gap analysis might be required regarding the need to integrate the GDPR safeguards with other regulatory safeguards, provided e.g. by competition law or ethical guidelines.

text: 3 | P a g e

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) ,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: , in particular Articles

text: (g) and 58(3)(c) thereof,

text: Having regard to

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA ,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction and scope of the Opinion

text: 1. On 19 February 2020, the European Commission (‘Commission’) presented its Communication on “A European strategy for data”. This was part of a package of documents, including a Communication on Shaping Europe’s digital future and a White Paper on Artificial Intelligence - A European approach to excellence and trust .

text: 2. One of the key initiatives of the European strategy for data (‘Data Strategy’) is to create Common European data spaces in strategic sectors and domains of public interest, which would increase the possibilities for public authorities and business to access high quality data, boost growth and create value. More generally, the various initiatives of the Data Strategy go in line with the Commission’s ambition to have the “(...) EU at the forefront of the data-agile economy, while respecting and promoting the fundamental values that are the foundation of European societies”.

text: 3. The EDPS released its Opinion 3/2020 on the European strategy for data (‘Opinion 3/2020’) in June 2020 , after an informal consultation on a draft version by the Commission in January 2019. Opinion 3/2020 presents the EDPS’ views on the Data Strategy, and touches particularly on certain relevant concepts from a data protection perspective, including the notion of ‘public good’, Open Data, use of data for scientific research, data intermediaries, data altruism and international data sharing. 5 | P a g e

text: 4. The EDPS notes that eHealth is a key area of public interest where the Commission’s Data Strategy envisages the creation of a common space, namely the European Health Data Space (‘EHDS’). In accordance with the Data Strategy, the EHDS will be essential for the prevention, detection and cure of diseases, as well as for evidence-based decisions in order to enhance effectiveness, accessibility and sustainability of the healthcare systems.

text: 5. In its recent meeting of October 2020, also the European Council welcomed “(...) the European strategy for data, which supports the EUʼs global digital ambitions to build a true European competitive data economy, while ensuring European values and a high level of data security, data protection, and privacy. It stresses the need to make high-quality data more readily available and to promote and enable better sharing and pooling of data, as well as interoperability. The European Council welcomes the creation of common European data spaces in strategic sectors, and in particular invites the Commission to give priority to the health data space, which should be set up by the end of 2021.”

text: 6. Whereas the EDPS strongly supports the objectives of promoting health-data exchange and fostering research on new preventive strategies, treatments, medicines, medical devices, it also underlines the necessity for data protection safeguards to be defined at the outset. In the context of the Covid19 pandemic, the European Union has seen more than ever the need for the GDPR data processing principles to be fully applied. In line with the recent European Council Conclusions, the EDPS recalls the fundamental rights to data protection and privacy, and calls for data protection principles to be integrated in the future eHealth solutions that will soon be at the heart of all European eHealth systems. In this context, we highlight that data protection safeguards must be embedded in the core of the upcoming EHDS, with the aim of guaranteeing the respect of fundamental rights of individuals, including the right to privacy and to the protection of personal data of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’).

text: 7. The aim of this preliminary opinion is to contribute to the Commission’s work on the future EHDS, in particular through identifying of the essential elements that should be considered in the development of the EHDS from the data protection perspective. This preliminary opinion should be read in conjunction with other relevant EDPS Opinions, including the Opinion on the European Strategy for Data , the preliminary 12 13 Opinion on scientific research , the Opinion on Open Data , the Opinion on the European Commission’s White Paper on Artificial Intelligence and the EDPS Opinion on the proposal for a recast of the Public Sector Information (PSI) re-use Directive. It is worth underlining that this preliminary opinion is without prejudice to any future EDPS opinion that may be issued in accordance with

text: Article 42 of Regulation (EU) 2018/1725

text: on the related forthcoming legislative proposals of the Commission.

text: 2. The European Union’s eHealth initiatives

text: 8. The EDPS acknowledges that multiple EU initiatives on eHealth already exist, inter alia, the Directive

text: on patients’ rights in cross-border healthcare (‘the Patients’ Rights Directive’), the European Reference Networks (‘ERNs’), the Clinical Patient Management System (‘CPMS’), the eHealth Network and the eHealth Digital System Infrastructure (‘eHDSI’). The main features of these initiatives are as follows: 6 | P a g e

text: 9. Directive

text: on patients’ rights in cross-border healthcare guarantees the right of individuals to access healthcare in any of the EU Member States and sets out the conditions under which EU patients may be reimbursed for healthcare costs in their home country. In particular, the Patient’s Rights Directive aims at ensuring an easier access to information on available healthcare in other EU Member States, together with alternative healthcare options and/or specialised treatments abroad. The Directive creates a network of National Contact Points providing information on cross-border healthcare, develops EU rules on an essential list of elements to be included in cross- border medical prescriptions and fosters the development of the European Reference Network (ERN) of medical expertise, in order to broaden the cooperation between EU Member State in eHealth. The same Directive also creates the eHealth Network , a voluntary network of Member States’ competent authorities responsible for eHealth. Moreover, in order to facilitate interoperability, the eHealth network, assisted by the Commission, developed an IT tool, the so-called eHealth Digital Service Infrastructure (‘eHDSI’) , with the scope of exchanging health data under the Connecting Europe Facility programme, also developed by the Commission.

text: 10. The Directive not only enables patients to be reimbursed for treatment in other EU Member States, but also enhances access to information on healthcare, thus increasing the options for treatment, including rare diseases, through the (currently 24) ERNs , who work on different thematic issues. These are virtual networks involving healthcare providers across Europe and aim at dealing with complex or rare diseases, which require highly specialised treatment and a concentration of knowledge and resources. Therefore, the ERNs enable patients’ reimbursement for treatment in other EU Member States and enhance access to information on healthcare, thus increasing the options for treatment, including rare diseases. The Commission’s role is to create the framework for the ERNs and to provide technical networking facilities.

text: 11. As the Directive also entrusts the Commission with the role of supporting the ERN’s establishment, functioning and evaluation through specific implementing measures, the Commission has developed the CPMS platform . This aims at facilitating remote collaboration by health professionals in the ERNs for the diagnosis and treatment of patients with rare or low prevalence complex diseases or conditions across national borders and fostering scientific research of such diseases or conditions. The CPMS processes sensitive data concerning patients who suffer from rare or low prevalence complex diseases to facilitate patients’ diagnosis and treatment, for scientific research, clinical or health policy purposes and for contacting potential participants for scientific research initiatives. For all these three cases, the patient signs a specific consent.

text: 3. The Common European Health Data Space

text: 3.1 Context and legal basis

text: 12. Pursuant to the Commission’s Data Strategy, the objective of the proposed European Health Data Space (EHDS) is to improve access to and quality of healthcare, by helping competent authorities in firstly, taking evidence-based policy decisions and secondly, supporting scientific research. According to this strategy, the Commission intends to achieve this goal by deploying data infrastructures, tools and computing capacity for the EHDS, namely a platform that will allow certain data to be processed for the benefit of society. The EHDS will thus foster the development and interconnection of 7 | P a g e the abovementioned eHealth initiatives by enhancing research and innovation and facilitating policy-making decisions and regulatory activities of Member States in the area of public health.

text: 13. The EDPS acknowledges that a common EHDS will be an essential tool to improve the accessibility, effectiveness and sustainability of the health systems as well as to allow informed, evidence-based policy decisions relating to them. Indeed, public health policy is an area where the EU can benefit from a data revolution that makes possible an increase of the quality of healthcare, while decreasing costs.

text: 14. As the EDPS highlights in its Opinion 3/2020 on the European strategy for data, given the sensitive nature of health data, all processing operations, which might result from the establishment of such a common health data space will require a robust legal basis in line with EU data protection law. In this regard, we recall that the EU’s primary legislation, and in particular,

text: Article 168

text: TFEU sets the goal of encouraging cooperation between the Member States in the area of public health and, if necessary, lend support to their action, with the view to improve the complementarity of their health services in cross-border areas.

text: 15. Moreover, processing operations under the EHDS will only be lawful if they are based on one or more of the six legal bases exhaustively listed in

text: Article 6(1)

text: GDPR. As the scope of the EHDS’ creation is to enhance access to health data in order to allow for evidencebased policy decisions and for scientific research within the EU, we do not consider

text: Article 6(1)

text: (a) GDPR (i.e. consent of the data subject), as the most appropriate legal basis to enhance such aim. Rather, the EDPS considers that

text: Article 6(1)

text: (e) GDPR may possibly be the most appropriate legal basis for the processing of personal data in the context of the functioning of the EHDS, as the platform’s main purpose will be to serve the public interest and the processing should be done in the exercise of official authority vested in the controller.

text: 16. In addition, it is recalled that health data are a “special category of data” to which the GDPR affords special protection through the establishment of certain safeguards for its processing. In this regard, the EDPS considers that

text: Article 9(2)

text: (i) GDPR, which allows processing of sensitive data for reasons of public interest, could be considered as a possible legal basis for the processing operations carried out within the EHDS in relation to the specific purpose of taking evidence-based policy decisions by competent authorities. In addition,

text: Article 9(2)

text: (j) GDPR could be a possible legal basis for processing operations involving health data when the processing is necessary for scientific research purposes. Such processing must also be in accordance with

text: Article 89(1)

text: based on Union or Member State law which requires the processing to be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. In this context, the EDPS would like to draw the attention to the recently adopted EDPB Guidelines on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak. These also touch upon the essential data protection requirements applicable to this processing, in particular legality, transparency, necessity and proportionality, as well as integrity and confidentiality.

text: 17. The EDPS, in its preliminary opinion on Scientific Research , has already called for a need for further harmonisation of data protection rules applicable to health data among the Member States. As also echoed in the Data Strategy, “the landscape of digital health services remains fragmented, especially when provided cross-border”. In order to 8 | P a g e overcome such fragmentation in terms of harmonisation, the EDPS welcomes the Commission’s initiative to facilitate the establishment, in accordance with Article 40 of the GDPR, of a Code of Conduct for processing of personal data in health sector. Furthermore, in the context of processing of data for scientific research in health, we consider that EU-wide Codes of Conduct in the respective research areas could be an effective enabler of cross-border exchange of data that would contribute to providing further clarity and building trust from patients and individuals into the system.

text: 18. Closely linked to the lawfulness of the processing, is the principle of purpose limitation. In this regard, the EDPS notes that the purpose(s) for which the health data may be processed within the EHDS must be clearly established prior to the processing. The boundaries of what constitutes a lawful processing and a compatible further processing of the data must be crystal-clear for all the stakeholders involved. The processing in the context of the future EHDS must comply with the requirements of

text: Articles 5(1)

text: (b) GDPR (purpose limitation),

text: Article 6(4)

text: GDPR (compatibility test), as well as

text: Article 89(1)

text: GDPR (safeguards and derogations relating to processing for scientific purposes), read in the light Article (50) GDPR. The

text: Article 29

text: WP Opinion 3/2013 provides useful guidance on the implementation of the purpose limitation principle, as well as on the appropriate use of the various legal bases for personal data processing and remains largely relevant also under the GDPR.

text: 19. Where the legal basis for further processing of data within the EHDS is consent, the technical means implemented therein should be granular enough to allow for the respect of the will of the data subjects, for example, when they have expressed a consent limited to certain situations such as usage by public sector bodies or specific research types. This being noted, the EDPS considers that forthcoming legislation should indeed determine specific conditions for further processing of personal data and establish mechanisms to ensure that the data made available for secondary use are not unlawfully harvested or used for purposes that were not foreseen initially, are disproportionate or lack an adequate legal basis. Moreover, the conditions should not be discriminatory and should follow a necessity and proportionality approach. Finally, to strengthen the transparency of the personal data processing on the EHDS, the conditions for further processing of personal data should be publicly available.

text: 20. Moreover, the EDPS notes that lawful further processing of data, including when measures such as anonymisation are applied, might not solve all ethical problems, such as for example those relating to personal objections to certain private sector stakeholders (e.g. pharmaceutical, insurance, etc.) having access to the individual’s sensitive personal data . In this regard, it is recalled that anonymization also requires a lawful legal basis within Articles 6 and 9 of the GDPR, and must comply with the requirements for a compatible further processing . Therefore, in the context of the EHDS, the Commission should ensure that the future legal framework to be established also takes into account such circumstances and that data subjects are properly informed about the potential further processing of their data.

text: 21. The EDPS calls on the Commission to clarify the roles and responsibilities of the parties involved, in particular as regards the identification of controllers within the context of the EHDS, before whom individuals are able to exercise their data protection rights. In this regard, we recall that, pursuant to

text: Article 24

text: GDPR, the public sector body vested with the role of controller in each Member State would be accountable for the processing, i.e. it would need to demonstrate compliance with the GDPR. In particular, that public body 9 | P a g e would be responsible for the implementation of appropriate technical and organisational measures aimed to ensure the respect of the data protection rights of individuals.

text: 22. The EDPS recommends the Commission to clearly identify the precise categories of data to be made available to the EHDS. In particular, the decision on the categories of data should be defined by the legislator at a level of granularity that enhances accuracy of data while still ensuring a lawful basis and the respect of the data protection principles under the GDPR. Moreover, the EDPS recalls the fundamental need for an adequate check-andbalance system (at national level) and in the context of a public interest and ethical objective.

text: 23. As to the sources of that data, we are of the view that this should be a responsibility of the national Member States’ contact points/permit authorities, who would assess the validity and quality of the type of data submitted by the parties sharing such data. Following the necessity and proportionality principles, the EDPS believes that the data made available to the EHDS should as a general rule be made anonymised and aggregated. If this were not possible due to the nature of the data at stake and the purpose of the processing, this should at least be pseudonymised.

text: 24. In this regard, and as in Opinion 3/2020 on the European Strategy for Data, the EDPS once again underlines the essential importance of the application of data protection safeguards together with organisational and technical measures within the EHDS development and governance. In line with Article 5 of the GDPR, the processing of personal data within the EHDS will need to respect the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality. In this context, we also recall the fundamental importance of the requirements of data protection by design and by default, which need to be fully applied by all actors involved, in full compliance with the GDPR.

text: 25. As an example, to implement data minimisation, safeguards should consider, as appropriate and as far they have reached the state-of-the art maturity, the use in context of privacy enhancing technologies, including those enabling to perform operations on encrypted data without having access to the data in clear or performing calculations on distributed data without having access to all data sources or enabling reliable statistical calculations on data where noise has been injected.

text: 26. Moreover, the EDPS underlines that the EHDS must have a comprehensive security policy, organisation and infrastructure, including both organisational and state-of-theart technical security measures to protect the sensitive data fed into the EHDS. In particular, we recall the obligations of

text: Article 32

text: GDPR and recommend, given also the nature of the health data as “special category of data” based on

text: Article 9

text: GDPR, the use of effective encryption as a baseline requirement, together with the establishment of strict authentication procedures and access restrictions based on data classification and use on a case-by-case basis, and the adoption of further measures of enhanced security for the storage space and intra-European data flows. Moreover, accurate logging and auditing should be performed in order to ensure the security of the data contained in the platform and the accountability of its use.

text: 27. As in Opinion 3/2020, the EDPS also recalls the essential role of Data Protection Impact Assessments (‘DPIAs’), as the use of data within the meaning of public interest involves large-scale processing, combining data from various sources and involving special categories of data. In these cases, and as such processing is likely to result in a high risk, 10 | P a g e data controllers have the obligation to conduct DPIAs in accordance with Article 35 of the GDPR. Moreover, the EDPS once again recommends, whenever possible, making public the results of such assessments, as an enhancing measure of trust and transparency. The measures adopted because of the risks assessed in the DPIA should follow the principle of data protection by design and by default. The inception phase of the EHDS is the best suited for the implementation of such principle. In this regard, we recall the EDPB Guidelines 4/2019 on

text: Article 25

text: Data Protection by Design and by Default.

text: 28. In sum, the EDPS strongly believes that transparency to and control by data subjects are key. This can only be achieved through a common understanding as to what the main actors and third parties can and cannot do within the EHDS together with precise modalities as to what data and how data can be accessed. Exhaustive agreements on the use of the EHDS and clear rules on the data’s management should be foreseen in the legislative framework at stake. Moreover, the EDPS highlights that, in line with

text: Article 42

text: GDPR, stakeholders participating in the EHDS may establish data protection certification mechanisms and data protection seals and marks, for the purpose of demonstrating compliance with the GDPR and enhancing trust.

text: 29. In addition, the EDPS calls for special attention to the essential need of the ethical use of such data. As also recommended in the abovementioned opinion, “[E]thics committees can play a meaningful role in ensuring that the respect of human rights, including right to data protection, is embedded in the research project from the early planning stage. They are likely to continue to play an important role in ensuring that research projects are designed from the start with data protection principles in mind”. As a result, forthcoming legislation should also take into account existing ethics committees and their role in the context of national legislation, while also paying particular attention to the need to determine a common understanding and general rules as to how data could be ethically processed and re-used in the context of the processing within the EHDS. However, it should also be clarified that ethics committees cannot absolve controllers from their obligations to meet their obligations under EU data protection law, to be supervised by the independent supervisory authorities set up for that purpose. 3.2 Governance

text: 30. According to the information available at this stage, the forthcoming Commission proposal on Data Governance would establish the main principles for the governance of the future European Data Spaces, including the EHDS. These general principles would be complemented by additional mechanisms and safeguards, to be included in future sectoral legislation.

text: 31. The EDPS is of the view that the success of the EHDS will depend on the establishment of a strong data governance mechanism, fully compliant with the GDPR that provides for sufficient assurances of a lawful, responsible, ethical management anchored in EU values, including respect for fundamental rights. In this regard, the EDPS considers that the EHDS should serve as an example of transparency, effective accountability and proper balance between the interests of the individual data subjects and the shared interest of the society as a whole.

text: 32. Moreover, in order to establish an effective and solid governance, the EDPS is of the view that any legislative act providing for such platform must clearly identify the main actors involved in the processing of personal data within it and define their role as data controller, processor or joint controller. In line with the relevant data protection legislation, their roles 11 | P a g e and responsibilities should be assessed thoroughly, particularly to guarantee the respect of data subject’s rights and to consequently ensure a high level of trust by EU citizens. In this regard, the EDPS suggests that the future governance framework for the EHDS should include at least the following elements.

text: 33. Entities making data available to the EHDS: these would be responsible for the primary collection and quality of the data and could make data available to the EHDS through specifically identified Member States’ national contact points;

text: 34. EHDS users (i.e. research organisations, patients and users’ associations, institutions, but also private companies, start-ups etc.). In this regard, the EDPS recommends that such actors be required to demonstrate specific objectives with scientific and research relevance with evident purposes of public interest, to be conducted in an ethical framework;

text: 35. Member States’ national contact points/ permit authorities: in most EU Member States, researchers may only obtain data by approaching the relevant databases individually, this being a burdensome and complex process. The EDPS is of the view that the EHDS legislative proposal should provide for Member States to have a single national contact point or permit authority, which would act as coordinator between the requests to have access to specific data and the databases relevant for their research initiatives. These bodies could also carry out an assessment of the objectives’ requirements with scientific and research relevance under the law and would thus not only facilitate the access to health data in a cross-border context, but would also ensure an effective control over the entire process. We believe that such national contact points/ permit authorities could take the form of independent new bodies, or also existing ethics committees, without interference with the powers of the independent data protection supervisory authorities established under EU law.

text: 36. In this regard, the EDPS considers fundamental for the European Data Protection Authorities (‘DPAs’) to be formally involved in the EHDS’ supervision and data protection compliance. We also take note that in the context of existing data spaces, such as the French Health Data Hub, the respective DPAs already act as authorisers of access to specific data according to criteria of data protection and respect for citizens' rights. The EDPS, as the supervisory authority for processing of personal data by EU institutions, offices, bodies and agencies, must be involved in the EHDS’ supervision, given the likely central role by EUIs in the governance of the data space at hand, in coordination with national DPAs in the context of the EDPB, as appropriate.

text: 37. The EDPS does not support the creation of artificial geographical borders, but has a preference for data being processed by entities sharing European values, including privacy and data protection. The EDPS is interested in policy initiatives to achieve ‘digital sovereignty’, where data generated in Europe is converted into value for European companies and individuals, and processed in accordance with EU rules and regulations.

text: 38. In this regard, the EDPS calls on the Commission to ensure that the controllers taking part in the EHDS ('data exporters') ensure full compliance with the rules of the GDPR, as interpreted by the CJUE in particular in Schrems II. This may involve, where necessary, the adoption by the data exporters of measures (having technical, contractual and organisational nature) supplementing the appropriate safeguards entered into with the controllers or processors in the third country of destination of the data. To do so, data exporters should conduct a transfer impact assessment in compliance with the steps described in the EDPB Recommendations on measures that supplement transfers tools to 12 | P a g e ensure compliance with the EU level of protection of personal data. In case the implemented measures, considered sufficient on the basis of the data transfer impact assessment, no longer ensure adequate protection of the personal data transferred, the data exporter shall suspend or prohibit such transfer to the third country. Consequently, the Commission should ensure that the stakeholders taking part in the EHDS, and in particular, the controllers, do not transfer personal data unless data subjects whose personal data are transferred to a third country are afforded a level of protection essentially equivalent to that guaranteed within the European Union.

text: 39. Lastly, the European Commission would be responsible for the EHDS’ creation, governance and development of technical and organisational measures. We also consider that EU Agencies whose mission is closely related to the processing of health data (such as EMA and ECDC) should be able to directly connect and access the EHDS, in order to simplify their work and performance of their tasks. The EDPS thus recommends to ensure that their roles and responsibilities, including the conditions under which these may access the EHDS, be fully clarified, also in accordance with data protection law. 3.3 The right to data portability

text: 40. The EDPS welcomes the specific acknowledgement in the European Data Strategy of the citizens’ right to access and control their personal health data and to request their portability , as well as the Commission’s aim to work to solve the fragmented implementation of this right. In particular, the Commission has committed to taking measures to strengthen citizens’ access to health data and portability of these data and tackle barriers to cross-border provision of digital health services and products. Moreover, the Commission has committed to working in ensuring portability of the personal data within the Electronic Health Record (EHR), within and across borders, as this “will improve access to and quality of care, cost effectiveness of care delivery and contribute to the modernisation of health systems”.

text: 41. The EDPS notes that the right to data portability is essential to enhance “control” by data subjects over their data and that the imperfect data portability mechanisms currently existing can present an obstacle to the effectiveness of this right. The right to data portability is a right that may only enforced upon the data subject’s request and entails the possibility for a data subject to receive a subset of the personal data processed by a data controller concerning him or her, and to store those data for further personal use. Such storage can be on a private device or on a private cloud, without necessarily transmitting the data to another data controller.

text: 42. The EDPS also notes that, in line with the GDPR, the right to data portability may not be applicable in the context of a task carried out in the public interest. As a result, the EDPS invites the Commission to ensure in its legislative proposal that Member States guarantee the application of this right together with the development of the necessary technical requirements specifically in the EHDS that allow and effective use of this right by data subjects.

text: 43. The EDPS highlights that there are still gaps that should be addressed in the future legislation on the EHDS in order to make the right to data portability effective. As indicated by the EDPB, the right to data portability covers data provided knowingly and actively by the data subject as well as the personal data generated by his or her activity. In this regard, the EDPB has clarified that the outcome of an assessment regarding the health of a user (i.e. derived data such as medical diagnosis etc.) cannot in 13 | P a g e itself be considered as “provided by” the data subject and thus will not be within scope of this right. This is so, even if such data may be part of a profile kept by a data controller and are inferred or derived from the analysis of data provided by the data subject.

text: 44. Moreover, some authors have pointed to the fact that under the research exemption for the processing of special categories of data under

text: Articles 9(2)

text: (j); 5(1)(b); 6(4) and 89 GDPR, data subjects appear to be significantly excluded from the control over their processed health data. Therefore, in the context of the EHDS, a gap analysis might be required regarding the need to integrate the GDPR safeguards with other regulatory safeguards, provided e.g. by competition law or ethical guidelines. to transmit their data to another controller without any legal, technical or financial obstacles placed by data controller in order to refrain or slow down access, transmission or reuse by the data subject or by another data controller. In this context, the EDPS calls for Member States, where appropriate, to encourage the use of open, machine-readable formats. Moreover, we highlights that in implementing the right to data portability, data controllers should assess the specific risks linked with data portability and take appropriate risks mitigation measures.

text: 4. Conclusions and recommendations

text: In light of the above, the EDPS makes the following recommendations:

text: 46. Supports the initiative to create a common European Health Data Space and acknowledges its key role to improve access to and quality of healthcare, by helping competent authorities in taking evidence-based policy decisions and by supporting scientific research. However, the EDPS calls for the adoption of necessary data protection safeguards in parallel to the works towards the creation of the EHDS.

text: 47. Recalls that all processing operations resulting from the EHDS’ establishment will require a robust legal basis in line with EU data protection law, particularly

text: Article 6(1)

text: GDPR and

text: Article 9

text: GDPR for the processing of special categories of data.

text: 48. Considers that the forthcoming legislative initiative on the EHDS should also aim at contributing to a mitigation of the current fragmentation of rules applicable to the processing of health data and to scientific research, thus also aimed at guaranteeing a lawful and ethical use and re-use of the data within the EHDS.

text: 49. Advocates for additional clarity on the boundaries of what constitutes a lawful processing and a compatible further processing of the data for all stakeholders involved in the EHDS process, while also strengthening the transparency of data processed by making the conditions for re-use publicly available.

text: 50. Considers essential the setting of clear rules to the Member States for the identification of controllers within the context of the EHDS, before whom individuals may be able to exercise their data protection rights, in line with current legislation (GDPR and Regulation 2018/1725).

text: 51. Requests that the main actors involved and the categories of data processed within the EHDS are clearly identified and considers fundamental for the European Data Protection 14 | P a g e Authorities (‘DPAs’) to be clearly involved in its supervision and data protection compliance.

text: 52. Calls for the adoption of a comprehensive security infrastructure, including both organisational and state-of-the-art technical security measures to protect the sensitive data fed into the EHDS.

text: 53. Recalls the essential role of Data Protection Impact Assessments (‘DPIAs’), and recommends, whenever possible, making public the results of such assessments, as an enhancing measure of trust and transparency.

text: 54. Calls for the establishment of a strong data governance mechanism that providing for sufficient assurances of a lawful, responsible and ethical management of the data processed within the EHDS.

text: 55. Has a preference for data being processed by entities sharing European values, including privacy and data protection.

text: 56. Strongly supports the achievement of data sovereignty where data generated in Europe is converted into value for European companies and individuals, and processed in accordance with EU rules and regulations.

text: 57. Calls on the Commission to ensure that the stakeholders taking part in the EHDS, and in particular, the controllers, do not transfer personal data unless data subjects whose personal data are transferred to a third country are afforded a level of protection essentially equivalent to that guaranteed within the European Union.

text: 58. Invites the Commission to ensure in its legislative proposal that Member States guarantee the application of the right to data portability together with the development of the necessary technical requirements in the EHDS that allow and effective exercise of such right by data subjects.

text: 59. Recommends performing a gap analysis regarding the need to integrate the GDPR safeguards with other regulatory safeguards, provided e.g. by competition law or ethical guidelines. Brussels, 17 November 2020 Wojciech Rafał WIEWIÓROWSKI (e-signed) 15 | P a g e

text: Notes

text: 16 | P a g e

text: 17 | P a g e

type: vagledning

utgivare: edps


text: 7 Cybersecurity Strategy and the NIS 2.0 Directive (‘NIS 2.0 Opinion’) . For this reason the present Opinion will refer to the NIS 2.0 Opinion.

text: paragraph 25 EDPS NIS 2.0 Opinion

text: Annex I and II of the Proposal

text: Recitals 58, 77, Articles

text: NIS 2.0 Proposal

text: Paragraph 10 EDPS NIS 2.0 Opinion

text: Proposal for a Directive of the European Parliament and of the Council on measures for a high common level of cybersecurity across the Union, repealing

text: Directive (EU) 2016/1148

text: , COM (2020) 823 final

text: Paragraph 11 EDPS NIS 2.0 Opinion

text: Annex I & II of the Proposal

text: Annex I & II of the Proposal

text: Paragraph 16 EDPS NIS 2.0 Opinion

text: See also the EDPS Guidelines on Personal Data Breach Notification 10

text: OJ L 295, 21.11.2018, p. 39. COM(2022) 122 final COM(2022) 119 final The EU’s Cybersecurity Strategy for the Digital Decade | Shaping Europe’s digital future (europa.eu) including a Joint Communication with the High Representative of the Union for Foreign Affairs and Security Policy (JOIN(2020)18) See chapter I. INTRODUCTION of the Strategy, page 4. Joint Communication from the European Commission and the High Representative of the Union for Foreign Affairs and Security Policy to the European Parliament and the Council, titled ‘The EU's Cybersecurity Strategy for the Digital Decade’ EDPS Opinion 5/2021 on the Cybersecurity Strategy and the NIS 2.0 Directive The current role of CERT-EU stems from the Interinstitutional Agreement 2018/C 12/01

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (OJ L 295, 21.11.2018).

identifier: EDPS yttrande 08/2022

publisher: Europeiska datatillsynsmannen

sprak: en

title: Opinion on the Proposal for a Regulation laying down measures for a high common level of cybersecurity at the institutions, bodies, offices and agencies of the Union

serie: yttranden

text: 17 May 2022

type: rubrik

text: Opinion 8/2022

text: on the Proposal for a Regulation laying down measures for a high common level of cybersecurity at the institutions, bodies, offices and agencies of the Union

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Commission Proposal for a Regulation laying down measures for a high common level of cybersecurity at the institutions, bodies, offices and agencies of the Union. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: Executive Summary

text: The EDPS welcomes the aim of the Proposal to improve the cybersecurity posture of the Union Institutions, bodies, offices and agencies (‘EUIs’), and equally welcomes the new role of of the former ‘Computer Emergency Response Team’, now called ‘Cybersecurity Centre’ (CERT-EU), taking into account the amplified digitisation, the rapidly evolving cybersecurity threat landscape and the recent digitalisation shift due also to the Covid-19 pandemic.

text: The EDPS regrets that the Proposal does not align with the NIS Directive, and the NIS 2.0 Proposal so that consistent and homogeneous rules for Member States and the EUIs are achieved, contributing to the overall Union cybersecurity level. The EDPS recommends adding in the Proposal that its minimum security requirements should be at least equal or higher than the minimum security requirements of the entities of NIS and NIS 2.0 Proposal.

text: In order to comply with the Proposal, the EUIs, as well as CERT-EU will have to deploy certain cybersecurity processes and measures, which are bound to imply additional processing of personal data. To achieve legal certainty and foreseeability, and to ensure compliance with the EUDPR, the EDPS strongly advises that the Proposal, or at the very least, a delegated act to be adopted subsequently by the Commission, must clearly provide a legal ground for the processing of personal data by CERT-EU and the EUIs, including in particular the purposes of processing and the categories of personal data.

text: The EDPS stresses the importance of integrating the privacy and data protection perspective in the cybersecurity management, in order to achieve positive synergies between the Proposal and privacy and data protection legislation, and provides specific recommendations how such synergies can be achieved, including a specific obligation for EU officials responsible for cybersecurity to cooperate closely with the data protection officer designated in accordance with EUDPR.

text: The EDPS strongly advises that the Proposal provide for close cooperation between CERT-EU and EDPS, in activities like when addressing incidents resulting in personal data breaches, when addressing significant vulnerabilities, significant incidents or major attacks, that have the potential to result in personal data breaches, as well as when CERT-EU has indications that an infringement of the Proposal entails a personal data breach.

text: The EDPS also strongly recommends that the Proposal provide for the EDPS’ participation in the ‘Interinstitutional Cybersecurity Board’ (IICB).

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EC) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular

text: Articles 42(1)

text: , thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 22 March 2022, the European Commission adopted a Proposal for a Regulation laying down measures for a high common level of cybersecurity at the institutions, bodies, offices and agencies of the Union (‘the Proposal').

text: 2. On the same date, the European Commission adopted the Proposal for a Regulation of the European Parliament and of the Council on the information security in the institutions, bodies, offices and agencies of the Union (‘the Infosec Proposal').

text: 3. Both Proposals were envisaged by the EU's Cybersecurity Strategy for the Digital Decade presented on 16 December 2020 (‘the Strategy'). The overall aim of the Strategy is to strengthen the Union’s strategic autonomy in the field of cybersecurity and to improve its resilience and collective response as well as to build a global and open Internet with strong guardrails to address the risks to security and fundamental rights and freedoms of people in Europe.

text: 4. The Proposal constitutes one of the regulatory initiatives of the Strategy, and in particular in the area of cybersecurity for the EU institutions, bodies, offices and agencies (EUIs). According to its explanatory memorandum, the aim of the Proposal is twofold:  to address the increasingly hostile cyber threat landscape and the increased incidence of more sophisticated cyberattacks affecting the EU institutions, bodies and agencies, driving the need for increased investments to reach a high level of cyber maturity, and  to reinforce the EU Computer Emergency Response Team (CERT-EU) with an improved funding mechanism that is necessary to increase its ability to help EU institutions, bodies and agencies to apply the new cybersecurity rules, and improve their cyber resilience.

text: 5. The EDPS observes that the subject matter of the Proposal at hand is interlinked with the Proposal for a Directive of the European Parliament and of the Council on measures for a high common level of cybersecurity across the Union, repealing

text: Directive (EU) 2016/1148

text: (‘NIS 2.0 Proposal’). The EDPS recalls that he issued the Opinion 5/2021 on the 4

text: 6. In line with the Strategy, the Proposal aims at further improving the resilience of all Union institutions, bodies and agencies together with their incident response capacities. It is also in line with the Commission’s priorities to make Europe fit for the digital age and to build a future-ready economy that works for the people. Moreover, it stresses that the security and resilience of the public administration is a cornerstone in the digital transformation of society as a whole.

text: 7. According to the explanatory memorandum, the Proposal:  outlines measures with a view to ensuring a high common level of cybersecurity for the European Union institutions, bodies and agencies,  establishes the ‘Interinstitutional Cybersecurity Board’, which shall be responsible for monitoring the implementation of the proposed Regulation,  establishes the new role of the Computer Emergency Response Team for the EU institutions, agencies and bodies (‘CERT-EU’) , as the ‘Cybersecurity Centre’ for the Union institutions, bodies and agencies, in line with developments in the Member States and globally.

text: 8. On 22 March 2022 the European Commission requested the EDPS to issue an Opinion on the Proposal pursuant to

text: Article 42(1) of Regulation (EU) 2018/1725

text: (‘EUDPR’) . The comments and recommendations in this Opinion are limited to the provisions in the Proposal that are most relevant from a data protection and privacy perspective.

text: 2. General remarks

text: 9. The EDPS observes that while the NIS 2.0 Proposal applies to Member States public and private essential and important entities, the Proposal applies to the Union institutions, bodies, offices and agencies.

text: 10. The EDPS wishes to underline that while for the NIS 2.0 Proposal, which provides for obligations on Member States, the application of

text: Regulation (EU) 2016/679

text: (‘GDPR’) and Directive

text: (ePrivacy Directive) is relevant when processing personal data, for the current Proposal, which lays down rules affecting how EUIs, the EUDPR applies and plays an equally important role.

text: 11. The EDPS welcomes the aim of the Proposal to improve the cybersecurity posture of the Union Institutions, bodies, offices and agencies through a self-standing and dedicated legal instrument, a Regulation. The EDPS equally welcomes the new role of CERT-EU, taking into account the amplified digitisation, the rapidly evolving cybersecurity threat landscape and the recent digitalisation shift due also to the Covid-19 pandemic.

text: 12. The EDPS recommends adding in a separate recital, as per standard practice, that ‘the European Data Protection Supervisor was consulted in accordance with Article 42 of 5

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council and delivered an opinion on ... [EDPS Opinion date]’.

text: 13. The EDPS recalls that in his NIS 2.0 Opinion, he recommended that the co-legislators create an actionable link between the NIS 2.0 Proposal and legislative actions at the level of the EUIs, in order to achieve consistent and homogeneous rules for Member States and the EUIs . This is of the outmost importance to ensure a common high level of effectiveness and resilience, in particular in the functioning of the whole national and EU public administration, due to the increasing role that the latter plays based on the Treaties.

text: 14. The EDPS regrets that the Proposal does not explain sufficiently in the explanatory memorandum nor in the relevant recitals (4) and (5), in what way it aligns with the NIS Directive, and the NIS 2.0 Proposal and how it contributes to the overall Union cybersecurity level through the link with the NIS Directive and the NIS 2.0 Proposal.

text: 15. In view of the essential and important role of the EUIs for the functioning of the Union, the EDPS submits that the minimum security requirements of the Proposal should be at least equal or higher than the minimum security requirements of the entities falling within the scope of the NIS and the NIS 2.0 Proposal, in line with Article 3 of the NIS 2.0 Proposal ('Minimum harmonisation)'. For this reason, the EDPS recommends adding in a recital that the Proposal builds on the NIS 2.0 Proposal, and further explain the link between the Proposal and the NIS Directive as well as the NIS 2.0 Proposal in recitals (4) and (5). In addition, the EDPS recommends the inclusion of wording in the main text as follows: “The minimum security requirements should be at least equal or higher than the minimum security requirements of the entities under the scope of NIS 2.0 Proposal”.

text: 16. In particular, the EDPS observes that the Proposal does not fully align with the NIS 2.0 Proposal in the following points:  Article 5(1) of the NIS 2.0 Proposal requires that ‘Each Member State shall adopt a national cybersecurity strategy defining the strategic objectives and appropriate policy and regulatory measures, with a view to achieving and maintaining a high level of cybersecurity’. The EDPS suggest that the Proposal should include the promotion of an adoption of a common cybersecurity strategy of all EUIs, reflecting the requirements set by Article 5 of the NIS 2.0 Proposal.  There seems to be some misalignment between the minimum cybersecurity measures of the Proposal and the minimum measures listed in Article 18 of the NIS 2.0 Proposal. In this context the EDPS regrets that the Proposal does not contain an explicit reference to the use of cryptography and encryption (and end-to- end encryption), which are essential technologies to protect all information at rest and in transit and to also protect electronic communications.  Contrary to the NIS 2.0 Proposal , the Proposal does not include provisions for the collaboration between the CERT-EU and the Interinstitutional Cybersecurity 6 Board with the European Data Protection Supervisor. The EDPS strongly recommends that such collaboration be institutionalised through a provision in the Proposal, to allow EDPS to monitor cybersecurity developments that might have implications for personal data security of the EUIs and to monitor compliance of cybersecurity measures. This point is further elaborated in section 3.3.

text: 3. Specific comments

text: 3.1. Scope of the Proposal and relationship with data protection and privacy legislation

text: 17. The EDPS notes that the entities subject to the Proposal are the same entities subject to the EUDPR, which are the ‘Union institutions, bodies, offices and agencies’. While this term is found in the title of the Proposal, the rest of the text uses the term ‘Union institutions, bodies and agencies’. The EDPS recommends using the term ‘Union institutions, bodies, offices and agencies’ consistently across the Proposal in order to avoid misunderstandings.

text: 18. The EDPS reiterates that

text: Article 4(1)

text: (f) of EUDPR establishes security as one of the main principles relating to the processing of personal data.

text: Article 33

text: EUDPR further defines this obligation, applicable to both controllers and processors, to ensure an appropriate level of security of personal data. Both provisions clearly establish that personal data security is essential for compliance with EU data protection law.

text: 19. The EDPS observes, on the one hand, that the Proposal uses the same definition of cybersecurity as the NIS 2.0 Proposal: “the activities necessary to protect network and information systems, the users of such systems, and other persons affected by cyber threats”, where cyber threat means “any potential circumstance, event or action that could damage, disrupt or otherwise adversely impact network and information systems, the users of such systems and other persons” . It is clear from this definition that the objective of cybersecurity has a different focus than that of the EUDPR security provisions, as in

text: Articles 4(1)

text: (f) and 33 (‘personal data security’). While cybersecurity aims to protect ‘network and information systems, the users of such systems, and other persons’ from cyber threats, personal data security has a different specific aim: to protect personal data from any threat (including the cyber threats) that can lead to adverse consequences for the rights and freedoms of individuals. This is why the EDPS stated in paragraph 10 of the NIS 2.0 Opinion that by improving cybersecurity, personal data security as well as the privacy of electronic communications are also improved. That comment remains valid in the present context.

text: 20. On the other hand, the EDPS reiterates that the pursuance of the objectives of cybersecurity may lead to deploying measures that interfere with the rights to data 7 protection and privacy of individuals. This means ensuring that any potential limitation of the right to the protection of personal data and privacy must meet the requirements of Article 52(1) of EU Charter of Fundamental Rights, in particular being provided for by law, necessary and proportionate, and respecting the essence of the right.

text: 21. In order to comply with the Proposal, the EUIs, as well as CERT-EU, will have to deploy certain cybersecurity processes and measures, which are bound to imply additional processing of personal data and of electronic communications data, including traffic data. Such measures would be adopted in relation to the cybersecurity risk management, or because they belong to the list of minimum cybersecurity measures such as access control, communications security, incident management and multi-factor authentication.

text: 22. In this context, the EDPS observes that the organisations acting as controllers and processors do not always realise that the data processed in cybersecurity systems and services may constitute personal data (e.g. IP addresses, device identifiers, network log files, access control log files, etc.). This exacerbates risks of non-compliance with data protection and privacy legislation, as for example the principles of lawfulness of processing, purpose limitation, data minimisation, storage limitation, and obligations for lawful data transfers. The EDPS therefore considers that it should be clarified, for the avoidance of any doubt, in a new recital that “All cybersecurity systems and services involved in the prevention, detection, and response to cyber threats should be compliant with the current data protection and privacy framework, and should take relevant technical and organisational safeguards to ensure this compliance in an accountable way”.

text: 23. The EDPS welcomes Recital 22 according to which all personal data processed under this Proposal should be processed in accordance with data protection legislation, including

text: Regulation (EU) 2018/1725

text: . Moreover, the EDPS recommends adding in that recital that “the Proposal does not seek to affect the application of existing EU laws governing the processing of personal data, including the tasks and powers of the EDPS”.

text: 24. The EDPS observes that

text: Article 18(3)

text: requires that the processing of personal data carried out under this Proposal should be subject to the EUDPR, giving the impression that this is only required in the context of information handling by CERT-EU and the EUIs. To avoid possible misinterpretations, the EDPS recommends moving the provision of

text: Article 18(3)

text: to recital 22 in order to cover any personal data processing performed by CERT-EU and the EUIs in the context of the Proposal, including but not limited to: the cybersecurity services provided by CERT-EU pursuant to

text: Article 12

text: , the information sharing pursuant to

text: Article 18

text: , sharing obligations pursuant to

text: Article 19

text: , measures involving personal data in relation to the cybersecurity risk management of the

text: Article 4

text: , and the list of minimum cybersecurity measures of the Proposal, that involve personal data processing.

text: 25. Where an EU legal act envisages the processing of personal data, the EU legislation in question must lay down clear and precise rules governing the scope and application of the measure in question and imposing minimum safeguards so that the persons whose data are being processed have sufficient guarantees to effectively protect their personal data 8 against the risk of abuse and against any unlawful access and use of that data (see, CJEU, judgment of 8 April 2014, Digital Rights Ireland e.a.,

text: et

text: , EU:C:2014:238, point 54, and by analogy, as regards Article 8 of the ECHR, Eur. Court H.R., Liberty and Others v. the United Kingdom, 1 July 2008, no. 58243/00, § 62 and 63; Rotaru v. Romania, § 57 to 59, and S. and Marper v. the United Kingdom, § 99).

text: 26. To achieve legal certainty and foreseeability, and to ensure compliance with the EUDPR, in particular with

text: Article 5(1)

text: (a) and (2), the EDPS strongly advises that the Proposal must clearly provide for a legal ground for the processing of personal data by CERT-EU and the EUIs, including in particular the purposes of processing and the categories of personal data. In addition, the following elements should be explicitly laid down: (a) Identification of the controller(s), processors or joint controllers, as applicable; (b) Categories of data subjects; (c) Retention periods or at least criteria to determine such periods. The EDPS considers that these elements should be provided for explicitly in the Proposal, or at the very least, in a delegated act to be adopted subsequently by the Commission. The Proposal should provide for such a delegation.

text: 3.2. Synergies with data protection and privacy

text: 27. The EDPS reiterates that integrating the privacy and data protection perspective in the traditional cybersecurity management is capable of ensuring a holistic approach and therefore enabling important synergies to the EUIs when managing cybersecurity and protecting the information they process without unnecessary multiplication of efforts.

text: 28. The use of technologies for improving cybersecurity should not unduly interfere with the rights and freedoms of individuals. The first step to avoid or mitigate those risks is to apply the data protection by design and by default requirements laid down in

text: Article 27

text: EUDPR, which will assist in integrating the appropriate safeguards such as pseudonymisation, encryption, data accuracy, data minimization, in the design, development and use of cybersecurity technologies and systems.

text: 29. The EDPS wishes to reiterate that encryption, including end-to-end encryption, is a critical and irreplaceable technology for effective data protection and privacy. While encryption is very effective in dealing with cybersecurity risks, it does this without involving additional personal data processing.

text: 30. Considering the accelerated use and adoption of cloud services by the EUIs, the EDPS strongly recommends including ‘encryption at rest’, ‘encryption in transit’ as well as ‘end-to-end encryption’ in the list of minimum cybersecurity measures of the Annex II of the Proposal.

text: 31. As already underlined on previous occasions, the management of risks for the rights and freedoms of individuals, when their personal data are processed, is an obligation under Article 33 of the EUDPR. Whereas the cybersecurity risk management measures of

text: Article 9

text: 4 of the Proposal aim at protecting network and information systems (and the data therein),

text: Article 33

text: EUDPR aims at addressing risks for individuals (not necessarily belonging to the same organisation) and their rights, by protecting their personal data. There is a difference in the assets to protect among the two activities, which might lead to different conclusions in certain circumstances. At the same time, the cybersecurity risk management process can contribute to the assessment of the data protection impact of weaknesses in the security of personal data. For this reason, the EDPS recommends integrating the privacy and data protection considerations into cybersecurity risk management to ensure a holistic approach and enable synergies without unnecessary multiplication of efforts.

text: 32. Finally, concerning the cybersecurity incidents that may entail a personal data breach, or a personal data breach that shows indications of a cybersecurity incident, it is strongly advisable to explain in a relevant recital the benefits of having an integrated incident handling process that serves both cybersecurity and data protection obligations on data breach notifications. In this way, the controller can save time, resources and have a much more efficient incident response for both domains.

text: 33. To ensure such synergies between cybersecurity and data protection, the EDPS strongly advises that the proposal provides for a specific obligation for the Local Cybersecurity Officer defined in

text: article 4(5)

text: to cooperate with the data protection officer designated in accordance with

text: Article 43

text: EUDPR, when dealing with overlapping activities like applying data protection by design and by default to cybersecurity measures, selecting cybersecurity measures that involve personal data, integrated risk management, and integrated security incident handling.

text: 3.3. The role of the EDPS

text: 34. The EDPS observes that the Proposal does not make any reference to the EDPS, despite the important interplay between cybersecurity and data protection and privacy, as described above.

text: 35. The EDPS needs to be involved in both of these aspects, on the one hand to monitor cybersecurity developments that can have implications for data protection and privacy, and on the other hand to monitor and ensure compliance of cybersecurity measures that involve personal data.

text: 36. In contrast to the Proposal,

text: Article 28

text: and Article 32 of the NIS 2.0 Proposal provide specific provisions for collaboration between cybersecurity and data protection authorities.

text: 37. To ensure consistency between Member States and the EUIs, and in line with Article 28 of the NIS 2.0 Proposal, the EDPS strongly advises adding a provision in

text: Article 12

text: 38. In the same spirit, the EDPS considers that CERT-EU shall inform the EDPS when addressing significant vulnerabilities, significant incidents or major attacks that have the potential to result in personal data breaches and/or in the breach of confidentiality of electronic communications. A corresponding obligation should be added in

text: Article 12

text: ‘CERT-EU mission and tasks’ of the Proposal.

text: 39. Moreover, the EDPS recommends providing in

text: Article 12

text: that that the EDPS shall be involved in the CERT-EU cybersecurity awareness raising activities of the EUIs, in order to cover the interplay between personal data breach and cybersecurity incidents.

text: 40. Moreover, in line with the Article 32 of the NIS 2.0 Proposal the EDPS recommends adding a provision in

text: Article 12

text: 41. The EDPS is not included in the list of the permanent participants of the ‘Interinstitutional Cybersecurity Board’ (‘IICB’) defined in the Article 9 of the Proposal. As highlighted above, the security of personal data processing, and therefore also cybersecurity, is one of the cornerstones for data protection. In addition the EDPS is mandated by

text: Article 57(1)

text: (h) EUDPR to monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies. This includes cybersecurity developments, so as to be able to issue specific Data Protection guidance related to cybersecurity, the EDPS strongly advises that the

text: 3.4. Information sharing and CERT-EU services

text: 42. According to

text: Article 12

text: , CERT-EU provides certain cybersecurity services in which it acts as the processor of cybersecurity information that includes personal data. It must be ensured from the outset that such data processing activities are in full compliance with EUDPR and GDPR.

text: Article 16(2)

text: states that CERT-EU ‘may exchange incident-specific information with national counterparts in the Member States to facilitate detection of similar cyber threats or incidents without the consent of the affected constituent’, and that ‘CERT-EU may only exchange incident-specific information which reveals the identity of the target of the cybersecurity incident with the consent of the affected constituent’.

text: Article 19

text: allows CERT-EU to request and obtain information from the information systems inventories of the EUIs, in order to coordinate vulnerability management and incident response. Furthermore, it obliges EUIs, upon request of the CERT-EU and without undue delay, to provide it with digital information created by the use of electronic devices involved in their respective incidents.

text: 45. The EDPS considers that there is high probability that the incident-specific information as well as the digital information created by the use of electronic devices involved in the incident will contain personal data. Thus, the EDPS advises clarifying the categories of 11 personal data to be processed in these exchanges, the purpose or purposes of processing, the recipients of data and the possible data transmission, to achieve the necessary legal clarity, legal certainty and foreseeability. The EDPS considers that these elements should be provided for explicitly in the Proposal, or at the very least, in a delegated act to be adopted subsequently by the Commission. The Proposal should provide for such a delegation.

text: 46. Furthermore, the EDPS notes the use of the expression ‘consent’ which the legislator has defined already in

text: Article 3 (15)

text: EUDPR. Given that the Proposal in the context of

text: Article 16(2)

text: refers to EUIBAs (‘constituents’) rather than data subjects, the EDPS suggest to use the term ‘authorization’ instead of ‘consent’.

text: Article 17(3)

text: states that ‘CERT-EU may, with the consent of the constituent affected by an incident, provide information related to the incident to [non-Member State counterparts] partners that can contribute to its analysis’. The EDPS recalls that such international data transfers should be in full compliance with the Chapter V of the EUDPR. Consequently, the EDPS recommends including in the Proposal a recital with reference to the aforementioned chapter.

text: 4. Conclusions

text: 48. In light of the above, the EDPS makes the following main recommendations:  the EDPS recommends adding in a recital that the Proposal builds on the NIS 2.0 Proposal, and further explain the link between the Proposal and the NIS Directive as well as the NIS 2.0 Proposal in the recitals (4) and (5). In addition, the EDPS recommends the inclusion of wording in the main text as follows: “The minimum security requirements should be at least equal or higher than the minimum security requirements of the entities of NIS and NIS 2.0 Proposal”.  the EDPS strongly advises that the Proposal must clearly provide a legal ground for the processing of personal data by CERT-EU and the EUIs, including in particular the purposes of processing and the categories of personal data. In addition, the following elements should be explicitly laid down: (a) Identification of the controller(s), processors or joint controllers, as applicable; (b) Categories of data subjects; (c) Retention periods or at least criteria to determine such periods. The EDPS considers that these elements should be provided for explicitly in the Proposal, or at the very least, in a delegated act to be adopted subsequently by the Commission. The Proposal should provide for such a delegation.  the EDPS strongly recommends including ‘encryption at rest’, ‘encryption in transit’ as well as ‘end-to-end encryption’ in the list of minimum cybersecurity measures of the Annex II of the Proposal.  the EDPS strongly advises that the proposal provides for a specific obligation for the Local Cybersecurity Officer defined in

text: article 4(5)

text: Article 43

text: EUDPR, when dealing with overlapping activities like applying data protection by design and by default to 12 cybersecurity measures, selecting cybersecurity measures that involve personal data, integrated risk management, and integrated security incident handling.  the EDPS strongly advises adding a provision in

text: Article 12

text: ‘CERT-EU mission and tasks’ of the Proposal that ‘CERT-EU shall work in close cooperation with the EDPS, when addressing incidents resulting in personal data breaches or in breach of confidentiality of electronic communications’.  the EDPS recommends adding an obligation for CERT-EU to inform the EDPS when addressing significant vulnerabilities, significant incidents or major attacks that have the potential to result in personal data breaches and/or in the breach of confidentiality of electronic communications.  the EDPS recommends providing in

text: Article 12

text: that that the EDPS shall be involved in the CERT-EU cybersecurity awareness raising activities of the EUIs, in order to cover the interplay between personal data breach and cybersecurity incidents.  the EDPS recommends adding a provision in

text: Article 12

text: ‘CERT-EU mission and tasks’ of the Proposal that would specify that CERT-EU shall inform without undue delay the EDPS when it has indications that an infringement by the EUIs of the obligations laid down in the Proposal entails a personal data breach.  the EDPS strongly advises that the European Data Protection Supervisor is added in

text: Article 9(3)

text: as a permanent participant in the IICB with one representative. Brussels, 17 May 2022 Wojciech Rafał WIEWIÓROWSKI [e-signed] 13

text: Notes