text: OJ L 119, 4.5.2016, p. 1. OJ L 295, 21.11.2018, p. 39.

text: Proposal for a Directive of the European Parliament and of the Council on measures for a high common level of cybersecurity across the Union, repealing

text: Directive (EU) 2016/1148

text: , COM (2020) 823 final. The EU’s Cybersecurity Strategy for the Digital Decade, JOIN (2020) 18 final. See chapter I. INTRODUCTION, page 4 of the Strategy.

text: Directive (EU) 2016/1148

text: of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union, OJ L 194, 19.7.2016, p. 1–30

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1–88. See for more details: EDPS guidelines “Assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data”, 19/12/2019, (https://edps.europa.eu/data-protection/ourwork/publications/guidelines/assessing-proportionality-measures-limit_en) as well as the EDPS paper “Necessity toolkit on assessing the necessity of measures that limit the fundamental right to the protection of personal data”, 11/04/2017(https://edps.europa.eu/data-protection/our-work/publications/papers/necessitytoolkit_en). EDPS, Shaping a Safer Digital Future: a New Strategy for a New Decade, 30/6/2020 (https://edps.europa.eu/data-protection/our-work/publications/strategy/edps-strategy-2020-2024-shaping-saferdigital-future_en). Directive

text: of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), OJ L 201, 31.07.2002, p. 37 – 47. Recital 25 of the Proposal refers only to the

text: Regulation (EU) 2016/679

text: regarding the proactive scanning of the network and information systems; recital 48, refers to both

text: (EU) 2016/679

text: and the Directive

text: regarding the reporting obligations; recital 56 refers to both

text: (EU) 2016/679

text: and the Directive

text: regarding notification obligations from different regulatory instruments; recital 58 refers only to Directive

text: regarding the compromise of personal data in the context of security incidents, -while it should also refer to the

text: Regulation (EU) 2016/679

text: Article 26

text: refers to the

text: Regulation (EU) 2016/679

text: regarding the exchange of cybersecurity information between Member States; and the

text: Article 32

text: refers to the

text: Regulation (EU) 2016/679

text: regarding the Infringements entailing a personal data breach.

text: Regulation (EU) 2019/881

text: of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing

text: Regulation (EU) No 526/2013

text: (Cybersecurity Act)), OJ L 151, 7.6.2019, p. 15–69. The same definition exists in the current NIS Directive. For example in Article 4(4) of the Proposal : ‘national strategy on cybersecurity’ means a coherent framework of a Member State providing strategic objectives and priorities on the security of network and information systems in that Member State;’ https://edpb.europa.eu/sites/edpb/files/files/file1/icann_letter_en.pdf (p. 4) See Court of Justice of European Union in Joint Cases C92/09, Volker und Markus Schecke Gbr v. Land Hessen, and

text: , Eifert v. Land Hessen and Bundesanstalt für Landwirtschaft und Ernahrung, at paragraph 53, where the CJEU considered that legal persons can claim the protection of Articles 7 and 8 of the Charter in so far as the official title of the legal person identifies one or more natural persons. Article 52(1) of the Charter provides that any limitation on the exercise of the rights and freedoms laid down by the Charter must be provided for by law, respect their essence and, subject to the principle of proportionality, limitations may be made to those rights and freedoms only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others. See, to that effect, Court of Justice of European Union, judgment of 17 December 2015, WebMindLicenses,

text: , EU:C:2015:832, paragraph 81.

text: Court of Justice of European Union, judgments of 16 December 2008, Satakunnan Markkinapörssi and Satamedia,

text: , EU:C:2008:727, paragraph 56; of 8 April 2014, Digital Rights Ireland and Others,

text: and

text: , EU:C:2014:238, paragraphs 51 and 52; of 6 October 2015, Schrems,

text: , EU:C:2015:650, paragraph 92; and of 21 December 2016, Tele2 Sverige and Watson and Others,

text: and

text: , EU:C:2016:970, paragraphs 96 and 103. Cf. Court of Justice of European Union, Opinion 1/15 of the Court of 26 July 2017, paragraphs 140 and 141. the judgment

text: (Schrems II) of the Court of Justice of the European Union (CJEU) (http://curia.europa.eu/juris/liste.jsf?num=

text: #) Recital (46) and Article 19 of the Proposal. These references are: (i) the inclusion of encryption in the set of important technologies for the Strategy, for which the EU needs to ensure control of their supply chain (page 1) and on the other hand the inclusion of encryption in the technologies in which the EU should further develop (page 18); (ii) the statement in section 2.4 of the Strategy, that encryption is regarded as one of the 3 key technologies with which cybersecurity must be integrated; and the intention to develop “new and more secure forms of encryption to shield against cyberattack” in the context of deploying a secure quantum communication infrastructure (QCI) for Europe which will offer high level of confidentiality. Statement of the WP29 on encryption and their impact on the protection of individuals with regard to the processing of their personal data in the EU, Brussels, April 11 2018: https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=622229. EDPB Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data https://edpb.europa.eu/sites/edpb/files/consultation/edpb_recommendations_202001_supplementarymeasurestra nsferstools_en.pdf. In line with Article 24(2) of the Proposal entities referred to in paragraph 1of Proposal shall be deemed to have their main establishment in the Union in the Member State where the decisions related to the cybersecurity risk management measures are taken. See the EDPB Opinion 8/2019 on the competence of a supervisory authority in case of a change in circumstances relating to the main or single establishment adopted on 12 July 2019, https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_opinion_201908_changeofmainorsingleestablishment_en. pdf.

identifier: EDPS yttrande 05/2021

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion on the Cybersecurity Strategy and the NIS 2.0 Directive

serie: yttranden

text: Opinion 5/2021

type: rubrik

text: on the Cybersecurity Strategy and the NIS 2.0 Directive

text: 11 March 2021 1 | P a g e

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Wiewiorówski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’ and under Article 57(1)(g), the EDPS shall ‘advise on his or her own initiative or on request, all Union institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion is issued by the EDPS, within the period of eight weeks from the receipt of the request for consultation laid down under

text: Article 42(3) of Regulation (EU) 2018/1725

text: , having regard to the impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data of the Commission Proposal for a Directive of the European Parliament and of the Council on measures for a high common level of cybersecurity across the Union, repealing

text: Directive (EU) 2016/1148

text: 2 | P a g e

text: Executive Summary

text: On 16 December 2020, the European Commission has adopted a proposal for a Directive of the European Parliament and of the Council on measures for a high common level of cybersecurity across the Union, repealing

text: Directive (EU) 2016/1148

text: (‘the Proposal’). In parallel, the European Commission and the High Representative of the Union for Foreign Affairs and Security Policy issued a Joint Communication to the European Parliament and the Council, titled ‘The EU's Cybersecurity Strategy for the Digital Decade’ (‘the Strategy’).

text: The EDPS fully supports the overall objective of the Strategy to ensure a global and open internet with strong safeguards for the risks to security and the fundamental rights, recognising the strategic value of the Internet and its governance and reinforcing the Union action therein, in a multi-stakeholders model.

text: The EDPS therefore equally welcomes the aim of the Proposal to introduce systemic and structural changes to the current NIS Directive in order to cover a wider set of entities across the Union, with stronger security measures, including mandatory risk management, minimum standards and relevant supervision and enforcement provisions. In this regard, the EDPS considers that it is necessary to fully integrate Union institutions, offices, bodies and agencies in the overall EU-wide cybersecurity framework for achieving a uniform level of protection, by including Union institutions, offices, bodies and agencies explicitly in the scope of the Proposal.

text: The EDPS further highlights the importance of integrating the privacy and data protection perspective in the cybersecurity measures stemming from the Proposal or from other cybersecurity initiatives of the Strategy in order to ensure a holistic approach and enable synergies when managing cybersecurity and protecting the personal information they process. It is equally important that that any potential limitation of the right to the protection of personal data and privacy entailed by such measures fulfil the criteria laid down in Article 52 of EU Charter of Fundamental Rights, and in particular that they be achieved by way of a legislative measure, and be both necessary and proportionate.

text: It is the expectation of the EDPS that the Proposal does not seek to affect the application of existing EU laws governing the processing of personal data, including the tasks and powers of the independent supervisory authorities competent to monitor compliance with those instruments. This means that all cybersecurity systems and services involved in the prevention, detection, and response to cyber threats should be compliant with the current privacy and data protection framework. In this regard, the EDPS considers it important and necessary to establish a clear and unambiguous definition for the term “cybersecurity” for the purposes of the Proposal.

text: The EDPS issues specific recommendations to ensure that the Proposal correctly and effectively complements the existing Union legislation on personal data protection, in particular the GDPR and the ePrivacy Directive, also by involving the EDPS and the European Data Protection Board when necessary, and establishing clear mechanisms for the collaboration between competent authorities from the different regulatory areas.

text: Furthermore, the provisions on managing internet Top Level Domain registries should clearly define the relevant scope and conditions in law. The concept of the proactive scans of network and information systems by the CSIRTs equally requires further clarifications on the scope and the types of personal data processed. Attention is drawn to the risks for possible non-

text: 3 | P a g e

text: compliant data transfers related to the outsourcing of cybersecurity services or the acquisition of cybersecurity products and their supply chain.

text: The EDPS welcomes the call for the promotion of the use of encryption, and in particular end-to-end encryption, and reiterates his position on encryption as a critical and irreplaceable technology for effective data protection and privacy, whose circumvention would deprive the mechanism of any protection capability due to their possible unlawful use and loss of trust in security controls. To this end, it should be clarified that nothing in the Proposal should be construed as an endorsement of weakening end-to-end encryption through “backdoors” or similar solutions.

text: 4 | P a g e

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular

text: Article 16

text: thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles

text: and

text: thereof, Having regard to

text: Regulation (EU) 2016/679

text: (General Data Protection Regulation) , Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular Article

text: (g) and 58(3)(c) thereof, Having regard to

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA ,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION

text: 1. On 16 December 2020, the European Commission has adopted a proposal for a Directive of the European Parliament and of the Council, on measures for a high common level of cybersecurity across the Union, repealing

text: Directive (EU) 2016/1148

text: (‘the Proposal’).

text: 2. On the same date, the European Commission and the High Representative of the Union for Foreign Affairs and Security Policy issued a Joint Communication to the European Parliament and the Council, titled ‘The EU's Cybersecurity Strategy for the Digital Decade’ (‘the Strategy’).

text: 3. The Strategy aims to strengthen the Union’s strategic autonomy in the fields of cybersecurity and to improve its resilience and collective response as well as to build a global and open Internet with strong guardrails to address the risks to the security and fundamental rights and freedoms of people in Europe.

text: 4. The Strategy contains proposals for regulatory, investment and policy initiatives in three areas of EU action: (1) resilience, technological sovereignty and leadership, (2) building operational capacity to prevent, deter and respond, and (3) advancing a global and open cyberspace.

text: 5. The Proposal constitutes one of the regulatory initiatives of the Strategy, and in particular in the area of resilience, technological sovereignty and leadership. 6 | P a g e

text: 6. According to the Explanatory Memorandum, the aim of the Proposal is to modernise the existing legal framework, i.e.

text: Directive (EU) 2016/1148

text: (‘NIS Directive’) . The Proposal aims to build on and repeal the current NIS Directive, which was the first EU-wide legislation on cybersecurity and provides legal measures to boost the overall level of cybersecurity in the Union. The Proposal takes account of the increased digitisation of the internal market in recent years and of an evolving cybersecurity threat landscape, as amplified since the onset of the COVID-19 crisis. The Proposal aims to address several identified shortcomings of the NIS Directive and aims to increase the level of cyber resilience of all those sectors, public and private, that perform an important function for the economy and society.

text: 7. The main elements of the Proposal are: (i) the expansion of the scope of the current NIS Directive by adding new sectors based on their criticality for the economy and society; (ii) stronger security requirements for covered companies and entities, by imposing a risk management approach providing a minimum list of basic security elements that have to be applied; (iii) addressing the security of supply chains and supplier relationships by requiring individual companies to address cybersecurity risks in supply chains and supplier relationships; (iv) enhancement of cooperation between Member State authorities and with Union institutions, offices, bodies and agencies in dealing with cybersecurity related activities, including cyber crisis management.

text: 8. On 14 January 2021, the EDPS received a request for formal consultation from the European Commission, on the “Proposal for a Directive of the European Parliament and of the Council on measures for a high common level of cybersecurity across the Union, repealing

text: Directive (EU) 2016/1148

text: 2. GENERAL COMMENTS

text: 2.1. On the Cybersecurity Strategy

text: 9. The EDPS welcomes the Cybersecurity Strategy and fully supports its objective to ensure a global and open internet with strong safeguards for the risks to security and the fundamental rights, recognising at the same time the strategic value of the Internet and its governance and reinforcing the Union action therein, in a multi-stakeholders model.

text: Article 5(1)

text: (f) of

text: Regulation (EU) 2016/679

text: (GDPR) has established security as one of the main principles relating to the processing of personal data.

text: Article 32

text: GDPR further defines this obligation, applicable to both controllers and processors, to ensure an appropriate level of security. Both provisions make clear that security is essential for compliance with EU data protection law. This is why the EDPS agrees that improving cybersecurity is essential for safeguarding fundamental rights and freedoms, including the rights to privacy and to the protection of personal data, and strongly supports the proposal for a comprehensive package of relevant effective technical and organisational measures.

text: 11. At the same time the EDPS recalls that the pursuance of the objectives of cybersecurity may lead to deploying measures that interfere with the rights to data protection and privacy 7 | P a g e of individuals. This means ensuring that any potential limitation of the right to the protection of personal data and privacy must fulfil the requirements of Article 52(1) of EU Charter of Fundamental Rights, in particular being achieved by way of a legislative measure, being both necessary and proportionate , and respecting the essence of the right.

text: 12. Security rules, security policies and security standards form the backbone of a proper cybersecurity and information security management. For this reason, the EDPS welcomes in particular the intention of the Strategy to establish:  Security rules for the cybersecurity as well as the information security of the Union’s institutions, offices, bodies and agencies;  Security rules for the cybersecurity of all connected products (IoT) and associated services;  Security standards on the security of 5G and future generation mobile networks, with particular focus on the security of the supply chain.

text: 13. The EDPS fully supports the initiatives of the Strategy regarding ‘technological sovereignty and leadership’. In his Strategy for 2020-2024 , the EDPS expressed his strong support for policy initiatives promoting ‘digital sovereignty’, where data generated in Europe is converted into value for European companies and individuals, and processed in accordance with European values. The EDPS therefore particularly welcomes the following initiatives:  the building of a network of Security Operations Centres across the EU;  the initiative to deploy a secure quantum communication infrastructure (QCI) built with European technology;  the development of a public European DNS resolver service; and  the establishment of the Cybersecurity Industrial, Technology and Research Competence Centre and Network of Coordination Centres (CCCN), that will support developing the EU’s technological sovereignty, and reduce dependence on other parts of the globe for the most crucial technologies.

text: 14. The EDPS is aware of the potential of artificial intelligence in developing advanced cybersecurity capabilities for the real-time detection, analysis, containment and response to cyber threats in a continuously enlarged digital landscape. However, these technologies generally require processing of large amounts of personal data (e.g. user log data) and come with their own risks that need to be identified and mitigated (e.g. lack of transparency or bias). Use of technologies for improving cybersecurity should not unduly interfere with the rights and freedoms of individuals. The first step to avoid or mitigate those risks is to apply the data protection by design and by default requirements laid down in

text: Article 25

text: GDPR, which will assist in integrating the appropriate safeguards such as pseudonymisation, encryption, data accuracy, data minimization, in the design and use of these technologies and systems.

text: 15. Whereas the security of the information processed by critical and important organisations and infrastructure, as identified in the Proposal, is of the utmost importance for the EU economy and society, the protection of privacy and personal data is widely supported also by small and medium enterprises (SMEs) providing digital services and needs adequate cybersecurity awareness and skills among individuals. This is why the EDPS welcomes the plan for a widespread adoption of cybersecurity technologies through dedicated support to SMEs under the Digital Innovation Hubs and other instruments, as well as 8 | P a g e plans for a strengthened cybersecurity awareness among individuals, especially children and young people, and organisations, especially SMEs, through the Revised Digital Education Action Plan.

text: 16. The EDPS submits that the legislator, as well as Member States and EU institutions, should take into account the role of cybersecurity in the protection of privacy and personal data by considering this “dimension” in all the above-mentioned policy actions, and in particular the need to protect individuals and their fundamental rights and have these, too, as assets to protect, further to other kinds of assets under their responsibility. Integrating the privacy and data protection perspective in the traditional cybersecurity management will ensure a holistic approach and enable synergies to public and private organisations when managing cybersecurity and protecting the information they process without useless multiplication of efforts.

text: 17. The EDPS welcomes that the Strategy considers Union institutions, offices, bodies and agencies (EUIs) both as organisations to defend together with Member States entities and actors as part of an EU-wide coordinated cybersecurity approach. This holds true in particular with a view to the creation of a Joint Cyber Unit (JCU), whose planned purpose is to improve and accelerate coordination among all actors and allow the EU to face up and respond to large-scale cyber incidents and crises. The Strategy notes that as “part of their contribution to the JCU, the EU actors (Commission and EU agencies and bodies) will therefore be ready to increase significantly their resources and capabilities, so as to level up their preparedness and resilience”. The EDPS recommends that the co-legislators consider and plan for these resources to be used by EUIs to strengthen their cybersecurity capacity, including in a way that is fully respecting the EU’s values.

text: 18. As mentioned above in the more general context of the Strategy, we recommend that the actions and the relevant increase in resources take into account the privacy and data protection dimensions of cybersecurity by investing in policies, practices and tools where the privacy and data protection perspective is integrated in the traditional cybersecurity management and effective data protection safeguards are integrated when processing personal data in cybersecurity activities. 2.2. On the Proposal

text: 19. The EDPS welcomes the aim of the Proposal to introduce systemic and structural changes to the current NIS Directive in order to cover a wider set of entities across the Union, with stronger security measures, including minimum standards and relevant supervision and enforcement provisions and by promoting the collaboration and shared responsibilities and accountability.

text: 20. The EDPS expects that the proposed changes will have a positive impact on the security of personal data and electronic communications, both by improving the cybersecurity practices the entities that are directly covered by the Proposal, as well as by improving the security of the internet more generally.

text: 21. The EDPS welcomes the numerous references to the protection of fundamental rights, including the right to data protection and privacy in various parts of the text of the Proposal. 9 | P a g e 2.3. On the scope of the Strategy and of the Proposal to the Union institutions, offices, bodies and agencies

text: 22. The Strategy proposes specific actions aimed to boost the information security posture of EUIs and harmonise it among the various EUIs. These actions include: a) two legislative proposals for common binding rules on information security and for common binding rules on cybersecurity for all EUI’s in 2021; b) increased investments to reach a high level of cyber maturity; c) a reinforced CERT-EU with an improved funding mechanism.

text: 23. The EDPS shares the Commission’s conclusion in the Strategy that the level of cyber resilience and ability to detect and respond to malicious cyber activities varies significantly across EUI’s in terms of maturity. We also take note of the involvement of EUIs such as ENISA and the Commission in the ensuring a high level of cybersecurity in the Member States.

text: 24. The EDPS takes note however that the provisions of the Proposals are addressed only to the Union’s Member States. Given the recognised need to improve the overall level of cybersecurity through consistent and homogeneous rules, the EDPS recommends that the co-legislators take into account EUIs needs and roles so that EUIs can be integrated in this overall EU-wide cybersecurity framework as entities enjoying the same high level of protection as those in the Member States.

text: 25. To this aim, the EDPS suggests including Union institutions, offices, bodies and agencies explicitly in the scope of the Proposal. Alternatively, the EDPS recommends that co-legislators include in the text of the Proposal an explicit obligation for the Commission to propose separate legislative proposals for EUIs still within the year 2021, so as to create an actionable link between the Proposal itself and the future legislative action at EUIs level in order to achieve consistent and homogeneous rules for Member States and EUIs.

text: 3. SPECIFIC RECOMMENDATIONS

text: 26. The remainder of this Opinion contains specific recommendations to ensure that the Proposal complements the existing Union legislation on personal data protection, in particular the GDPR and the ePrivacy Directive effectively and increases the protection for the fundamental rights and freedoms of the individuals concerned. 3.1. Relationship to existing Union legislation on personal data protection

text: 27. The EDPS observes that the Proposal in different parts clarifies that it is “without prejudice” to the GDPR and the ePrivacy Directive but only with reference to specific contexts, and sometimes only the one of the two instruments is mentioned.

text: 28. The EDPS notes that, in order to comply with the Proposal, entities covered by it will have to deploy certain cybersecurity controls which will most likely involve the processing of personal data and of electronic communications data, including traffic data. 10 | P a g e

text: 29. The EDPS therefore considers that the extension of the scope of the Proposal to a wider set of activities will entail an increase in the processing of personal data for cybersecurity purposes. Furthermore, the EDPS notes that in line with

text: Article 2(2)

text: , the Proposal also applies to ‘public electronic communications networks or publicly available electronic communications services’, which are also covered by the ePrivacy Directive. This means that the requirements of both the GDPR and the ePrivacy Directive will need to be taken into account.

text: 30. The EDPS notes that organisations acting as controllers and processors do not always realise that the data processed in cybersecurity systems and services may constitute personal data (e.g. IP addresses, device identifiers, network log files, access control log files, etc.). This leads to non-compliance with the GDPR especially as to principles such as purpose limitation, storage limitation, data protection by design and by default, and obligations for compliant data transfers. The EDPS considers that it must be made evident that all cybersecurity systems and services involved in the prevention, detection, and response to cyber threats should be compliant with the current data protection framework and should take relevant technical and organisational safeguards to ensure this compliance in an accountable way.

text: 31. The EDPS therefore considers it necessary to clarify in

text: Article 2

text: that the Union’s legislation for the protection of personal data, in particular the GDPR and the ePrivacy Directive, shall apply to any processing of personal data falling within the scope of the Proposal (instead just within specific contexts). A corresponding recital should equally clarify that the Proposal does not seek to affect the application of existing EU laws governing the processing of personal data, including the tasks and powers of the independent supervisory authorities competent to monitor compliance with those instruments. 3.2. The definition of cybersecurity

text: 32. The EDPS observes that the main term of the Proposal is “cybersecurity” (also in the title of the Proposal), while in the current NIS Directive the main term is “security of network and information systems”. However, the term “security of network and information systems” continues to be used in the Proposal alongside the term ‘cybersecurity’. Moreover, these terms are not used in a coherent manner throughout the text.

text: 33. In the Proposal, “cybersecurity” is defined in the

text: Article 4(3)

text: , which refers to

text: Article 2(1) of Regulation (EU) 2019/881

text: as: “the activities necessary to protect network and information systems, the users of such systems, and other persons affected by cyber threats”. The term ‘cyber threat’ as defined in

text: Article 2(8) of Regulation (EU) 2019/881

text: means “any potential circumstance, event or action that could damage, disrupt or otherwise adversely impact network and information systems, the users of such systems and other persons”.

text: 34. According to Article 4(2) of the Proposal , the term “security of network and information systems” is defined as: “the ability of network and information systems to resist, at a given level of confidence, any action that compromises the availability, authenticity, integrity or confidentiality of stored or transmitted or processed data or the related services offered by, or accessible via, those network and information systems”. 11 | P a g e

text: 35. The EDPs submits that the term “cybersecurity”, as defined in

text: Regulation (EU) 2019/881

text: and equally used in the Proposal, takes into account adverse impacts also on “...users of such systems and other persons”. This definition allows to take into account the management of the risks to fundamental rights and freedoms of individuals when their personal data are processed via network and information systems and implies an integrated approach.

text: 36. At the same time we note that the term “security of network and information systems” does not include this perspective, since it does not explicitly refer to the protection of individuals. This is not an issue insofar as the term is used only to emphasize the focus on the network and information systems infrastructure as such, and the primary need for protection of these assets, which is then functional to the protection of other assets including individuals. Nevertheless, the EDPS observes as these two terms are used almost in an interchangeable way in the Proposal with possible unintended operational consequences as to the need to take into account the protection of individuals.

text: 37. The EDPS thus invites the co-legislators to clarify this issue. The EDPS suggests that given the broader scope, the term “cybersecurity” should be used in general and that the term of “security of network and information systems” be used only when the context (e.g. a purely technical one, without having regard to impacts also on users of systems and other persons) allows it. 3.3. Domain names and registration data (‘WHOIS data’)

text: 38. The EDPS welcomes Recital 59 of the Proposal, which states that where processing of ‘WHOIS data’ includes personal data, such processing shall comply with Union data protection law. Additionally, Recital 60 also confirms that access to these data by competent authorities should comply with Union data protection law insofar as it is related to personal data. As indicated above (see section 3.1), the EDPS strongly recommends adding (in

text: Article 2

text: ) a general substantive provision on the application of Union data protection law, instead of several instances.

text: 39. Article 23(2) of the Proposal refers to the “relevant information to identify and contact the holders of the domain names and the points of contact administering the domain names under the TLDs”. The EDPS recommends clearly spelling out what constitutes “relevant information” for purposes of this provision, including personal data, taking into account the principles of necessity and proportionality. Doing so would promote legal certainty, as well as a ensuring a consistent approach across the EU’s 27 Member States.

text: 40. Article 23(4) of the Proposal furthermore requires Member States to ensure that the registries and the entities providing domain name registration services publish, without undue delay, domain registration data which are not personal data. The EDPS equally recommends clarifying in greater detail which categories of data domain registration data (which do not constitute personal data) should be the subject of publication.

text: 41. Recital 14 of the GDPR states that it ‘does not cover processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person’. The EDPS recalls that while the contact details of a legal person are outside the 12 | P a g e scope of GDPR provided they do not identify a natural person, the contact details concerning natural persons are within the scope of GDPR .

text: 42. Moreover,

text: Article 4(1)

text: GDPR defines personal data as ‘any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Even the data concerning legal persons may therefore in some cases be considered as personal data, as the clarified by the CJEU . In these cases, the determining factor is whether the information ‘relates to’ an ‘identifiable’ natural person.

text: 43. Article 23(5) of the Proposal requires Member States to ensure that the TLD registries and the entities providing domain name registration services for the TLD provide access to specific domain name registration data upon lawful and duly justified requests of legitimate access seekers, in compliance with Union data protection law. The Proposal neither defines what is to be understood by “lawful and duly justified requests”, nor defines “legitimate access seekers”, nor specifies any purposes for such access. The Proposal also does not lay down any objective criterion by which to determine the limits of the access of “legitimate access seekers” to the data and their subsequent use.

text: 44. Article 23(5) of the Proposal creates an obligation for Member States to interfere with the fundamental right to the protection of personal data guaranteed by Article 8 of the Charter because it provides for the processing of personal data .

text: 45. In accordance with Article 52(1) of the Charter, the CJEU has repeatedly clarified that the legal basis which permits the interference must itself define the scope of the limitation on the exercise of the right concerned . In accordance with the principle of proportionality, any derogations from and limitations on the protection of personal data should apply only in so far as is strictly necessary. In order to satisfy that requirement, the legislation in question which entails the interference must lay down clear and precise rules governing the scope and application of the measure in question and imposing minimum safeguards, so that the persons whose data has been accessed have sufficient guarantees to protect effectively their personal data against the risk of abuse. It must, in particular, indicate in what circumstances and under which conditions a measure providing for the processing of such data may be adopted, thereby ensuring that the interference is limited to what is strictly necessary. The need for such safeguards is all the greater where personal data is subject to automated processing.

text: 46. In view of these requirements, the EDPS underlines that the text of the Proposal must therefore further clarify which (public or private) entities might constitute “legitimate access seekers”. For example, it should be clarified whether access shall be limited to those entities identified in recital (60) of the Proposal, or whether any other category of recipients may be given access. The EDPS submits that in practice entities outside the EEA might also request access to specific domain name registration data. For this reason, the EDPS invites the legislators to clarify in this Proposal whether or not the personal data held by the TLD registries and the entities providing domain name registration services for the TLD 13 | P a g e should also be accessible by entities outside the EEA. If that is to be the case, the Proposal should clearly lay down the conditions, limitations and procedures for such access, taking into account also the requirements of

text: Article 49(2)

text: GDPR, where applicable.

text: 47. In the same vein, the EDPS also recommends introducing further clarification as to what constitutes a “lawful and duly justified” request on the basis of which access shall be granted, and under which conditions. 3.4. ‘Proactive scanning of network and information systems’ by CSIRTs

text: 48. The EDPS observes that

text: Article 10(2)

text: (e) of the Proposal assigns CSIRTs with the task to provide, upon request of an (essential or important) entity, a “proactive scanning of the network and information systems used for the provision of their services”. The EDPS understands this as referring not only to network scanning but also to scanning of information systems in general (applications, servers, and databases).

text: 49. Recital 25 states that “[a]s regards personal data, CSIRTs should be able to provide, in accordance with

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council as regards personal data, on behalf of and upon request by an entity under this Directive, a proactive scanning of the network and information systems used for the provision of their services”.

text: 50. The EDPS notes that recital 69 further clarifies the activities of CSIRTs, specifying their purpose in general terms (i.e. ‘ensuring network and information security by entities’) and scope (i.e. ‘measures related to the prevention, detection, analysis and response to incidents, measures to raise awareness in relation to specific cyber threats, exchange of information in the context of vulnerability remediation and coordinated disclosure, as well as the voluntary exchange of information on those incidents, as well as cyber threats and vulnerabilities, indicators of compromise, tactics, techniques and procedures, cybersecurity alerts and configuration tools’) and the types of personal data that might be involved (i.e. ‘IP addresses, uniform resources locators (URLs), domain names, and email addresses’).

text: 51. The EDPS considers that the Proposal does not sufficiently delineate the nature of the processing of personal data involved in proactive scanning. In light of the wording of Recital (69) (“may require”), the EDPS understands that the aim of

text: Article 10(2)

text: (e) is not to enable systematic collection and analysis of personal data and/or electronic communications data by CSIRTs. In the interest of legal certainty, the EDPS recommends that the co-legislators more clearly delineate the types of proactive scanning which CSIRTs may be requested to undertake and to identify the main categories of personal data involved in the text of the Proposal. 3.5. Outsourcing and supply chain

text: 52. Recitals 42 and 44 of the Proposal imply that there is a possibility for the essential and important entities to outsource parts or the whole of their cybersecurity activities to external Service Providers, like the ‘managed security services providers (MSSPs)’.

text: 53. The EDPS recalls that the outsourcing of such activities by the controller, needs to be in full compliance with the GDPR. In particular, the processing by a processor shall be governed by a contract or other legal act under Union or Member State law in accordance 14 | P a g e with

text: Article 28

text: GDPR. Furthermore, the EDPS recalls that transfers of personal data to third countries or international organisations must comply with Chapter V and the relevant case law of the Court of Justice .

text: 54. The EDPS welcomes the measures for mitigation of risks due to technical and, where relevant, non-technical factors of the supply chain through coordinated (sectoral) supply chain risk assessments . The EDPS also welcomes that among the criteria to identify the supply chains that should be subject to a coordinated risk assessment, the Proposal identifies the relevance of specific critical ICT services, systems or products processing, inter alia, personal data.

text: 55. The EDPS stresses that among the specific factors to be considered when assessing supply chains for technology and systems processing personal data, specific attention should be given to those features enabling the effective implementation of the principle of data protection by design and by default. Doing so could help promote compliance with

text: Article 25

text: GDPR, as well as contribute to the effective protection of communications and the terminal equipment in the ePrivacy Directive.

text: 56. Furthermore, the EDPS considers that, in the assessment of the supply chain risks, emphasis should be given to ICT services, systems or products subject to specific requirements in the country of origin that might represent an obstacle to compliance with EU privacy and data protection law.

text: 57. The EDPS also recommends that the European Data Protection Board established by

text: Article 68

text: GDPR (EDPB) be consulted when defining these criteria and, as necessary, in the coordinated sectoral risk assessment mentioned in the recital 46.

text: 58. The EDPS takes also the opportunity to recommend to mention in a recital that open source cybersecurity products (software and hardware), including open source encryption, might offer the necessary transparency to mitigate specific supply chain risks. 3.6. Encryption

text: 59. The EDPS welcomes the inclusion of encryption and cryptography in the list of minimum safeguards for cybersecurity, in Article 18 of the Proposal. In addition, the EDPS welcomes also the references to the encryption in the Strategy .

text: 60. The EDPS fully supports the statement contained in Recital 54 of the Proposal regarding the promotion and even the mandatory use of end-to-end encryption by the providers of electronic communications services.

text: 61. Recital 54 also states, however, that the use of end-to-end encryption should be “reconciled” with the Member State’ powers to ensure the protection of their essential security interests and public security, and to permit the investigation, detection and prosecution of criminal offences in compliance with Union law. In particular, it is stated that “[s]olutions for lawful access to information in end-to-end encrypted communications should maintain the effectiveness of encryption in protecting privacy and security of communications, while providing an effective response to crime”. 15 | P a g e

text: 62. The EDPS wishes to reiterate that, in line with the statement of

text: Article 29

text: Working Party encryption is a critical and irreplaceable technology for effective data protection and privacy. Strong encryption must be available to be used for the mitigation of high risks for the rights and freedoms of individuals. As an example of the need to use strong encryption, the EDPS recalls the recent EDPB Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data , which contain certain use cases where strong encryption can be used to mitigate risks related to non-compliant data transfers.

text: 63. Any weakening or circumvention of encryption (e.g. using mandatory backdoors, mandatory key escrow, and hidden communication channels) would completely devoid the mechanism of any effective protection capability due to their possible unlawful use and loss of trust in security controls. It would thus inevitably compromise the protection of the fundamental rights to the protection of personal data and privacy, as it would pose significant risks to the economy and society in general. Even when strong encryption is not used while still available, unauthorized decryption or reverse engineering of encryption code, or monitoring of electronic communications outside clear legal authority should be prohibited.

text: 64. While the EDPS understands that law enforcement requires the means to fight crime on the internet, any measure interfering with confidentiality of communications must comply with the requirements of legality, necessity and proportionality, based on substantiated evidence. While encryption makes bulk data collection and mass surveillance difficult, it is not a limiting factor to more targeted and specific measures. The EDPS therefore recommends clarifying in recital 54 that nothing in the Proposal should be construed as an endorsement of weakening end-to-end encryption through “backdoors” or similar solutions. 3.7. Cybersecurity risk management measures

text: 65. The EDPS welcomes

text: Article 18

text: which requires Member States to ensure that essential and important entities shall take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems as well as the minimum set of measures provided in

text: Article 18(2)

text: 66. The EDPS recalls that the management of risks for the rights and freedoms of individuals, when their personal data are processed, is an obligation for all controllers (and not only essential and important entities) under Article 32 of the GDPR. Whereas the Cybersecurity risk management measures of Article 18 of the Proposal aims at protecting network and information systems of the organisation (and the data therein),

text: Article 32

text: GDPR aims at protecting individuals (not necessarily belonging to the same organisation) and their rights by protecting their data. There is a difference in the assets to protect in the two activities, which might lead to different conclusions in certain circumstances. At the same time, the cybersecurity risk management process can contribute to the assessment of the data protection impact of weaknesses in the security of personal data. As stated above as to the wider measure of the Strategy, the EDPS recommends integrating the privacy and data protection considerations into cybersecurity risk management to ensure a holistic approach and enable synergies to public and private organisations when managing cybersecurity and protection the information they process without unnecessary multiplication of efforts. 16 | P a g e

text: 67. The EDPS suggests adding these considerations both in recitals and in the substantive part of the Proposal, in a way that possible future Commission implementing acts, EU level guidance on cybersecurity from ENISA as well as its work on European cybersecurity certification schemes (see Article 21 of the Proposal), and work from EU standardisation bodies (see

text: Article 22

text: ), could take them into account and thus integrate the management of the risks for individuals and their fundamental rights stemming from cybersecurity threats.

text: 68. Given the strong links between cybersecurity management and personal data protection the EDPS also suggests adding an obligation for ENISA to consult the EDPB when drawing up relevant advice. These acts and guidance can also be useful to those organisations that are not under the scope of the Directive but could still provide similar benefits as well as promote compliance with the GDPR obligations on security of personal data. 3.8. Personal data breaches

text: 69. Pursuant to Article 20(2) of the Proposal, Member States shall ensure that essential and important entities notify, without undue delay, the competent authorities or the CSIRT of any significant cyber threat that those entities identify that could have potentially resulted in a significant incident.

text: Article 20(3)

text: defines when an incident shall be considered “significant”. One option is that the incident has affected or has the potential to affect other natural or legal persons by causing considerable material or non-material losses.

text: 70. The EDPS welcomes

text: Article 20(3)

text: (b) of the Proposal which considers not only impacts on the organisation but also those on natural persons who may be affected. At the same time, the EDPS also notes that the definition in

text: Article 20(3)

text: (b) would encompass some “personal data breaches”, as defined in Article 4(12) of the GDPR. It seems that the corresponding reporting obligations may also overlap in certain cases with the notification of personal data breaches to competent authorities in accordance with

text: Article 33

text: GDPR. Nevertheless, the definitions of the circumstances leading to the obligation, the set maximum delays as well as the competent authorities to report/notify are different. Analogous notification obligations to competent authorities are set in the ePrivacy Directive, currently under review.

text: 71. The EDPS welcomes

text: Article 28(2)

text: , which establishes that the competent authorities under the Proposal shall work in close cooperation with data protection authorities when addressing incidents resulting in personal data breaches, and thus creates synergies between the legal instruments. The EDPS also welcomes the obligations of

text: Article 32(1)

text: for competent authorities to inform data protection competent authorities when they have indications that the infringement by an essential or important entity of the obligations laid down in Articles

text: and

text: entails a personal data breach which shall be notified pursuant to

text: Article 33

text: GDPR.

text: 72. The EDPS notes that this obligation on competent authorities to notify to GDPR competent authorities is “within a reasonable period of time”. The EDPS observes that this obligation is without prejudice to the reporting obligation on controllers as defined in

text: Article 33

text: GDPR, which must be done “without undue delay” and “not later than 72 hours” after becoming aware of the personal data breach. In order to enable data protection authorities to perform effectively their tasks, the EDPS suggests to change the wording of the Proposal “within a reasonable period of time” to “without undue delay”. 17 | P a g e 3.9. Cooperation Group

text: 73. Article 12 of the Proposal establishes a Cooperation Group in order to support and to facilitate strategic cooperation and the exchange of information among Member States in the field of application of the Proposal. Taking into account the task of this Group and possible link with the data protection framework, the EDPS recommends including a representative of the EDPB as a member of the Cooperation Group. 3.10. Jurisdiction and territoriality The EDPS observes that the concept of “main establishment” used in Article 24(2) of the Proposal , is defined differently than in Article 4(16) of the GDPR.

text: 74. As regards the GDPR, the concept of “main establishment” is particularly important in cases involving cross-border processing of personal data.

text: Article 56(1)

text: GDPR contains an overriding rule and provide that the supervisory authority of the main establishment or of the single establishment of the controller or processor is competent to act as Lead Supervisory Authority for the cross-border processing carried out by that controller or processor . Consequently, the EDPS recommends providing a clarification in the legal text that the Proposal does not affect the competences of data protection supervisory authorities under the GDPR (see above, section 3.8).

text: 75. The EDPS reiterates his support for Article 28(2) of the Proposal, which provides that competent authorities shall work in close cooperation with data protection authorities when addressing incidents resulting in personal data breaches (see above, para. 67).

text: 76. At the same time, the EDPS stresses the need to provide in the Proposal a more comprehensive legal basis for the cooperation and exchange of relevant information between the competent authorities under the Proposal and other relevant supervisory authorities, each acting within their respective areas of competence. In particular, the EDPS recommends to make explicit that competent authorities under the Proposal should be able to provide to the competent supervisory authorities under

text: Regulation (EU) 2016/679

text: , upon request or on their own initiative, any information obtained in the context of any audits and investigations that relate to the processing of personal data and to include an explicit legal basis to that this effect.

text: 4. CONCLUSIONS

text: 77. In light of the above, the EDPS makes the following recommendations: Concerning the Cybersecurity Strategy  to take into account that the first step to mitigate data protection and privacy risks that are associated with new technologies for improving cybersecurity, such as AI, is to apply the data protection by design and by default requirements laid down in

text: Article 25

text: GDPR, which will assist in integrating the appropriate safeguards such as pseudonymisation, encryption, data accuracy, data minimization, in the design and use of these technologies and systems; 18 | P a g e  to take into account the importance of integrating the privacy and data protection perspective in the cybersecurity related policies and standards as well as in the traditional cybersecurity management in order to ensure a holistic approach and enable synergies to public and private organisations when managing cybersecurity and protecting the information they process without useless multiplication of efforts;  to consider and plan for resources to be used by EUIs to strengthen their cybersecurity capacity, including in a way that is fully respecting the EU’s values;  take into account the privacy and data protection dimensions of cybersecurity by investing in policies, practices and tools where the privacy and data protection perspective is integrated in the traditional cybersecurity management and effective data protection safeguards are integrated when processing personal data in cybersecurity activities; On the scope of the Strategy and of the Proposal to the Union institutions, offices, bodies and agencies:  to take into account the EUIs needs and role so that EUIs be integrated in this overall EU-wide cybersecurity framework as entities enjoying the same high level of protection as those in the Member States; and  to include Union institutions, offices, bodies and agencies explicitly in the scope of the Proposal. Concerning the relationship to existing Union legislation on personal data protection:  to clarify in Article 2 of the Proposal that the Union’s legislation for the protection of personal data, in particular the GDPR and the ePrivacy Directive apply to any processing of personal data falling within the scope of the Proposal (instead just within specific contexts); and  to also clarify in a relevant recital that the Proposal does not seek to affect the application of existing EU laws governing the processing of personal data, including the tasks and powers of the independent supervisory authorities competent to monitor compliance with those instruments; Concerning the definition of cybersecurity:  to clarify the different use of the terms “cybersecurity” and “security of network and information systems”; and to use the term “cybersecurity” in general and the term of “security of network and information systems” only when the context (e.g. a purely technical one, without having regard to impacts also on users of systems and other persons) allows it. 19 | P a g e Concerning the domain names and registration data (‘WHOIS data’):  to clearly spell out what constitutes “relevant information” for the purposes of identification and contacting the holders of the domain names and the points of contact administering the domain names under the TLDs;  to clarify in greater detail which categories of data domain registration data (which do not constitute personal data) should be the subject of publication;  to clarify further which (public or private) entities might constitute “legitimate access seekers”;  to clarify whether the personal data held by the TLD registries and the entities providing domain name registration services for the TLD should also be accessible by entities outside the EEA, and if that would be the case to clearly lay down the conditions, limitations and procedures for such access, taking into account also the requirements of

text: Article 49(2)

text: GDPR, where applicable; and  to introduce further clarification as to what constitutes a “lawful and duly justified” request on the basis of which access shall be granted, and under which conditions. Concerning the ‘proactive scanning of network and information systems’ by CSIRTs:  to clearly delineate the types of proactive scanning which CSIRTs may be requested to undertake and to identify the main categories of personal data involved in the text of the Proposal. Concerning outsourcing and supply chain:  to take into account the features enabling the effective implementation of the principle of data protection by design and by default, when assessing supply chains for technology and systems processing personal data;  to take into account specific requirements in the country of origin that might represent an obstacle to compliance with EU privacy and data protection law, when assessing the supply chain risks of ICT services, systems or products; and  to include in the legal text the mandatory consultation of the EDPB when defining the aforementioned features and, as necessary, in the coordinated sectoral risk assessment mentioned in the recital 46.  to recommend to mention in a recital that open source cybersecurity products (software and hardware), including open source encryption, might offer the necessary transparency to mitigate specific supply chain risks Concerning encryption:  to clarify in recital 54 that nothing in the Proposal should be construed as an endorsement of weakening end-to-end encryption through “backdoors” or similar solutions; 20 | P a g e Concerning Cybersecurity risk management measures:  to include both in recitals and in the substantive part of the Proposal the concept that integrating the privacy and data protection perspective in the traditional cybersecurity risk management will ensure a holistic approach and enable synergies to public and private organisations when managing cybersecurity and protection the information they process without useless multiplication of efforts;  to add in the legal text an obligation for ENISA to consult the EDPB when drawing up relevant advice; Concerning personal data breaches: Concerning the Cooperation Group:  to include in the legal text the participation of EDPB in the Cooperation Group, taking into account the link between the task of this Group and the data protection framework. Concerning jurisdiction and territoriality:  to clarify in the legal text that the Proposal does not affect the competences of data protection supervisory authorities under the GDPR;  to provide a comprehensive legal basis for the cooperation and exchange of information among competent and supervisory authorities, each acting within their respective areas of competence; and  to clarify that competent authorities under the Proposal should be able to provide to the competent supervisory authorities under

text: Regulation (EU) 2016/679

text: , upon request or on their own initiative, any information obtained in the context of any audits and investigations that relate to the processing of personal data and to include an explicit legal basis to that this effect. Brussels, 11 March 2021 [e-signed] Wojciech Rafał WIEWIÓROWSKI 21 | P a g e

text: Notes

text: 22 | P a g e

text: 23 | P a g e


text: 8 Security Union Strategy , the EU Strategy to tackle Organised Crime 2021-2025 and the 2021 Strategy towards a fully functioning and resilient Schengen area . Moreover, the Proposals establishing the Police Cooperation Code should be considered in the light of the ongoing reform of Europol and the growing role of the Agency as a central criminal information hub of the Union, collecting and processing ever-increasing amounts of data .

text: OJ L 295, 21.11.2018, p. 39. COM(2021) 782 final. COM(2021) 784 final. COM(2021) 780 final. Explanatory Memorandum, p. 2. Explanatory Memorandum, p. 3. Communication from the Commission on the EU Security Union Strategy, COM/2020/605 final. Communication from the Commission on the EU Strategy to tackle Organised Crime 2021-2025, COM/2021/170 final Communication from the Commission “A strategy towards a fully functioning and resilient Schengen area", COM/2021/277 final. For more information see the EDPS Opinion 4/2021, https://edps.europa.eu/system/files/2021-03/21-03- 08_opinion_europol_reform_en.pdf

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA Council Framework Decision 2006/960/JHA of 18 December 2006 on simplifying the exchange of information and intelligence between law enforcement authorities of the Member States of the European Union, OJ L 386, 29.12.2006, p. 89–100. Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters OJ L 350, 30.12.2008, p. 60–71.

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation)

text: Regulation (EU) 2016/794

text: of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA See for instance EDPS Opinion 4/2021, para. 40.

identifier: EDPS yttrande 05/2022

title: EDPS Opinion on the Proposal for a Directive on information exchange between law enforcement authorities of Member States

text: 7 March 2022

text: Opinion 5/2022

text: on the Proposal for a Directive on information exchange between law enforcement authorities of Member States

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under

text: Article 52(2) of Regulation (EU) 2018/1725

text: ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiorówski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: Under

text: Article 42(1) of Regulation (EU) 2018/1725

text: , the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’ and under

text: Article 57(1)

text: (g), the EDPS shall ‘advise on his or her own initiative or on request, all Union institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the EDPS' mission to advise the EU institutions on coherently and consistently applying the EU data protection principles. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: Executive Summary

text: The European Commission adopted on 8 December 2021 a Proposal for Directive of the European Parliament and of the Council on information exchange between law enforcement authorities of Member States. The Proposal is part of a larger legislative package, referred to as “EU Police Cooperation Code”, which also includes a Proposal for a Regulation of the European Parliament and of the Council on automated data exchange for police cooperation (“Prüm II”), amending Council Decisions 2008/615/JHA and 2008/616/JHA (the “Prüm Decisions”) and Regulations

text: (EU) 2018/1726

text: , 2019/817 and 2019/818 of the European Parliament and of the Council (subject to a separate EDPS opinion), and Proposal for Council Recommendation on operational police cooperation.

text: The Proposal aims at facilitating equivalent access for law enforcement authorities to information held in another Member State, while complying with fundamental rights, including data protection requirements; as well as ensuring that all Member States have an effective functioning Single Point of Contact and remedying the proliferation of communication channels used for law enforcement information exchange between Member States, while reinforcing Europol’s role as the EU criminal information hub.

text: While the EDPS understands the need for the law enforcement authorities to benefit from the best possible legal and technical tools for exchange of information for the purpose of preventing, detecting or investigating criminal offences, he considers that certain elements of the Proposal need to be amended in order to ensure compliance with data protection requirements.

text: Firstly, the Proposal should clearly define the personal scope of the information exchange, and in any event limit the categories of personal data that may be exchanged about witnesses and victims, in line with Article 6 of the Law Enforcement Directive 2016/680 and similarly to the approach taken by Annex II of the Europol Regulation.

text: The EDPS also considers that, in line with the principle of storage limitation, the future Directive should explicitly lay down that the personal data in the case management systems of the Single Points of Contact should only be stored for very short periods of time which should generally correspond to the time limits for provision of information stipulated in Article 5 of the Proposal.

text: Finally, the EDPS is of the opinion that the Member States should be required to assess on a caseby-case basis whether Europol should receive a copy of the exchanged information, and for what purpose. The Proposal should also explicitly require that this purpose, together with any restrictions pursuant to Article 19 of the Europol Regulation, are communicated to Europol.

text: The Opinion also analyses and provides recommendations on a number other specific issues, such as the relationship of the Proposed Directive with the existing data protection legal framework as well as the use of SIENA as the main channel for communication between Member States.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular

text: Article 16

text: thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles

text: and

text: thereof,

text: Having regard to

text: Regulation (EC) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 8 December 2021, the European Commission adopted a Proposal for a Directive of the European Parliament and of the Council on information exchange between law enforcement authorities of Member States, repealing Council Framework Decision 2006/960/JHA (the “Proposal”).

text: 2. The Proposal is part of a larger legislative package, referred to as “EU Police Cooperation Code”, which also includes: - Proposal for a Regulation of the European Parliament and of the Council on automated data exchange for police cooperation (“Prüm II”), amending Council Decisions 2008/615/JHA and 2008/616/JHA and Regulations

text: (EU) 2018/1726

text: , 2019/817 and 2019/818 of the European Parliament and of the Council , and - Proposal for a Council Recommendation on operational police cooperation .

text: 3. The objective of the EU Police Cooperation Code is to streamline, enhance, develop, modernise, and facilitate law enforcement cooperation between relevant national agencies . In this regard, the Proposal for a Directive aims at ensuring the equivalent access for any Member State’s law enforcement authorities to information available in other Member States for the purpose of preventing and detecting criminal offences, conducting criminal investigations or criminal operations, thereby overcoming currently existing rules at national level, which impede the effective and efficient flow of information . The Proposal therefore seeks to establish a legal framework ensuring a convergence of national practices and allowing a better monitoring and enforcement of rules at EU and national levels. In addition, the Proposal seeks to approximate minimum standards ensuring an efficient and effective functioning of the Single Points of Contacts (“SPOCs”). These common minimum requirements cover the composition, structures, responsibilities, staffing and technical capabilities.

text: 4. The Proposal, and more generally the EU Police Cooperation Code, is linked to the policy goals of several EU strategic documents in the area of Justice and Home Affairs, in particular the EU 4

text: 5. The Commission consulted the EDPS on the Proposal for a Directive on information exchange between law enforcement authorities on 7 January 2022, pursuant to

text: . The comments and recommendations in this Opinion are limited to the provisions in the Proposal that are most relevant from a data protection perspective.

text: 2. General Comments

text: 6. Terrorism and serious crime pose a significant threat within the European Union and globally and their detection, prevention and prosecution undoubtedly represents an important objective of the general interest, which may justify limitations on the exercise of the fundamental rights and freedoms of the individual, in accordance with Article 52(1) of the EU Charter of Fundamental Rights.

text: 7. The EDPS understands the need for the law enforcement authorities to benefit from the best possible legal and technical tools to accomplish their tasks, which are to detect, investigate and prevent crimes and other threats to public security. In this regard,

text: Article 87

text: TFEU recognises police cooperation, including exchange of relevant information between the law enforcement authorities, as an important instrument for the establishment of an area of freedom, security and justice.

text: 8. The aim of the current Opinion is to provide a fair and objective assessment of the necessity and proportionality of the proposed measures, accompanied by a number of specific recommendations for ensuring the right balance between the values and interests at stake. To this end, a particular scrutiny is given to the interplay of the Proposal with the provisions of the EU legal framework for data protection, the scope of the Proposal and the envisaged role of Europol.

text: 3. Specific Comments

text: 3.1. Relationship with the existing legal framework on data protection

text: 9. The EDPS welcomes the commitment in Recital 16 of the Proposal that the protection of personal data, in accordance with Union law, should be ensured in connection to all exchanges of information under the proposed Directive. Moreover, the second sentence of the same Recital explicitly provides for that the rules of the Directive should be aligned with

text: Directive (EU) 2016/680

text: (the “Law Enforcement Directive”, the “LED”) .

text: 10. Given that

text: Directive (EU) 2016/680

text: would apply to the processing envisaged in the Proposal, the EDPS considers that where additional safeguards would be required (e.g. due to the nature of the proposed processing), such safeguards should be included in the Proposal, in order to complement the general provisions of the LED.

text: 11. The EDPS recalls that the legislative framework today is different than when the Council Framework Decision 2006/960/JHA of 18 December 2006 had been adopted, in that a horizontal 5 data protection regime in the field of justice and home affairs did not exist at Union level. The Council Framework Decision 2008/977/JHA , the so-called Framework Decision on data protection in the Third Pillar of the EU, was enacted two years later.

text: 12. The EDPS also notes that Recital 16, last sentence, states that the provisions of the Proposal leave rules of the LED and

text: Regulation (EU) 2016/679

text: (the GDPR) unaffected. However, it remains unclear what the reference to the GDPR is aiming at. According to

text: Article 2(1)

text: (d) of the GDPR, the GDPR does not apply to processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties.

text: 13. Furthermore,

text: Article 2(6)

text: the Proposal refers to

text: Article 4

text: , point (1) of

text: Regulation (EU) 2016/679

text: for the definition of “personal data”. The EDPS recalls that the LED contains an identical definition in its

text: Article 3(1)

text: , which applies automatically to any processing under the Proposal.

text: 14. Therefore, in the interest of legal certainty and clarity, EDPS recommends explaining more clearly in the preamble the relationship of the Proposal with the existing legal framework on data protection, and refraining from making references to the GDPR, as it does not appear to be relevant in the context of the personal data processing envisaged by the Proposal.

text: 3.2. Scope of the personal data exchange

text: Article 10

text: (i) of the Proposal would limit personal data shared between Member States to the categories under Section B, point 2, of Annex II to

text: Regulation (EU) 2016/794

text: (Europol Regulation) . The catalogue applies to persons who, pursuant to the national law of the Member State concerned, are (a) suspected of having committed or having taken part in a criminal offence in respect of which Europol is competent, or who have been convicted of such an offence, or (b) persons regarding whom there are factual indications or reasonable grounds under the national law of the Member State concerned to believe they will commit criminal offences in respect of which Europol is competent.

text: 16. The EDPS has consistently expressed his support for measures aimed at harmonisation and alignment of the legal rules applicable to the processioning of operational personal data, especially in the context of Europol . Therefore, he welcomes the approach chosen by the Commission to define in an exhaustive manner the categories of data that may be exchanged between law enforcement authorities (including via SPOCs).

text: 17. The use of a closed list of data categories would provide additional legal certainty and corresponds to the principle of data minimisation, laid down in

text: Article 4(1)

text: (c) of the LED. Moreover, it should be considered in conjunction with the general requirement in

text: Article 4(2)

text: (a) of the Proposal, according to which the requested information has to be “necessary and proportionate” to achieve the purpose referred to in Article 1(1) of the Proposal, namely preventing, detecting or investigating criminal offences. In addition, the EDPS believes that the choice of a legislative technique, i.e. by reference to the existing list of data categories in Annex II to Europol Regulation, could help ensuring the compliance of Europol with the applicable rules on personal data processing in cases when the Agency is copied in a bilateral exchange of information.

text: 18. At the same time, the EDPS notes a substantive difference between the Proposal and the Europol Regulation in relation to the material and personal scope of the processed data. In particular, 6 Annex II, Section B of the Europol Regulation lays down several lists of permitted data categories, each of them differentiated and closely linked to a certain category of data subjects. As a result, the scope and the amount of personal data about convicted or suspected criminals, which could be stored and processed, are much larger than the scope and amount of data about victims or witnesses. In the view of the EDPS, the approach in Annex II.B. of the Europol Regulation could be seen as a practical expression of the obligation under Article 6 of the LED “to make a clear distinction between personal data of different categories of data subjects”.

text: 19. The EDPS regrets that the Proposal does not provide for such a distinction. Given the fact that the personal scope of the information exchanges pursuant to the Proposal would not be limited only to convicted or suspected criminals, the law enforcement authorities may request and submit personal data also of other parties in a criminal investigation, such as witnesses and victims. Consequently,

text: Article 10

text: (i) of the Proposal might be interpreted as allowing exchange of very extensive categories of data (which in the context of Europol is allowed only in relation to criminals and suspects), also about witnesses and victims. The EDPS considers that this outcome would be disproportionate and not consistent with the data protection principles.

text: 20. Therefore, the EDPS considers that the Proposal should clearly define the personal scope of the information exchange, and in any event should limit the categories of personal about witnesses and victims that could be exchanged pursuant to the Proposal, in line with Article 6 of the LED, and similarly to the approach taken by Annex II of the Europol Regulation.

text: 3.3. Storage of the exchanged data

text: 21. One of the objectives of the Proposal, according to the Explanatory Memorandum, is to remedy the lack of common practice in the use of existing communication channels by law enforcement. The Proposal seeks inter alia to reduce fragmentation by requiring Member States to bundle a number of existing police contact points in a joint structure - a Single Point of Contact (“SPOC”). To this end, pursuant to

text: Article 14(3)

text: (a) of the Proposal, the SPOC should have access to all information available to the national law enforcement authorities, insofar as necessary to carry out its tasks under the Directive.

text: 22. Furthermore, pursuant to Article 16 of the Proposal, Member States should ensure that their SPOC deploys and operates an electronic single Case Management System (CMS). The case management system would serve as a repository and would record incoming and outgoing requests, provisions of information, and also the internal communications between the SPOC and national law enforcement authorities.

text: 23. The EDPS notes that the CMS would store not only the metadata related to the information exchange, but also content data. As a result, personal data of various kind from different law enforcement authorities could be stored in the CMS of the national SPOCs. The main purposes for the storing of the data, according to

text: Article 16(1)

text: (d) and (e) of the Proposal, would be crosschecking incoming requests against already available information and ensuring adequate and rapid follow-up to incoming requests.

text: 24. The EDPS considers that several aspects related to the processing of data in the CMS, and in particular storing of content data including personal data, need further clarification. In particular, the text of

text: Article 16(3)

text: “... any personal data processed by their Single Point of Contact are contained in the Case Management System only for as long as is necessary and proportionate for the purposes for which the personal data are processed and are subsequently irrevocably deleted.” could imply that the storage would be only temporary, with aim to facilitate the 7 exchange of information. At the same time, the term “for as long as necessary and proportionate for the purposes for which the personal data are processed” is not specific enough to meaningfully limit the applicable storage periods. The EDPS believes that the role of the CMS repository should be more explicitly spelled out in the Proposal to avoid the duplication of the same data in parallel databases, or at least to limit it to the strict minimum.

text: 25. In this regard, the EDPS draws attention to the risk of possible desynchronization in case of prolonged storage of content data in the CMS. For instance, where the SPOC is copied into original messages marking a person as a suspect, but Member States do not copy their SPOC into a later correction, an incorrect classification of the person may be propagated through the law enforcement system. In addition, the Proposal does not stipulate what should be the consequences of the cross-checking against the available information, for example whether the SPOC should provide immediately and on its own initiative the information to the requesting Member State.

text: 26. Consequently, the EDPS considers that, in line with the principle of storage limitation, the Proposal should be amended to explicitly lay down that the personal data may only be stored in the CMS for a very short period of time which should generally correspond to the time limits for provision of information stipulated in Article 5 of the Proposal.

text: 3.4. The role of Europol

text: 27. Article 12 of the Proposal would oblige Member States to send copies of the requests for information, the information provided in response to a request, or the information provided on their own initiative, to Europol, if such information concerns offences falling within the scope of the objectives of the Agency in accordance with the Europol Regulation.

text: 28. The EDPS notes that Recital 18, the last sentence, goes even further and suggests that “[i]n practice, this can be done through the ticking by default of the corresponding SIENA box”. In this context, the EDPS recalls that pursuant to

text: Article 7(6)

text: (a) of the Europol Regulation, Member States should “supply Europol with the information necessary for it to fulfil its objectives, including information relating to forms of crime the prevention or combating of which is considered a priority by the Union”. Moreover, in accordance with Article 19 of the Europol Regulation, the Member States have the legal possibility and at the same time the obligation to determine the purpose of, and restrictions on, the processing of the information by Europol.

text: 29. The EDPS is concerned that, in practice, the SPOCs and the law enforcement authorities may encounter difficulties in making the assessment in individual cases whether they should send a copy of the information to Europol and under what conditions, and that this assessment would be prone to errors. This, in turn, might result in Europol receiving more information than it is entitled to process pursuant to the Europol Regulation.

text: 30. In addition, Article 13 of the Proposal would impose the use of the Europol SIENA network for all exchanges pursuant to the Proposal. Through this article, Europol SIENA would become the mandatory channel of communication by default for police cooperation between EU Member States (excluding those situations where other channels are required by EU law, e.g. in the context of the Schengen Information System).

text: 31. The EDPS notes that established ways of communication can enhance data security and also strengthen and facilitate supervision. Given that SIENA is, according to the Commission, currently not consistently used as a preferred channel, transforming SIENA into a mandatory 8 channel for law enforcement exchanges seems appropriate to provide the aforementioned benefits from a data protection view and address fragmentation.

text: 32. In view of the above, the EDPS considers that the Proposal should be amended to explicitly require Member States to assess on a case-by-case basis whether to send a copy of the exchanged information to Europol, and for which purpose. The Proposal should also explicitly provide for that this purpose, together with any possible restrictions pursuant to Article 19 of the Europol Regulation, is communicated to the Agency, so that Europol would be aware how it could further handle the personal data. Otherwise the Directive might result in creating a vast database of back-copies of exchanged information to be managed by Europol, acting as a controller, for the new purposes set by the Agency. The EDPS also recommends to delete the last sentence of Recital 18.

text: 4. Conclusions

text: 33. In light of the above, the EDPS makes the following main recommendations: - The relationship with the existing legal framework on data protection should be more clearly explained in the Recitals. In addition, the Proposal should refrain from references to the GDPR, as it does not appear to be relevant in the context of the personal data processing envisaged by the Proposal. - The Proposal should clearly define the personal scope of the envisaged information exchanges and limit the categories of personal data that could be exchanged about witnesses and victims, in line with Article 6 of the LED and similarly to the approach taken by Annex II of the Europol Regulation (EU). - The EDPS considers that, in line with the principle of storage limitation, the Proposal should explicitly lay down that the personal data may only be stored in the CMS of the SPOC for a very short period of time, which should generally correspond to the time limits for provision of information stipulated in Article 5 of the Proposal. - The EDPS considers that the Proposal should explicitly require the Member States to assess on a case-by-case basis whether to send a copy of the exchanged information to Europol, and for what purpose. The Proposal should also explicitly provide for that this purpose, together with the possible restrictions pursuant to Article 19 of the Europol Regulation, are communicated to Europol. The EDPS also recommends to delete the last sentence of Recital 18. Brussels, 7 March 2022 [e-signed] Wojciech Rafał WIEWIÓROWSKI 9

text: Notes

type: vagledning

utgivare: edps