text: OJ L 119, 4.5.2016, p. 1. OJ L 295, 21.11.2018, p. 39. OJ L 119, 4.5.2016, p. 89. COM(2020) 607 final, https://ec.europa.eu/home-affairs/sites/homeaffairs/files/what-we-do/policies/europeanagenda-security/20200724_com-2020-607-commission-communication_en.pdf Directive

text: of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) OJ L 201, 31.7.2002, p. 37–47

text: Directive (EU) 2018/1972

text: of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (Recast), OJ L 321, 17.12.2018, p. 36 COM(2020) 607 final, p. 4. The Communication notes that because the ePrivacy Directive does not contain a legal basis for voluntary processing of content and traffic data for the purpose of detecting child sexual abuse, providers can only apply such measures if based on a national legislative measure, that meets the requirements of Article 15 of the ePrivacy Directive for restricting the right to confidentiality. In the absence of such legislative measures, measures to detect child sexual abuse undertaken by these providers, which process content or traffic data, would lack a legal basis. COM(2020) 568 final, 2020/0259 (COD), Proposal for a Regulation of the European Parliament and of the Council on a temporary derogation from certain provisions of Directive

text: of the European Parliament and of the Council as regards the use of technologies by numberindependent interpersonal communications service providers for the processing of personal and other data for the purpose of combatting child sexual abuse online, https://ec.europa.eu/digital-single-market/en/news/interim-regulation-processing-personal-and-other-datapurpose-combatting-child-sexual-abuse

text: Article 2 (5)

text: EECC defines an ‘interpersonal communications service’ as “a service normally provided for remuneration that enables direct interpersonal and interactive exchange of information via electronic communications networks between a finite number of persons, whereby the persons initiating or participating in the communication determine its recipient(s) and does not include services which enable interpersonal and interactive communication merely as a minor ancillary feature that is intrinsically linked to another service”. A ‘number-independent interpersonal communications service’ means an interpersonal communications service which does not connect with publicly assigned numbering resources, namely, a number or numbers in national or international numbering plans, or which does not enable communication with a number or numbers in national or international numbering plans (

text: Article 2(7)

text: ECC). Directive

text: of the European Parliament and of the Council of 13 December 2011 on combating the sexual abuse and sexual exploitation of children and child pornography, and replacing Council Framework Decision 2004/68/JHA, OJ L 335, 17.12.2011, p. 1. The term ‘without right’ allows Member States to provide a defence in respect of conduct relating to pornographic material having for example, a medical, scientific or similar purpose. It also allows activities carried out under domestic legal powers, such as the legitimate possession of child pornography by the authorities in order to conduct criminal proceedings or to prevent, detect or investigate crime. Furthermore, it does not exclude legal defences or similar relevant principles that relieve a person of responsibility under specific circumstances, for example where telephone or Internet hotlines carry out activities to report those cases. Recital (25) of Directive

text: . Article

text: and

text: of Directive 2011/93/EU. Articles

text: and

text: of Directive 2011/93/EU.

text: Article 25(2) of Directive 2011/93/EU

text: . Opinion of the European Data Protection Supervisor on the proposal for a Directive of the European Parliament and of the Council on combating the sexual abuse, sexual exploitation of children and child pornography, repealing Framework Decision 2004/68/JHA, 10 May 2010, https://edps.europa.eu/sites/edp/files/publication/10- 05-10_child_abuse_en.pdf. Court of Justice of the European Union, La Quadrature du Net a.o, Joined Cases

text: and C- 520/18, 6 October 2020, ECLI:EU:C:2020:791, atparagraph 121. Recital (15) of

text: Directive (EU) 2018/1972

text: of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (Recast), O.J. 17.12.2018, L 321/36. EDPS, Opinion of the European Data Protection Supervisor on the proposal for a Directive of the European Parliament and of the Council on combating the sexual abuse, sexual exploitation of children and child pornography, repealing Framework Decision 2004/68/JHA, paragraph 5.

text: Court of Justice of the European Union, La Quadrature du Net a.o, Joined Cases

text: and C- 520/18, 6 October 2020, ECLI:EU:C:2020:791, at paragraph 128 . Judgment of the Court of Justice of the European Union, La Quadrature du Net a.o, Joined Cases

text: and

text: , 6 October 2020, ECLI:EU:C:2020:791, at paragraph 126. Opinion of the European Data Protection Supervisor on the proposal for a Directive of the European Parliament and of the Council on combating the sexual abuse, sexual exploitation of children and child pornography, repealing Framework Decision 2004/68/JHA, 10 May 2010, available at https://edps.europa.eu/sites/edp/files/publication/10-05-10_child_abuse_en.pdf, paragraph 7. Judgment of the Court of Justice of the European Union, La Quadrature du Net a.o, Joined Cases

text: and

text: , 6 October 2020, ECLI:EU:C:2020:791, at paragraph 132. Idem. Idem.

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1–88 Explanatory Memorandum of the Proposed Interim Regulation, p. 2.

text: Article 29

text: Data Protection Working Party, ‘Opinion 06/2014 on the notion of legitimate interests of the data controller under

text: Article 7 of Directive 95/46/EC

text: WP 217

text: , 9 April 2014, p. 29. Judgment of the Court of Justice of the European Union in Fashion ID, 29 July 2019,

text: , ECLI:EU:C:2019:629, at paragrap 95. See also: the European Data Protection Supervisor, Necessity toolkit on assessing the necessity of measures that limit the fundamental right to the protection of personal data, 11 April 2017, p.9 The first step pf the checklist for assessing necessity of new legislative measure requires “a detailed factual description of the measure

text: proposed and its purpose, prior to any further assessment.”

text: European Data Protection Supervisor Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data, 19 December 2019, p. 23 available at https://edps.europa.eu/sites/edp/files/publication/19-12-19_edps_proportionality_guidelines2_en.pdf European Data Protection Supervisor Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data, 19 December 2019, p.20 available at https://edps.europa.eu/sites/edp/files/publication/19-12-19_edps_proportionality_guidelines2_en.pdf While

text: Article 3

text: the Proposal limits the proposed measures to “...well-established technologies regularly used by providers of number-independent interpersonal communications services for that purpose before the entry into force of this Regulation...”, the Proposal does not further describe what those “well established technologies” are, which could create legal certainty to the identification of the allowed measures. Recital (11) of the Proposal specifies that « The reference to the technology includes where necessary any human review directly relating to the use of the technology and overseeing it.” This does not clarify in which circumstances human review will be present, only that it is not always present. Compare for example with

text: Article 7

text: (Preservation of content and related data) of the Proposal for a Regulation of the European Parliament and of the Council on preventing the dissemination of terrorist content online, Brussels, 12.9.2018, COM(2018) 640 final. While the Proposal indicates that in relation to data reliably identified as child pornography, data may only be kept for the creation of a unique, non-reconvertible digital signature (‘hash’), it does not explicitly state which entities would be authorised to retain a copy of the orginal data identified as child pornography, nor at which moment in time the provider would be required to delete erase the data reliably identifed as child pornography. Opinion of the European Data Protection Supervisor on the proposal for a Directive of the European Parliament and of the Council on combating the sexual abuse, sexual exploitation of children and child pornography, repealing Framework Decision 2004/68/JHA, 10 May 2010, paragraph 12, available at https://edps.europa.eu/sites/edp/files/publication/10-05-10_child_abuse_en.pdf Opinion of the European Data Protection Supervisor on the proposal for a Directive of the European Parliament and of the Council on combating the sexual abuse, sexual exploitation of children and child pornography, repealing Framework Decision 2004/68/JHA, paragraph 13. Opinion of the European Data Protection Supervisor on the proposal for a Directive of the European Parliament and of the Council on combating the sexual abuse, sexual exploitation of children and child pornography, repealing Framework Decision 2004/68/JHA, paragraph 15. Proposal for a Regulation of the European Parliament and of the Council on preventing the dissemination of terrorist content online, Brussels, 12.9.2018, COM(2018) 640 final. See

text: Article 29

text: Data Protection Working Party, Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679,

text: WP 248

text: rev.01, 4 October 2017 Processing that received a positive advice from a DPA upon consultation.

text: Ibid, p. 14. Council of the European Union Proposal for a Regulation of the European Parliament and of the Council on a temporary derogation from certain provisions of Directive

text: of the European Parliament and of the Council as regards the use of technologies by number-independent interpersonal communications service providers for the processing of personal and other data for the purpose of combatting child sexual abuse online Mandate for negotiations with the European Parliament, 23 October 2020, 2020/0259(COD) Ibid, p. 18-19.

identifier: EDPS yttrande 07/2020

publisher: Europeiska datatillsynsmannen

sprak: en

title: Opinion on the proposal for temporary derogations from Directive 2002/58/EC for the purpose of combatting child sexual abuse online

serie: yttranden

type: stycke

text: Opinion 7/2020

type: rubrik

text: on the Proposal for temporary derogations from Directive

text: for the purpose of combatting child sexual abuse online

text: 10 November 2020 1 | P a g e

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Wiewiorówski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: Under

text: Article 42(1) of Regulation (EU) 2018/1725

text: , the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’ and under

text: Article 57(1)

text: (g), the EDPS shall ‘advise on his or her own initiative or on request, all Union institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion is issued by the EDPS, within the period of eight weeks from the receipt of the request for consultation laid down under

text: Article 42(3) of Regulation (EU) 2018/1725

text: , having regard to the impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data of the Commission Proposal for a Regulation of the European Parliament and of the Council on a temporary derogation from certain provisions of Directive

text: of the European Parliament and of the Council as regards the use of technologies by number-independent interpersonal communications service providers for the processing of personal and other data for the purpose of combatting child sexual abuse online.

text: 2 | P a g e

text: Executive Summary

text: On 10 September 2020, the Commission published a Proposal for a Regulation on a temporary derogation from certain provisions of the ePrivacy Directive

text: as regards the use of technologies by number-independent interpersonal communications service providers for the processing of personal and other data for the purpose of combatting child sexual abuse online. The derogation concerns Articles 5(1) and 6 of the ePrivacy Directive in relation to the processing of personal data in connection with the provision of ‘number-independent interpersonal communications services’ necessary for the use of technology for the sole purpose of removing child sexual abuse material and detecting or reporting child sexual abuse online to authorities.

text: In this Opinion the EDPS provides his recommendations related to the Proposal in response to a formal consultation by the Commission pursuant to

text: Article 42 of Regulation (EU) 2018/1725

text: In particular, he notes that the measures envisaged by the Proposal would constitute an interference with the fundamental rights to respect for private life and data protection of all users of very popular electronic communications services, such as instant messaging platforms and applications. Confidentiality of communications is a cornerstone of the fundamental rights to respect for private and family life. Even voluntary measures by private companies constitute an interference with these rights when the measures involve the monitoring and analysis of the content of communications and processing of personal data.

text: The EDPS wishes to underline that the issues at stake are not specific to the fight against child abuse but to any initiative aiming at collaboration of the private sector for law enforcement purposes. If adopted, the Proposal, will inevitably serve as a precedent for future legislation in this field. The EDPS therefore considers it essential that the Proposal is not adopted, even in the form a temporary derogation, until all the necessary safeguards set out in this Opinion are integrated.

text: In particular, in the interest of legal certainty, the EDPS considers that it is necessary to clarify whether the Proposal itself is intended to provide a legal basis for the processing within the meaning of the GDPR, or not. If not, the EDPS recommends clarifying explicitly in the Proposal which legal basis under the GDPR would be applicable in this particular case. In this regard, the EDPS stresses that guidance by data protection authorities cannot substitute compliance with the requirement of legality. It is insufficient to provide that the temporary derogation is “without prejudice” to the GDPR and to mandate prior consultation of data protection authorities. The co-legislature must take its responsibility and ensure that the proposed derogation complies with the requirements of

text: Article 15(1)

text: , as interpreted by the CJEU.

text: In order to satisfy the requirement of proportionality, the legislation must lay down clear and

text: precise rules governing the scope and application of the measures in question and imposing minimum safeguards, so that the persons whose personal data is affected have

text: sufficient guarantees that data will be effectively protected against the risk of abuse.

text: 3 | P a g e

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular

text: Article 16

text: thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles

text: and

text: thereof, Having regard to

text: Regulation (EU) 2016/679

text: (General Data Protection Regulation) , Having regard to

text: Regulation (EC) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular Articles

text: (g) and 58(3)(c) thereof, Having regard to

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA ,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION

text: 1.1 Background

text: 1. On 24 July 2020, the Commission adopted a Communication EU strategy for a more effective fight against child sexual abuse. The Communication notes that as from December 2020, Directive

text: (‘the e-Privacy Directive’) will have an extended scope as a result of the already adopted Electronic Communications Code (‘ECC’) . The ECC extends the scope of the e-Privacy Directive to over the top (OTT) inter-personal communication services such as messaging services and email. According to the Communication, this would prevent certain companies (in the absence of national legislative measures adopted in accordance with Article 15(1) of the e-Privacy Directive) from continuing their own voluntary measures for detection, removal and reporting of child sexual abuse online.

text: 2. On 10 September 2020, the Commission published a Proposal for an Interim Regulation on the processing of personal and other data for the purpose of combatting child sexual abuse, which provides for a temporary derogation from

text: Article 5(1)

text: and Article 6 of the ePrivacy Directive (‘the Proposal’). The Commission considers that such a derogation is 5 | P a g e necessary in order to allow current voluntary activities to continue after December 2020. The derogation would concern the processing of personal data in connection with the provision of ‘number-independent interpersonal communications services’ (e.g., voice over IP, messaging and web-based e-mail services) strictly necessary for the use of technology for the sole purpose of removing child sexual abuse material and detecting or reporting child sexual abuse online to law enforcement authorities and to organisations acting in the public interest against child sexual abuse. The Proposal enumerates a number of conditions for the derogation to be applicable, which will be analysed later in this Opinion.

text: 3. The EDPS was formally consulted by the Commission on 16 September 2020. On 30 September, the Commission launched a public consultation inviting feedback in relation to its Proposal. 1.2 Relationship to Directive

text: 4. The EU has previously adopted a comprehensive legal instrument to combat the sexual abuse and sexual exploitation of children and child pornography, namely Directive

text: (‘Child Sexual Abuse Directive’).

text: 5. The Child Sexual Abuse Directive establishes minimum rules concerning the definition of criminal offences and sanctions in the area of sexual abuse and sexual exploitation of children and child sexual abuse material. It requires Member States to ensure that inter alia the following intentional conduct, when committed without right , shall be punishable: - intentionally and knowingly obtaining access, by means of information and communication technology, to child pornography; - distribution, dissemination or transmission of child pornography - offering, supplying or making available child pornography.

text: 6. The Child Sexual Abuse Directive also obliges Member States to take the necessary measures to ensure that certain conduct amounting to solicitation of children for sexual purposes, including by means of information and communication technology, shall be punishable.

text: 7. The Child Sexual Abuse Directive requires Member States to take the necessary measures to ensure the prompt removal of web pages containing or disseminating child pornography hosted in their territory and to endeavour to obtain the removal of such pages hosted outside of their territory as well as to seize and confiscate instrumentalities and proceeds from such offences. In addition, Member States may take measures to block access to web pages containing or disseminating child pornography towards the Internet users within their territory.

text: 8. In 2010, the EDPS issued an own-initiative Opinion on the proposal for a Directive on combating the sexual abuse, sexual exploitation of children and child pornography. This Opinion contains considerations and recommendations that are also relevant to the Proposal for an Interim Regulation. Where appropriate, the EDPS shall reiterate and/or make reference to his 2010 Opinion. 6 | P a g e

text: 2. MAIN RECOMMENDATIONS

text: 9. Confidentiality of communications is a cornerstone of the fundamental rights to respect for private and family life and protection of personal data. Even voluntary measures by private companies constitute an interference with these rights when the measures involve the monitoring and analysis of the content of communications and processing of personal data. The measures envisaged by the Proposal will interfere with the rights to respect for private life and data protection of the individuals concerned (users, perceived perpetrators and victims).

text: 10. Interference with confidentiality of communications is possible, but only under certain conditions. Limitations may be made only if they are provided for by law, respect the essence of the rights to data protection and privacy and, in compliance with the principle of proportionality, are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others (Article 52(1) of the Charter).

text: 11. The Commission maintains that the Proposal merely seeks to allow the continuation of certain existing voluntary practices, rather than create a new interference with fundamental rights. However, the temporary derogation is proposed precisely because of the extended scope of the ePrivacy Directive resulting from the entry into force of the EECC in December 2020. The EDPS wishes to underline that it was the choice of the European legislator to expand the notion of “electronic communications service” to include functionally equivalent online services in order to ensure that end-users and their rights are effectively and equally protected when using those services. Limitations upon the confidentiality of communications cannot be justified merely on the grounds that certain measures were previously deployed when the services concerned did not, from a legal perspective, amount to electronic communications services. The services in question will from 21 December 2020 qualify as electronic communication services, with the attendant legal protection of confidentiality. The proposed derogation must therefore be assessed in accordance with the requirements of Article 52 of the Charter.

text: 12. The EDPS wishes to underline that the issues at stake are not specific to the fight against child abuse but to any initiative aiming at collaboration of the private sector for law enforcement purposes. Child abuse is a particularly abhorrent crime and the objective of enabling effective action to combating child sexual abuse online clearly amounts to both an objective of general interest recognised by the Union and seeks to protect the rights and freedoms of others. As regards effective action to combat criminal offences committed against minors and other vulnerable persons, the CJEU has pointed out that positive obligations may result from Article 7 of the Charter, requiring public authorities to adopt legal measures to protect private and family life. Such obligations may also arise from

text: Article 7

text: , concerning the protection of an individual’s home and communications, and Articles

text: and

text: , as regards the protection of an individual’s physical and mental integrity and the prohibition of torture and inhuman and degrading treatment.

text: 13. The EDPS already previously questioned purely voluntary mechanisms to combat the dissemination of child abuse material, given the nature of the interference and the need for legal certainty for all actors involved. Indeed, there is a need to ensure harmonised, clear 7 | P a g e and detailed procedures when fighting illegal content, under the supervision of independent public authorities.

text: 14. Even if the Proposal does not oblige private parties to interfere with the confidentiality of communications, it nevertheless provides for a restriction of the confidentiality of communications. Given the nature of the interference at hand, the EDPS considers that the measures to detect, remove and report child sexual abuse online must be accompanied by a comprehensive legal framework which meets the requirements of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. In order to satisfy the requirement of proportionality, the legislation must lay down clear and precise rules governing the scope and application of the measures in question and imposing minimum safeguards, so that the persons whose personal data is affected have sufficient guarantees that data will be effectively protected against the risk of abuse. That legislation must be legally binding and, in particular, must indicate in what circumstances and under which conditions a measure providing for the processing of such data may be adopted, thereby ensuring that the interference is limited to what is strictly necessary. As clarified by the CJEU, the need for such safeguards is all the greater where personal data is subjected to automated processing and where the protection of the particular category of personal data that is sensitive data is at stake.

text: 15. The introduction of appropriate safeguards in the Proposal itself is all the more necessary as it concerns a Regulation rather than a Directive. The choice for a legal instrument that is directly applicable in all Member States entails the responsibility of EU legislator for ensuring that the appropriate safeguards are introduced already at EU level.

text: 3. SPECIFIC RECOMMENDATIONS

text: 3.1. Legal basis

text: 16. Recital (10) of the Proposal indicates that the

text: Regulation (EU) 2016/679

text: (‘GDPR’) remains applicable to the processing of personal data falling within the scope of the derogation. In accordance with

text: Article 6

text: GDPR, the processing of personal data shall be lawful only on the basis of one of six specified grounds set out in

text: Article 6(1)

text: (a) to (f).

text: 17. The Proposal does not clearly indicate whether or not it seeks to provide a legal basis within the meaning of

text: article 6

text: GDPR. The Explanatory Memorandum merely notes that the ePrivacy Directive “does not contain an explicit legal basis” for voluntary processing of content or traffic data for the purpose of detecting child sexual abuse online. It also notes that, in the absence of legislative measures providing for a derogation, providers of numberindependent interpersonal communications services “would lack a legal basis” for continuing to detect child sexual abuse on their services.

text: 18. For the sake of legal certainty, the EDPS considers that it is necessary to clarify whether the Proposal itself is intended to provide a legal basis for the processing within the meaning of the GDPR, or not. If not, the EDPS recommends clarifying explicitly in the Proposal which legal basis of the GDPR would be applicable in this particular case. 8 | P a g e

text: 19. In this regard, the EDPS notes that the derogation provided by the Proposal concerns the voluntary processing of content or traffic data for the purpose of detecting child sexual abuse online. In other words, it would not oblige providers of number-independent interpersonal communications services to carry out any processing. As a result, the legal basis for the processing cannot be found in

text: Article 6(1)

text: c GDPR (processing necessary for compliance with a legal obligation to which the controller is subject).

text: 20. In its 2014 Opinion on the notion of legitimate interests of the data controller, the

text: Article 29

text: Working Party considered that the legitimate interests pursued by the controller “may include situations where a controller goes beyond its specific legal obligations set in laws and regulations to assist law enforcement or private stakeholders in their efforts to combat illegal activities, such as child grooming. In these situations, however, it is particularly important to ensure that the limits of

text: Article 7

text: (f) are fully respected”.

text: 21. The EDPS observes that the aforementioned statement does not entail that any processing carried out to combat illegal activities may automatically be considered as lawful under

text: Article 6(1)

text: f GDPR. First, the processing in question must satisfy three cumulative conditions, namely (i) the pursuit of a legitimate interest by the data controller or by the third party or parties to whom the data are disclosed, (ii) the need to process personal data for the purposes of the legitimate interests pursued, and (iii) the condition that the fundamental rights and freedoms of the data subject whose data require protection do not take precedence. Second, the statement by the

text: Article 29

text: Working Party was made in general terms, without any suggestion that controllers might be allowed to rely on the lawful basis of legitimate interest in cases which interfere with the confidentiality of communications. 3.2. Necessity and proportionality

text: 22. Due to the absence of an impact assessment accompanying the Proposal, the Commission has yet to demonstrate that the measures envisaged by the Proposal are strictly necessary, effective and proportionate for achieving their intended objective. The EDPS in first instance calls upon the Commission to provide additional information to enable the colegislator to consider whether the envisaged measures in fact satisfy the requirements of necessity, effectiveness and proportionality.

text: 23. In order to be able to assess the impact of a measure on the fundamental rights to privacy and to the protection of personal data, it is particularly important to precisely identify :  the scope of the measure, including the number of people affected and whether it raises ‘collateral intrusions’ (i.e. interference with the privacy of persons other than the subjects of the measure);  the extent of the measure, including amount of information collected; for how long; whether the measure under scrutiny requires the collection and processing of special categories of data;  the level of intrusiveness, taking into account: the nature of the activity subjected to the measure (whether it affects activities covered by duty of confidentiality or not, lawyer-client relationship; medical activity); the context; whether it amounts to 9 | P a g e profiling of the individuals concerned or not; whether the processing entails the use of (partially or fully) automated decision making system with a ‘margin of error’;  whether it concerns vulnerable persons or not;  whether it also affects other fundamental rights (for instance the right to protection of privacy and the right to freedom of expression, as in the Digital Rights and Tele2 cases). In this context, it is also important to note that the impact can be minor with regard to the individual concerned, but nonetheless significant or highly significant collectively/for society as a whole.

text: 24. The EDPS observes that different measures to combat child sexual abuse online may involve different levels of intrusiveness. As a preliminary matter, the EDPS observes that automated analysis of speech or text with a view of identifying potential instances of child solicitation is likely to constitute a more significant interference than the matching of images or video on the basis of previously confirmed instances of child pornography.

text: 25. Recital (11) of the Proposal stipulates that “[t]he types of technologies deployed should be the least privacy-intrusive in accordance with the state of the art in the industry and should not include systematic filtering and scanning of communications containing text but only look into specific communications in case of concrete elements of suspicion of child sexual abuse.” While the EDPS welcomes the underlying intention to delineate the scope of the interference, a number of observations need to be made. First, any delineation affecting the scope of the interference should be reflected clearly in the text of the Proposal itself and not only in a recital. Second, it should be made explicit whether communications containing data other than text (e.g. image or audio communications) would be allowed to be subject to systematic filtering and monitoring. Third, there needs to be clarity as to how “concrete elements of suspicion” will be established in practice, and in particular whether such a determination involves a competent authority or not.

text: 26. As regards technology to detect child solicitation,

text: Article 3

text: (c) of the Proposal states that the technology used must be “limited to the use of relevant key indicators, such as keywords and objectively identified risk factors such as age difference, without prejudice to the right to human review”. In this regard, the EDPS considers that the general, indiscriminate and automated analysis of all text-based communications transmitted through numberindependent interpersonal communications services with a view of identifying new potential infringements does not respect the principle of necessity and proportionality. Even if the technology used is limited to the use of “relevant key indicators”, the EDPS considers the deployment of such general and and indiscriminate analysis is excessive.

text: 27. As regards the “right to human review” mentioned in

text: Article 3

text: (c) of the Proposal, the EDPS urges the co-legislator to provide further clarity as when such a right would become applicable and which entity would be in charge of carrying out this review. This is particularly important in terms of ensuring appropriate redress mechanisms (see also section 6.5 [reporting to public authorities] and 6.6 [transparency and data subject rights]). Finally, the use of the term “right” suggests that human review would not be implemented by default. The EDPS urges the legislature to specify in which circumstances human review will be ensured and by whom. This is all the more necessary to clarify in which 10 | P a g e circumstance the use of the technology could amount to automated decision-making within the meaning of

text: Article 22

text: GDPR (in particular given the possible consequences of both reporting and user blocking envisaged by the Proposal). 3.3. Scope and extent of the derogation

text: 28. The Proposal extends to ‘number-independent interpersonal communications services’. Such services include a wide variety of services, such voice over IP, messaging and webbased e-mail services. Further clarity should be provided regarding the types of services that would affected by the derogation. For example, it should be unambiguously stated whether the derogation concerns measures to detect child sexual abuse materials consisting of video and images or also to text messages and voice calls. This is necessary to satisfy the requirement that the legislation must lay down clear and precise rules governing the scope and application of the measure.

text: 29. In the same vein, more clarity is needed as to the types of detection measures that would fall within the scope of the derogation. Article 3 of the Proposal sets out a number of conditions for the derogation to be applicable, yet does not offer a clear description of the types of the measures envisaged.

text: Article 3

text: (c) indicates that “key indicators, such as keywords and objectively identified risk factors such as age difference” would be used to detect solicitation of children, whereas

text: Article 3

text: (e) in fine implies that the detection of child pornography may involve the “use of a non-reconvertible digital signature (‘hash’)”. A clear understanding of the precise nature of the measures limiting the confidentiality of communications is necessary not only with a view to ensuring clarity and legal certainty, but also with a view to assessing whether the measures are indeed limited to that which is strictly necessary.

text: 30. Third, more clarity is need as to the extent of communications to which the “wellestablished technologies” would be applied. In particular, it should be clarified what exactly is to be understood as “well-established technologies” and whether those technologies would be applied to all communications exchanged by all users or to a subset of them. In the latter case, it would be necessary to clarify the criteria by which the technologies would be applied to a specific subset of communications.

text: 31. The EDPS questions whether the extent of the proposed derogation is strictly necessary to achieve the objectives set out by the Proposal. Specifically, the EDPS questions whether the derogation from the entirety of Article 6 of ePrivacy Directive is justified, given that

text: Article 6

text: mainly concerns processing activities that have no relationship with the processing envisaged by the Proposal. Moreover,

text: Article 6(1)

text: explicitly provides that it is without prejudice to Article 15(1) of the ePrivacy Directive. Finally,

text: Article 5(1)

text: also makes reference to the “related traffic data” which appears to be more directly linked to the underlying objectives of the Proposal. 3.4. Purpose limitation and storage limitation

text: 32. The Proposal stipulates as one of the conditions for the derogation that the processing shall be “limited to what is strictly necessary for the purpose of detection and reporting of child sexual abuse online and removal of child sexual abuse material and, unless child sexual abuse online has been detected and confirmed as such, is erased immediately”. The EDPS 11 | P a g e understands the obligation to erase the data refers to all “personal and other data” covered by the scope of the derogation. The EDPS urges the co-legislature to be more explicit in this respect, clarifying also the specific categories of data that may be retained.

text: 33. The Proposal also provides that where child sexual abuse online has been detected and confirmed as such, the “relevant data” may be retained solely for the following purposes and only for the time period necessary: (i) for its reporting and to respond to proportionate requests by law enforcement and other relevant public authorities; (ii) for the blocking of the concerned user’s account; and (iii) in relation to data reliably identified as child pornography, for the creation of a unique, non-reconvertible digital signature (‘hash’). Here too the EDPS would encourage the co-legislature to spell out, in the text of the Proposal which categories of data would amount to “relevant data” in relation to each of these purposes and which recipients in fact constitute “other relevant public authorities”.

text: 34. The EDPS questions whether the reporting of individuals and blocking of the concerned user’s account will be strictly necessary and proportionate in all instances, given also the absence of further information as to what amounts to a “detected and confirmed” case of child sexual abuse online. Would the unsolicited receipt of child sexual abuse material justify reporting and/or blocking? Does the confirmation process by definition entail human review? Who makes the confirmation and who determines whether the account holder is in fact culpable of the acts described in Article 2(2) of the Proposal? While the EDPS supports the objective of swiftly disabling the means used to commit child sexual abuse online, the legal framework should be sufficiently clear and precise as regards the circumstances in which the described measures may be taken.

text: 35. Finally, while the Proposal envisages that the “relevant data” should only be retained as necessary to achieve the enumerated purposes, there is no clarity as to how long data should be retained with a view of “responding to proportionate requests by law enforcement and other relevant public authorities”. The Proposal fails to provide a clear indication of any actual time period in this respect. The Proposal also fails to clearly set out which entities would be allowed to continue to process the relevant data in a manner which would continue to permit identification of the individuals concerned (perceived perpetrators and victims). 3.5. Reporting to relevant authorities

text: 36. When it comes to reporting, the EDPS has already previously indicated that there is a need for a precise description in the text of the legislation of who is enabled to collect and keep which information and under what specific safeguards. This is particularly important considering the consequences of reporting: in addition to the information related to children, personal data of any individual connected in some way with the information circulating on the network could be at stake, including for instance information on a person suspected of misbehaviour, be it an internet user or a content provider, but also information on a person reporting a suspicious content or the victim of the abuse.

text: 37. In this regard, the EDPS is particularly concerned that the Proposal does not explain the governance model of electronic service providers using this derogation. It is unclear how the electronic service providers will report or to whom. It is also not specified who will be 12 | P a g e in charge of maintaining and updating the relevant databases for identifying future instances of child sexual abuse online.

text: 38. In terms of quality and integrity requirements, additional safeguards should be implemented in order to guarantee that this information considered as digital evidence has been properly collected and preserved and would therefore be admissible before a court. Guarantees related to the supervision of the system and its use, in principle by law enforcement authorities, are decisive elements to comply with. Transparency and independent redress possibilities available to individuals are other essential elements to be integrated in such a scheme. 3.6. Transparency and data subject rights

text: 39. The Proposal does not contain any provision concerning transparency and the exercise of data subject rights. Insofar as the proposal is intended to be “without prejudice” to the GDPR, the duties of the provider to inform individuals and to accommodate data subject rights in principle remain unaffected. Nevertheless, the EDPS recommends the colegislature to introduce additional measures place to ensure transparency and exercise of data subject rights, subject, where strictly necessary, to narrowly defined restrictions (e.g., where necessary to protect the confidentiality of an ongoing investigation). Such restrictions must, in any case, comply with the requirements set out in

text: Article 23(1)

text: and (2) GDPR.

text: 40. As far as users are concerned, an example of possible measures to ensure transparency and complaint mechanisms can be found in the Proposal for a Regulation on preventing the dissemination of terrorist content online. In addition to general transparency obligations (

text: Article 8

text: ) and complaint mechanisms (

text: Article 9

text: ), it also provides for information to content providers (subject to derogation where competent authorities decide that for reasons of public security including in the context of an investigation, it is considered inappropriate or counter-productive to directly notify the content provider of the removal or disabling of content) (

text: Article 11

text: ). While further adaptation is likely to be necessary, these examples be useful to consider as the EU co-legislator seeks to incorporate additional safeguards into the text of the Regulation. 3.7. Keeping up with the state of the art

text: Article 3

text: (a) of the Proposal limits the scope of the derogation to “...well-established technologies regularly used by providers of number-independent interpersonal communications services for that purpose before the entry into force of this Regulation...”. The EDPS stresses that these “well established technologies” are not described in the Proposal. This lack of precise identification of the measures subject to the derogation is likely to undermine legal certainty.

text: 42. Limiting the measures to those regularly used before the future entry into force of the Proposal would prevent future developments towards less intrusive technical and organisational measures. Recital (11) of the Proposal states that the Regulation would not preclude “the further evolution of the technology in a privacy-friendly manner”, it is not supported by the text of the Proposal itself. 13 | P a g e

text: 43. The EDPS therefore recommends clarifying in the text of the Proposal that the reference to technologies regularly used before the future entry into force of the Proposal does not prevent deployment of technologies with a similar purpose which are less privacyintrusive, in accordance with the requirements of data minimisation and data protection by design and by default. 3.8. DPIA and prior consultation

text: 44. Recital (10) of the Proposal clarifies that the requirement to carry out, prior to the deployment of the technologies concerned, an assessment of the impact of the envisaged processing operations pursuant to

text: Article 35

text: GDPR (‘DPIA’) shall apply “where appropriate”.

text: 45. The EDPS notes in accordance with

text: Article 35(1)

text: GDPR, carrying out a DPIA shall be required when the processing is likely to result in a high risk to the rights and freedoms of natural persons, taking into account the nature, scope, context and purposes of the processing. Taking into account the relevant guidance, the processing envisaged by the Proposal is very likely to satisfy this threshold (as the processing is likely to be large scale in nature, involve processing sensitive data or data of highly personal nature, etc.).

text: 46. The EDPS recommends the introduction, also with a view of providing legal certainty, of an explicit requirement of carrying out a DPIA within the meaning of

text: Article 35

text: GDPR in relation to any processing that falls within the scope of the proposed derogation. While the carrying out of DPIA may not always be necessary in relation to processing operations which were already being carried out on 25 May 2018 , controllers are obliged to conduct such a DPIA, at the appropriate time, as part of its general accountability obligations. Adding an explicit requirement in this respect would provide additional clarity as well assurances that the processing will be carried out in compliance with the GDPR.

text: 47. As regards the requirement of prior consultation in accordance with

text: Article 36

text: GDPR, the EDPS notes the requirement proposed by the Council that the prior consultation procedure set out in

text: Article 36

text: GDPR shall apply to any technology which has not been used before the entry into force of the Proposal. The EDPS wishes to stress, however, that such an obligation continues to be applicable in any situation where a DPIA reveals high residual risks.

text: 48. Finally, the EDPS would like to emphasize that guidance provided by data protection authorities cannot substitute compliance with the requirement of legality. As the Proposal provides for a derogation upon the confidentiality of communications, it is insufficient to provide that the temporary derogation is “without prejudice” to the GDPR and to mandate prior consultation of data protection authorities and/or to call upon the EDPB to issue guidance. The co-legislature must take its responsibility and ensure that the proposed derogation complies with the requirements of

text: Article 15(1)

text: , as interpreted by the CJEU. 3.9. Duration of the temporary derogation

text: 49. Article 4 of the Proposal specifies that the Regulation shall apply from 21 December 2020 until 31 December 2025, i.e. for a period of five years. Recital (16) clarifies that the period 14 | P a g e of application of this Regulation was chosen as “a time period reasonably required for the adoption of a new long-term legal framework”. In case the announced long-term legislation were to be adopted and enter into force prior to this date, that legislation should repeal the present Regulation.

text: 50. The EDPS is of the view that a five-year period is too longdoes not seem proportional given the absence of (a) a prior demonstration of the proportionality of the envisaged measure and (b) the inclusion of sufficient safeguards within the text of the legislation. He recommends that the validity of any transitional measure should not exceed 2 years.

text: 51. If adopted, the Proposal, will inevitably serve as a precedent for future legislation tackling the dissemination of illegal content online, in particular in relation to confidential communications. The EDPS therefore considers it essential that the Regulation is not adopted, even in the form a temporary derogation, until the necessary safeguards and all the outstanding missing elements as identified in these specific recommendations are integrated.

text: 4. CONCLUSIONS

text: 52. The measures envisaged by the Proposal would constitute an interference with the fundamental rights to respect for private life and data protection of all users of very popular electronic communications services, such as instant messaging platforms and applications. Even voluntary measures by private companies constitute an interference with these rights when the measures involve the monitoring and analysis of the content of communications and processing of personal data.

text: 53. The issues at stake are not specific to the fight against child abuse but to any initiative aiming at collaboration of the private sector for law enforcement purposes. If adopted, the Proposal will inevitably serve as a precedent for future legislation in this field. The EDPS therefore considers it essential that the Proposal is not adopted, even in the form a temporary derogation, until all the necessary safeguards set out in this Opinion are integrated.

text: 54. In the interest of legal certainty, the EDPS considers that it is necessary to clarify whether the Proposal itself is intended to provide a legal basis for the processing within the meaning of the GDPR, or not. If not, the EDPS recommends clarifying explicitly in the Proposal which legal basis under the GDPR would be applicable in this particular case. In this regard, the EDPS stresses that guidance by data protection authorities cannot substitute compliance with the requirement of legality. It is insufficient to provide that the temporary derogation is “without prejudice” to the GDPR and to mandate prior consultation of data protection authorities. The co-legislature must take its responsibility and ensure that the proposed derogation complies with the requirements of

text: Article 15(1)

text: , as interpreted by the CJEU.

text: 55. In order to satisfy the requirement of proportionality, the legislation must lay down clear and precise rules governing the scope and application of the measures in question and 15 | P a g e imposing minimum safeguards, so that the persons whose personal data is affected have sufficient guarantees that data will be effectively protected against the risk of abuse.

text: 56. The lack of precise identification of the measures subject to the derogation is likely to undermine legal certainty.

text: 57. Finally, the EDPS is of the view that the five-year period as proposed does not appear proportional given the absence of (a) a prior demonstration of the proportionality of the envisaged measure and (b) the inclusion of sufficient safeguards within the text of the legislation. He considers that the validity of any transitional measure should not exceed 2 years. Brussels, 10 November 2020 Wojciech Wiewiorowski (e-signed) 16 | P a g e

text: Notes

text: 17 | P a g e

text: 18 | P a g e

text: 19 | P a g e

type: vagledning

utgivare: edps


identifier: EDPS yttrande 07/2021

title: EDPS Opinion on digital operational resilience for the financial sector (DORA)

text: 10 May 2021

text: Opinion 7/2021

text: on the Proposal for a Regulation on digital operational resilience for the financial sector and amending Regulations

text: (EC) 1060/2009

text: (EU) 648/2012

text: (EU) 600/2014

text: and

text: (EU) 909/2014

text: 0 1 2 1 2

text: 1 BACKGROUND

text: 3 4 6

text: 2 GENERAL COMMENTS

text: 7 4 8 9 10 11 12 5

text: 3 SPECIFIC COMMENTS

text: 3.1 Regarding the international transfers to ICT third-party service providers established in a third-country 13 14 3.2 Regarding the information sharing arrangements 15 16 17 6 18 3.3 Regarding the publication of administrative fines 19 3.4 Regarding the notification of data breaches 7 20

text: 4 CONCLUSIONS

text:      8     9


text: See: paragraph 11 of the NIS 2.0 Opinion 6

text: "The Future of Encryption in the EU", Keynote Speech by Supervisor Wiewiórowski at the ISOC 2020 Webinar 8

text: See also the EDPS Guidelines on Personal Data Breach Notification 9

text: OJ L 295, 21.11.2018, p. 39. 2 COM(2022) 119 final 3 COM(2022) 122 final 4 The EU’s Cybersecurity Strategy for the Digital Decade | Shaping Europe’s digital future (europa.eu) including a Joint Communication with the High Representative of the Union for Foreign Affairs and Security Policy (JOIN(2020)18) 5 See chapter I. INTRODUCTION, page 4 of the Strategy.

text: Joint Communication from the European Commission and the High Representative of the Union for Foreign Affairs and Security Policy to the European Parliament and the Council, titled ‘The EU's Cybersecurity Strategy for the Digital Decade’ EDPS Opinion 5/2021 on the Cybersecurity Strategy and the NIS 2.0 Directive

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (OJ L 295, 21.11.2018).

identifier: EDPS yttrande 07/2022

title: Opinion on the Proposal for a Regulation on information security in the institutions, bodies, offices and agencies of the Union

text: 17 May 2022

text: Opinion 7/2022

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on the information security in the institutions, bodies, offices and agencies of the Union. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the draft Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: The EDPS observes that personal data security as mandated by the EUDPR has a scope that only partially overlaps with the scope of the information security under the Proposal. The latter focuses on the confidentiality of information, whereas the EUDPR ensures also integrity and availability. Furthermore, the EUDPR personal data security provisions specifically address the risks for the rights and freedoms of natural persons.

text: The Proposal requires the EUIs to adopt information security measures, which will inevitably involve the processing of personal data and of electronic communications data, including traffic data. The EDPS considers that it must be made evident that all information security measures involving processing of personal data should be compliant with the current data protection and privacy legal framework and that EUIs should take relevant technical and organisational safeguards to ensure this compliance in an accountable way.

text: To achieve legal certainty and foreseeability, and to ensure compliance with the EUDPR, the EDPS strongly advises that the Proposal, or at the very least, a delegated act to be adopted subsequently by the Commission, clearly defines the personal data processing activities that are allowed for the purposes of this Regulation. The EDPS also draws the attention to the need to ensure compliance with the EUDPR rules regarding transfers of personal data to third countries and international organisations. Moreover, the EDPS recommends explaining in a Recital, that all of the EUDPR provisions will apply, including the rules on international transfers.

text: The EDPS stresses the importance of integrating the privacy and data protection perspective in the information security management, in order to achieve positive synergies between the Proposal and privacy and data protection legislation, and provides specific recommendations on how such synergies can be achieved, including: a specific obligation for EU officials responsible for information security to cooperate closely with the data protection officer designated in accordance with

text: Article 43

text: EUDPR; the integration of end-to-end encryption in the list of minimum security measures of the Proposal, where applicable, and in particular when exchanging sensitive non-classified information; and the promotion of an integrated information security risk management and an integrated incident handling process that serve both information security and data protection obligations on data breach notifications.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EC) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular

text: Articles 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. The European Commission adopted on 22 March 2022 a Proposal for a Regulation of the European Parliament and of the Council on the information security in the institutions, bodies, offices and agencies of the Union (‘the Proposal').

text: 2. On the same date, the European Commission adopted another Proposal for a Regulation laying down measures for a high common level of cybersecurity at the institutions, bodies, offices and agencies of the Union ('the Cybersecurity Proposal').

text: 3. Both Proposals had been envisaged by the EU's Cybersecurity Strategy for the Digital Decade presented on 16 December 2020 (‘the Strategy'). The overall aim of the Strategy was to strengthen the Union’s strategic autonomy in the fields of cybersecurity and to improve its resilience and collective response as well as to build a global and open Internet with strong guardrails to address the risks to security and fundamental rights and freedoms of people in Europe.

text: 4. The Proposal constitutes one of the regulatory initiatives of the Strategy, and in particular in the area of Cybersecurity of the EU Institutions, bodies, offices and agencies (‘the EUIs’). According to the Strategy, the aim of the Proposal is twofold:  to facilitate the interoperability of classified information systems, allowing a seamless transfer of information between the different entities, and  to enable an inter-institutional approach to the handling of EU classified information and sensitive non-classified information, which could also serve as a model for interoperability across Member States, stating that the EU should also further develop its ability to communicate in a secure manner with relevant partners, building to the extent possible on existing arrangements and procedures.

text: 5. The EDPS observes that the subject matter of the Proposal at hand is also directly related to the Proposal for a Directive of the European Parliament and of the Council on measures for a high common level of cybersecurity across the Union, repealing

text: Directive (EU) 2016/1148

text: (‘NIS 2.0 Proposal’). The EDPS recalls that he issued the Opinion 5/2021 on the 6 7 Cybersecurity Strategy and the NIS 2.0 Directive (‘NIS 2.0 Opinion’) . For this reason the present Opinion will refer to the NIS 2.0 Opinion. 4

text: 6. According to the explanatory memorandum of the Proposal, due to the ever-increasing amount of sensitive non-classified (‘SNC’) information and European Union classified information (‘EUCI’) that the EUIs need to share amongst themselves and considering the dramatic development of the threat landscape, the European administration is exposed to attacks in all its areas of activity. The information handled by the EUIs is very attractive for the threat actors and needs to be appropriately protected.

text: 7. According to the explanatory memorandum, the Proposal would:  establish harmonised and comprehensive categories of information, as well as common handling rules for all EUIs,  set up a lean cooperation scheme on information security between EUIs able to foster a coherent information security culture across the European administration,  modernise the information security policies at all levels of classification/categorisation, for all EUIs, taking into account the digital transformation and the development of teleworking as a structural practice.

text: 8. On 22 March 2022 the Commission consulted the European Data Protection Supervisor pursuant to

text: Article 42(1) of Regulation (EU) 2018/1725

text: (‘EUDPR’) . The comments and recommendations in this Opinion are limited to the provisions in the Proposal that are most relevant from a data protection and privacy perspective.

text: 2. General remarks

text: 9. The EDPS recalls that information security, which is the subject matter of the Proposal, has been a part of data protection legislation since its beginnings. Today

text: Article 4(1)

text: (f) of the EUDPR establishes security as one of the main principles relating to the processing of personal data. Article 33 of the EUDPR further defines the obligations applicable to both controllers and processors, to ensure an appropriate level of security of personal data. Both provisions clearly establish that personal data security is essential for compliance with EU data protection law. This is why, on the one hand, this Opinion analyses the Proposal as to whether it establishes an effective information security management system or contains effective measures to increase the security of information including personal data.

text: 10. On the other hand, information security measures do not only enhance personal data security and do not only contribute to the protection of personal data, but they also have the potential to interfere with the rights and freedoms of data subjects, especially the fundamental rights to the protection of personal data and to the privacy of electronic communications. Therefore, this Opinion analyses the Proposal also as to whether it provides for measures to be taken, among others, based on a valid legal basis, with specific and limited purposes, and are adequate, necessary and proportionate.

text: 11. The EDPS takes note that the subject matter of the Proposal has a different perspective from both the NIS 2.0 and the Cybersecurity Proposals. It is our understanding that cybersecurity focuses on the protection of network and information systems, the users of such systems, and other persons affected by cyber threats, while the Proposal concerns 5 information security in any form, not just information processed by IT systems that are affected by cyber threats.

text: 12. The EDPS wishes to underline that while for the NIS 2.0 Proposal, which provides for obligations on Member States, the application of

text: Regulation (EU) 2016/679

text: (‘GDPR’) and Directive

text: (ePrivacy Directive) is relevant when processing personal data, for the current Proposal, which lays down rules for EUIs, the EUDPR applies and plays an equally important role.

text: 13. The EDPS welcomes the aim of the Proposal to improve the security of information handled by the EUIs, by establishing common information security rules as well fostering a coherent information security culture in a specific legal instrument.

text: 3. Specific comments

text: 3.1. Scope of the Proposal and relationship with data Protection and Privacy legislation

text: 14. According to

text: Article 3

text: (b) of the Proposal, ‘information security’ means ensuring the authenticity, availability, confidentiality, integrity and non-repudiation of information. However, the EDPS observes that according to

text: Article 2(2)

text: , information is classified only with regard to confidentiality, and that, according to

text: Article 2(3)

text: , the confidentiality levels ‘are based on the damage that unauthorised disclosure may cause to the legitimate private and public interests, including those of the Union, Union institutions and bodies and Member States or other stakeholders’. The emphasis on confidentiality is also present in the Information security risk management process described in

text: Article 5

text: , where only the confidentiality level of information is taken into consideration.

text: 15. As a consequence, the EDPS submits that personal data security as mandated by the EUDPR has a scope that only partially overlaps with the scope of the information security under the Proposal.

text: Article 4(1)

text: (f) EUDPR requires ensuring integrity and confidentiality of personal data, while

text: Article 33

text: EUDPR requires ensuring the ongoing confidentiality, integrity, availability and resilience of processing systems and services by addressing the risks for the rights and freedoms of natural persons.

text: 16. At the same time, similarly to what was already stated in the NIS 2.0 Opinion, the pursuance of the objectives of information security may lead to deploying measures that interfere with the rights to data protection and privacy of individuals. This implies ensuring that any limitation of the right to the protection of personal data and privacy must fulfil the requirements of Article 52(1) of EU Charter of Fundamental Rights, in particular be achieved by way of a legislative measure, be necessary and proportionate, and respect the essence of the right.

text: 17. The Proposal requires the EUIs to apply information security measures, either as mandatory ones, or as measures selected from a risk management process taking into account certain criteria. In practice, some of these measures will inevitably involve the processing of personal data and of electronic communications data, including traffic data. The Proposal contains already some mandatory measures that would imply personal data processing:

text: 18. The EDPS notes that the organisations acting as controllers and processors do not always realise that the data processed in information security systems and services may include personal data (e.g. IP addresses, device identifiers, network log files, access control log files, etc.). This might lead to certain risks of non-compliance with data protection and privacy principles, such as lawfulness of processing, data minimisation, purpose limitation, storage limitation, and obligations for lawful data transfers. The EDPS considers that it must be made evident that all information security measures involving processing of personal data should be compliant with the current data protection and privacy legal framework and that EUIs should take relevant technical and organisational safeguards to ensure this compliance in an accountable way. Even more so, if there is no appropriate legal basis for EUIs in order to process personal data to implement certain security measures, the creation and justification of such a legal basis should be considered.

text: 19. Where an EU legal act envisages the processing of personal data, the EU legislation in question must lay down clear and precise rules governing the scope and application of the measure in question and imposing minimum safeguards so that the persons whose data are being processed have sufficient guarantees that their personal data are effectively protected against the risk of abuse and against any unlawful access and use of that data (see, CJEU, judgment of 8 April 2014, Digital Rights Ireland e.a.,

text: et

text: , EU:C:2014:238, point 54, and by analogy, as regards Article 8 of the ECHR, Eur. Court H.R., Liberty and Others v. the United Kingdom, 1 July 2008, no. 58243/00, § 62 and 63; Rotaru v. Romania, § 57 to 59, and S. and Marper v. the United Kingdom, § 99).

text: 20. To achieve legal certainty and foreseeability, and to ensure compliance with the EUDPR, in particular with

text: Article 5(1)

text: (a) and 5(2), the EDPS strongly advises that the Proposal clearly defines the personal data processing activities that are allowed for the purposes of this Regulation (unless differently specified in another sectoral/specific legal text), including: the purpose(s) of the processing; categories of personal data; categories of data subjects; definition of roles as applicable (controller, processor, joint controllers), retention periods, recipients in case of transmission to entities not subject to the EUDPR. The EDPS considers that these elements should be provided for explicitly in the Proposal, or at the very least, in a delegated act to be adopted subsequently by the Commission. The Proposal should provide for such a delegation. The EDPS also draws attention to the need to ensure compliance with the EUDPR rules regarding transfers of personal data to third countries and international organisations.

text: 21. The EDPS welcomes Recital 6 according to which the Proposal is without prejudice to the EUDPR. Moreover, the EDPS observes that

text: Article 46(9)

text: contains a reference to the EUDPR, 7 in particular when transferring EUCI containing personal data to third countries. The EDPS recalls that the EUDPR will apply to all processing of personal data by force of law. Therefore, no substantive provision is needed in the Proposal that establishes the application of the EUDPR in whole or in part. The EDPS acknowledges that international transfers of personal data are a complex subject requiring an additional reminder of the applicability of the EUDPR. In that case, the EDPS recommends explaining in a Recital, possibly Recital 6, that all of the EUDPR provisions will apply, including the rules on international transfers. Recital 6 can also be used to include any other general data protection recommendations made in this Opinion that do not aim at changing the substantive provisions.

text: 22. The Proposal regulates EU classified information in a very extensive way. EUCI, as all the other information in the scope of the Proposal, can also contain personal data. As a result, they are subject to the applicable data protection rules, which apply also in this case and must be taken into account further to the EUCI provisions. We recommend recalling this explicitly in a recital, given the level of detail of the EUCI rules in the text.

text: 3.2. Synergies with data protection and privacy

text: 23. Article 33 of the EUDPR considers individuals and their rights and freedoms as assets to protect in the security risk management approach when personal data are processed.

text: 24. The EDPS reiterates that integrating the privacy and data protection assets and perspective in the traditional information security management process will ensure a holistic approach and enable synergies to the EUIs when managing information security and protecting the information they process without unnecessary multiplication of efforts.

text: 25. The use of technologies for improving information security should not unduly interfere with the rights and freedoms of individuals. The first step to avoid or mitigate those risks is to apply the requirements of data protection by design and by default laid down in

text: Article 27

text: EUDPR, which will assist in integrating the appropriate safeguards such as pseudonymisation and encryption, or to implement principles such as storage limitation and data minimization, in the design and use of these technologies and systems.

text: 26. The EDPS recalls that encryption, including end-to-end encryption are critical and irreplaceable technologies for effective data protection and privacy . The EDPS welcomes Articles 11 and 17 of the Proposal that include encryption in the list of minimum measures for the protection of information at rest and in transit.

text: 27. As the use of tools and services for electronic collaboration and communication have now become standard in our normal working modalities, it is very important to safeguard also the security of electronic communications. Beyond its benefits for privacy of electronic communications, end-to-end encryption can also protect information in the scope of this Proposal, while being exchanged when using electronic collaboration and communication tools. For this reason, the EDPS strongly recommends including end-to-end encryption in the list of minimum security measures of the Proposal, where applicable, and in particular when exchanging sensitive non-classified information.

text: 28. Taking into account the accelerated use and adoption of cloud services by the EUIs, the EDPS recommends adding in

text: Article 5(3)

text: , that in the factors under consideration by the information security risk management process, also the threats stemming from access based on third countries jurisdiction (e.g. by their public authorities) shall be considered. This is another example of possible synergies between information security and data protection. Tackling these risks for the one domain, the risks for the other domain are tackled for the same information systems that process personal data and information in the scope of the Proposal.

text: 29. Finally, when dealing with information security incidents that may entail a personal data breach, or when dealing with a personal data breach that shows useful elements to tackle an information security incident, it is strongly advisable to explain in a relevant recital the benefits of having an integrated incident handling process that serves both information security and data protection obligations on data breach notifications. In this way, the controller can save time, resources and have a much more efficient incident response for both domains.

text: 30. To ensure such synergies between information security and data protection, the EDPS strongly advises that the proposal provide for a specific obligation for EU officials responsible for information security to cooperate closely with the data protection officer designated in accordance with

text: Article 43

text: 4. Conclusions

text: 31. In light of the above, the EDPS makes the following main recommendations:  the EDPS strongly advises that the Proposal clearly defines the personal data processing activities that are allowed for the purposes of this Regulation, including: the purpose(s) of the processing; categories of personal data; categories of data subjects; definition of roles as applicable (controller, processor, joint controllers), retention periods, recipients in case of transmission to entities not subject to the EUDPR. The EDPS considers that these elements should be provided for explicitly in the Proposal, or at the very least, in a delegated act to be adopted subsequently by the Commission. The Proposal should provide for such a delegation.  the EDPS recommends explaining in a Recital, that all of the EUDPR provisions will apply, including the rules on international transfers. Recital 6 can also be used to include any other general data protection recommendations made in this Opinion that do not aim at changing the substantive provisions.  the EDPS strongly recommends including end-to-end encryption in the list of minimum security measures of the Proposal, where applicable, and in particular when exchanging sensitive non-classified information.  the EDPS recommends adding in

text: Article 5(3)

text: , that in the factors under consideration by the information security risk management process, also the threats stemming from access based on third countries jurisdiction (e.g. by their public authorities) shall be considered.  the EDPS strongly advises to explain in a relevant recital the benefits of having an integrated information security risk management and an integrated incident handling process that serves both information security and data protection obligations on data breach notifications.  the EDPS strongly advises that the proposal provides for a specific obligation for EU officials responsible for information security to cooperate closely with the data protection officer designated in accordance with

text: Article 43

text: EUDPR, when dealing with activities such as applying data protection by design and by default to information security measures, selecting security measures that involve personal data, integrated risk management, integrated security incident handling. Brussels, 17 May 2022 Wojciech Rafał WIEWIÓROWSKI [e-signed]

text: Notes