text: The EDPS welcomes the objective of the Strategy to empower the individuals to be in control of their data, inter alia by providing tools and means to decide at a granular level about what is done with their data (“personal data spaces”). In the same vein, the Strategy aims at enhancing the portability right of individuals under Article 20 of the GDPR.

text: OJ L 119, 4.5.2016, p. 1. OJ L 295, 21.11.2018, p. 39. OJ L 119, 4.5.2016, p. 89. COM (2020) 66 final, https://ec.europa.eu/info/strategy/priorities-2019-2024/europe-fit-digital-age/european-datastrategy COM(2020) 67 final, https://ec.europa.eu/info/strategy/priorities-2019-2024/europe-fit-digital-age/shaping-europedigital-future_en COM(2020) 65 final, https://ec.europa.eu/info/strategy/priorities-2019-2024/europe-fit-digital-age/excellence-trustartificial-intelligence_en https://edps.europa.eu/sites/edp/files/publication/20-01-06_opinion_research_en.pdf https://edps.europa.eu/sites/edp/files/publication/18-07-11_psi_directive_opinion_en.pdf https://edps.europa.eu/sites/edp/files/publication/16-10-20_pims_opinion_en.pdf See more at https://edps.europa.eu/data-protection/our-work/subjects/covid-19_en COM (2017) 10 final, Proposal for a Regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive

text: (Regulation on Privacy and Electronic Communications) See

text: Article 29

text: Working Party Guidelines on Transparency under Regulation 2016/679 (wp260rev.01) https://ec.europa.eu/newsroom/article29/document.cfm?action=display&doc_id=51025 https://edps.europa.eu/sites/edp/files/publication/16-10-20_pims_opinion_en.pdf https://privacyinternational.org/legal-action/challenge-hidden-data-ecosystem See Recital 4 of GDPR See

text: Article 29

text: WP Guidelines on DPIA: https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=611236 In this regard, the general rule under Article 12(1) of the Open Data Directive states, subject to the limited exception under

text: Article 12(2)

text: : “The re-use of documents shall be open to all potential actors in the market, even if one or more market actors already exploit added-value products based on those documents. Contracts or other arrangements between the public sector bodies or public undertakings holding the documents an d third parties shall not grant exclusive rights.” Directive

text: of the European Parliament and of the Council of 17 November 2003 on the re-use of public sector information, OJ L 345, 31.12.2003, p. 90.

text: Directive (EU) 2019/1024

text: of the European Parliament and of the Council of 20 June 2019 on open data and the re-use of public sector information, OJ L 172, 26.6.2019, p. 56-83. 20 EDPS Opinion 5/2018, Opinion on the proposal for a recast of the Public Sector Information (PSI) re -use Directive, available at: https://edps.europa.eu/sites/edp/files/publication/18-07-11_psi_directive_opinion_en.pdf See, for instance, the Data protection impact assessment for smart grid and smart metering environment, available at:https://ec.europa.eu/energy/en/topics/markets-and-consumers/smart-grids-and-meters/smart-grids-task-force/dataprotection-impact-assessment-smart-grid-and-smart-metering-environment The latter could be implemented in order to also take into account the re-use of data to identify energy saving solutions. See at page 8 of the Strategy, referring to “use of aggregated and anonymised social media data”. See

text: Case C‑582/14

text: Patrick Breyer v Bundesrepublik Deutschland, ECLI:EU:C:2016:779 See

text: Article 29

text: WP Opinion 05/2014 on Anonymisation Techniques, https://ec.europa.eu/justice/article- 29/documentation/opinion-recommendation/files/2014/wp216_en.pdf https://www.ema.europa.eu/en/human-regulatory/marketing-authorisation/clinical-data-publication/support-industryclinical-data-publication https://ec.europa.eu/eurostat/web/european-statistical-system/reuse-ess-statistics See

text: Recital 5

text: of

text: Regulation (EU) 2018/1725

text: See EDPB-EDPS Joint Opinion 1/2019 on the processing of patients’ data and the role of the European Commission within the eHealth Digital Service Infrastructure (eHDSI), https://edpb.europa.eu/our-work-tools/ourdocuments/edpbedps-joint-opinion/edpb-edps-joint-opinion-12019-processing_en See page 15 of the Data Strategy. https://edps.europa.eu/sites/edp/files/publication/20-01-06_opinion_research_en.pdf https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-032020-processing-data-concerninghealth-purpose_en See more on this issue in the EDPS Preliminary opinion on data protection and scientific research See for instance the opinion of the German Data Ethics Commission from 2019, recommendations 16-23. https://edps.europa.eu/sites/edp/files/publication/18-03-16_cloud_computing_guidelines_en.pdf For more information see https://edps.europa.eu/press-publications/press-news/press-releases/2019/edpsinvestigation-it-contracts-stronger_en

identifier: EDPS yttrande 03/2020

amnesord:
Artificial Intelligence
Digital Clearinghouse 2.0

publisher: Europeiska datatillsynsmannen

sprak: en

title: European Strategy for Data

serie: yttranden

text: Opinion 3/2020

type: rubrik

text: on the European strategy for data

text: 16 June 2020 1 | P a g e

text: Executive Summary

type: stycke

text: The European Commission published on 19 February 2020 a Communication “A European strategy for data”. It is part of a wider package of strategic documents, including also a Communication on Shaping Europe’s digital future and a White Paper on Artificial Intelligence - A European approach to excellence and trust.

text: The aim of the Data Strategy is to create a single European data space and thus make it easier for businesses and public authorities to access high-quality data to boost growth and create value. Moreover, it should “enable the EU to become the most attractive, most secure and most dynamic dataagile economy in the world”. A key element of the Data Strategy is the development of common European data spaces in strategic economic sectors and domains of public interest, such as the common European health data space.

text: This Opinion presents the EDPS view on the Data Strategy as a whole, as well as on certain specific aspects, such as the notion of “public good”, Open Data, use of data for scientific research, data intermediaries, data altruism, international data sharing and others.

text: The EDPS understands the growing importance of data for the economy and society and supports the wider strategic objectives of the EU, such as the development of the Digital Single Market and the EU’s digital sovereignty. At the same time, he recalls that “big data comes with big responsibility” and therefore appropriate data protection safeguards must be in place.

text: In this regard, the EDPS applauds the Commission’s commitment to ensure that European fundamental rights and values, including the right to the protection of personal data, underpin all aspects of the Data Strategy and its implementation. In particular, he appreciates the assurance that the Strategy would be developed in full compliance with the General Data Protection Regulation, which provides a solid basis, also by virtue of its technologically-neutral approach.

text: The EDPS underlines that one of the objectives of the Data Strategy should be to prove the viabilit y and sustainability of an alternative data economy model - open, fair and democratic. Unlike the current predominant business model, characterised by unprecedented concentration of data in a handful of powerful players, as well as pervasive tracking, the European data space should serve as an example of transparency, effective accountability and proper balance between the interests of the individual data subjects and the shared interest of the society as a whole.

text: Furthermore, this Opinion takes into account the unprecedented global crisis, caused by the COVID- 19 pandemic, which has affected all aspects of our life. In this context, the EDPS reiterates his position that data protection is not the problem but part of the solution. Data and technology can play an important role in the overcoming the crisis in combination with other factors, as there is no “silver bullet” for something as complex like this.

text: The EDPS remains at the disposal of the Commission, the Council and the European Parliament to provide further advice at the next stages of the implementation of the European strategy for data, both in terms of legal framework and of practical aspects. The comments in this Opinion are without prejudice to additional comments in the future on particular issues and/or if further information is available.

text: 2 | P a g e

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof, Having regard to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) , Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: , in particular

text: Article 58(3)

text: (c), Having regard to

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA ,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION AND BACKGROUND

text: 1. The European Commission presented on 19 February 2020 a Communication “A European strategy for data” . It is part of a wider package of strategic documents, including also a Communication on Shaping Europe’s digital future and a White Paper on Artificial Intelligence - A European approach to excellence and trust .

text: 2. The aim of the European strategy for data (hereinafter referred to as “the Data Strategy” or “the Strategy”) is to create a single European data space and thus make it easier for businesses and public authorities to access high quality data to boost growth and create value, while reducing the carbon footprint of the EU economy. Moreover, it would play a key role in realising the Commission’s ambition to “enable the EU to become the most attractive, most secure and most dynamic data-agile economy in the world”.

text: 3. The European Data Strategy has been open to public consultation. The objective of the consultation is to collect views on the Data Strategy as a whole, as well as on certain specific aspects. A similar public consultation has been launched on the White Paper on Artificial Intelligence.

text: 4. The EDPS was informally consulted by the Commission on 29 January 2020 on the initial draft of the Data Strategy and submitted preliminary comments. The EDPS welcomes the fact that his views have been sought at an early stage of the procedure and encourages the Commission to continue with this best practice.

text: 5. The present opinion further elaborates upon some of the informal comments and provides more targeted input in light of the public consultation. It should, in principle, be read in conjunction with other relevant opinions of the EDPS, referred throughout the document, such as the 7 8 Preliminary opinion on scientific research , Opinion on Open Data , Opinion on personal 4 | P a g e information management systems , and others. Furthermore, the present opinion is without prejudice to any additional comments that the EDPS could make on the basis of further available information at a later stage, including in the context of the future legislative consultations on the legal acts foreseen in the Data Strategy and the Commission Work Programme.

text: 6. Finally, the EDPS notes the ongoing debate about the extent to which data and technology can help in the fight against COVID-19. In this context, the EDPS would like to recall his position, shared by the other supervisory authorities within the European Data Protection Board (EDPB) , that data protection rules do not hinder measures taken in response to the coronavirus pandemic. Data protection is not the problem, it is part of the solution. The EDPS considers that data and technology play an important role in the overcoming of the unprecedented crisis, which impacts all aspects of our life, but they are by no means a “silver bullet”. Data and technology can contribute in fighting the pandemics and other similar threats only if they empower effectively the individuals and are accompanied by appropriate safeguards and other holistic measures.

text: 2. GENERAL COMMENTS

text: 2.1. Application of the key data protection principles

text: 7. The EDPS welcomes the Data Strategy’s commitment to ensure that European fundamental rights and values, including the right to the protection of personal data provided under Article 8 of the Charter of Fundamental Rights of the EU and

text: Article 16

text: TFEU, are fully upheld in all the actions that will follow from the Strategy.

text: 8. In particular, the EDPS supports the Commission’s commitment to develop the Strategy in full compliance with the General Data Protection Regulation (“GDPR”). He is convinced that the GDPR provides a solid basis, also by virtue of its technologically-neutral approach, for the development and implementation of the Strategy.

text: 9. The EDPS recalls that, pursuant to Article 5 of the GDPR, the processing of personal data should always respect the principles of lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality.

text: 10. These principles remain fully applicable when processing personal data for the “public good” purposes. Purpose limitation is an essential safeguard to provide individuals with the confidence that the data they provide will not be used against them in an unexpected manner. The importance of the principle of purpose limitation is clearly demonstrated in the context of the measures which are being considered to fight against COVID-19, e.g. health data to be processed under the control of healthcare authorities as data controllers and not to be used for commercial or other incompatible purposes.

text: 11. Equally significant are the principles of transparency and accountability. Transparency should be understood as an obligation to provide clear, intelligible and easily accessible information both to the citizens/the public and to data protection authorities. Furthermore, the possibility to perform independent audits on the data processing operations and to take enforcement measures, whenever necessary, are important aspects of accountability and cannot be replaced by self-regulation only.

text: 12. In the context of the proposed future Data Act, the EDPS recommends to lay down requirements for producers of products, services and applications that are based on the processing of personal data or which process personal data to also comply with data protection legislation, in particular with the requirements of data protection by design and by default. Such an obligation should complement the existing obligations of controllers and processors under the GDPR, and could 5 | P a g e considerably enable controllers and processors to fulfil their data protection obligations, e.g. when selecting appropriate hardware or software solutions.

text: 13. The EDPS recalls that the adoption of the proposed ePrivacy Regulation is crucial to protect the fundamental rights to privacy and personal data protection in the digital age. Hence, the completion of the EU’s legal framework for data protection and confidentiality of communications is an important condition for the success of the Data Strategy.

text: 14. The EDPS observes that the implementation of the Strategy will inevitably entail an increase in magnitude and seriousness of the data protection risks, including security risks. For instance, connected Internet of Things (IoT) devices increase the “attack surface” for cyberattacks and amplify or produce new possible adverse impacts on individuals. This problem should be addressed in the context of the review of the Directive on security of network and information systems (NIS Directive) or via a new legislative initiatives, and might also be linked to EU consumer law and policy, for instance on product safety. 2.2. Data subject rights and the role of data intermediaries

text: 16. An important prerequisite for individuals to be able to exercise effectively their rights as data subjects is the ability to ascertain what has done with their data and by whom, given the fact that pooling of data will facilitate access by many different actors. Therefore, the routine approach to transparency in the form of lengthy privacy notices phrased in abstract or ambivalent terms, still applied by some controllers, is contrary to the GDPR’s requirements to provide information “in a concise, transparent, intelligible and easily accessible form, using clear and plain language”. . In this context, and especially in the light of technological developments the EDPS reminds that pursuant to

text: Article 12(7)

text: and (8) of the GDPR the information to data subjects could be provided with standardised and machine readable icons in order to offer an easily visible, intelligib le and meaningful overview of the intended processing. The Commission should by 2022 determine with delegated acts how the required information would be presented with such standardised icons.

text: 17. Personal information management systems (PIMS) are emerging as promising platforms to give data subjects more control over their personal data. Furthermore, some PIMS models could be seen as a driver for data portability as they can function as a centralized data infrastructure allowing the individuals to manage their personal data. The EDPS has already published an Opinion on Personal Information Management Systems . Therein, the EDPS stresses the need to develop technical tools and standards that make the exercise of data subjects’ rights simple (e.g. with data privacy dashboards), as important means to empower the individual to manage their data. In his Opinion on PIMS the EDPS has also pointed out in particular the requirement for such systems to be fully transparent towards users and to ensure genuine user control.

text: 18. The EDPS notes that there are other types of data intermediaries such as data trusts and cooperatives, data marketplaces, data brokers, etc. In this regard, the EDPS emphasises the need of a clear distinction between the data intermediaries focussing exclusively on personal data and seeking to enhance individual agency, on the one hand, and those driven by economic incentives and aiming to support mainly Business to Business (B2B) data exchange, on the other hand. 6 | P a g e

text: 19. The EDPS considers that intermediaries aiming to empower data subjects through technical and other tools to manage the use of their data deserve consideration, further research and effective support, as they contribute to a sustainable and ethical use of data, in line with the principles of the GDPR.

text: 20. At the same time, the EDPS underlines the need of caution with regard to the role of data brokers that are actively engaged in the collection of huge datasets, including personal data from different sources. They tap into a variety of data sources used for data-related services, such as data that are disclosed for other unrelated purposes; data from public registers (open data), as well as data “crawled” from the Internet and social media, often in violation of data protection legislation. In this context, the EDPS notes that the activities of big data brokers are under increased scrutiny and are investigated by a number of national data protection authorities . 2.3. Concept of “public good”

text: 21. The Data Strategy pays specific attention to “availability of data for the public good”, understood in a broad sense - from healthcare and environmental protection to fight against crime. The EDPS welcomes the Commission’s vision on the fostering the use of data for “public good”. The EDPS recalls one of the overarching principles of the GDPR, namely that processing of personal data should be designed to serve humankind.

text: 22. The EDPS also notes that the Strategy equally refers to the notion of “public interest”, and uses it interchangeably with the notion of “public good”. “Public interest” can be a basis for lawful processing under

text: Articles 6(1)

text: (e) of the GDPR and can be relied on for the processing of special categories of data (e.g. data concerning health) under and 9(2)(g) and (i) of the GDPR. In line with Article 6(3) of the GDPR, the basis for processing of personal data, necessary for the performance of a task carried out in the public interest, should be laid down by EU or Member State law. Consequently, processing of personal data for “public good” corresponds to the same important objectives, expressed in the GDPR as “public interest,” and should be subject to the same requirements.

text: 23. In this context, the EDPS notes that data, in particular public sector information, could play a key role in the Digital Single Market. Furthermore, smart use of data, including its processing via Artificial Intelligence, can have a transformative effect on various sectors of economy. At the same time, the EDPS points out that the sharing of data for social and other common needs should be subject to the appropriate data protection safeguards in line with the principles of necessity and proportionality.

text: 24. The use of data for the public good/public interest may involve large-scale processing, which combines data from a variety of sources, potentially involving special categories of data and/or personal data of vulnerable groups of data subjects. Where that is the case, such processing is likely to result in a high risk and data controllers have to conduct data prote ction impact assessments (DPIA) in accordance with Article 35 of the GDPR . Moreover, the EDPS recommends, whenever possible, making public the results of such assessments, as a trust and transparency enhancing measure.

text: 25. Any subsequent use of data, collected and/or shared for a public good/public interest function (e.g. for improving transport/mobility or tackling serious cross-border threats to health), for commercial for-profit purposes (for instance insurance, marketing, etc.) should be avoided. Such “function creep” might not only constitute a breach of the data protection principles under Article 5 of the GDPR, but could also undermine the trust of the citizens, which is a fundamental component of the Strategy. 7 | P a g e

text: 26. Equally important, processing of data for the public good should not create or reinforce situations of data oligopoly (dependency of the public sector, SMEs, etc. on few powerful IT companies, socalled Big Tech) . This is also relevant from a data protection perspective since monopolies and oligopolies create situations of users’ lock-in and ultimately restrict the possibility for individ uals to exercise effectively their rights. 2.4. Open Data

text: 27. Regarding the Government to Business (G2B) data re-use envisaged in the Strategy, namely the access to and processing of data held by public authorities, as defined under the ‘PSI Directive’ , revised by Directive

text: (hereinafter, the Open Data Directive) , the EDPS has issued an Opinion ,whereby he referred to the following key principles: (i) transparency and societal participation on the purpose of the reuse vis-à-vis the citizens/data subjects, as well as transparency and clear purpose definition between the licensor (the public authority) and the licensees; (ii) data protection impact assessment for data processing falling under Article 35(3) of the GDPR to identify the risks and the appropriate data protection safeguards addressing them, before the reuse of data takes place.

text: 28. The EDPS remarks that, due to the technological, economic and legal specificities of each ‘sector’ (e.g. the processing of health data for research purposes is different than the processing of smart energy data to implement ‘green business model’) , a ‘sector-by-sector’ approach, requiring inter alia a ‘sectoral’ data protection assessment, might be necessary.

text: 29. From the information technology viewpoint, the EDPS welcomes that the Strategy aims to foster the reuse of public sector information by reducing market entry barriers, in particular for small and medium-sized enterprises, by minimizing the risk of excessive first-mover advantage, which benefits large companies and thereby limits the number of users of the data in question, as well as by increasing business opportunities by encouraging the publication of dynamic data and the uptake of application programming interfaces (APIs). 2.5. Personal and non-personal data

text: 30. The EDPS notes that the Strategy makes a distinction between three categories of data, namely non-personal, personal and mixed data sets. In this context, the EDPS would like to remind that in practice a combination of non-personal data may infer or generate personal data, i.e. data relating to an identified or identifiable individual.

text: 31. The Strategy also refers to “anonymised” and “aggregated” data, at one point suggesting that the aggregated data might be the same than anonymized data. Here the EDPS would like to point out that aggregated data is not necessarily non-personal data, since aggregated data might still be related to an identified or identifiable individual. In this regard, the EDPS recalls that, in line with Recital 26 of the GDPR and the case law of the CJEU , a due account should be taken of all objective factors, including the costs and the time required for identification, the available technology as well as the legal and other means to access additional data about the person.

text: 32. Furthermore, anonymization processes are not straightforward . The more varied the data, the more difficult it is to be anonymised by reducing the re-identification risk to an acceptable threshold. The practical difficulties associated with a robust anonymization process might prevent data controllers, and specially SMEs, from sharing valuable data. To reduce the required effort, while ensuring the data is anonymised appropriately, the EDPS encourages the Commission to 8 | P a g e invest into and further support and foster good anonymization practices and anonymizatio n standards.

text: 33. In this regard, the EDPS would also like to point out to some best practices with reference to the re-use of anonymised data in the public sector, such as the extensive guidance developed by European Medicines Agency (EMA) for industry to facilitate compliance with this policy or the provision of high quality as a ‘public good’ by the European Statistical System (ESS) . 2.6. European Union institutions, bodies and agencies

text: 34. The EDPS notes that the Strategy does not specifically address the role and the applicable rules for the European Union institutions, bodies and agencies. It is true that data protection rules applicable to them, namely

text: Regulation (EU) 2018/1725

text: , is very much aligned with the GDPR and

text: Directive (EU) 2016/680

text: and, consequently, all these acts have to be interpreted homogeneously . At the same time, the Union institutions and other bodies are important actors in the data economy on their own - as providers of data (e.g. through EU Open Data Portal), users of data (e.g. for better policy making), or as service providers (e.g. the eHealth Digital Service Infrastructure ).

text: 35. Hence, the EDPS, as the supervisory authority monitoring the personal data processing by Union institutions and bodies, is convinced that the Data Strategy and the related legal and non-legal acts on its implementation should take due account of the specific role of the European Union institutions, bodies and agencies. Thus the Union will not only ensure the necessary transparency and legal certainty but will also live up to Commission’s promise in the Strategy to be “leading by example” .

text: 3. DATA FOR SCIENTIFIC RESEARCH

text: 36. The EDPS takes note of the Commission’s plan to increase the amount and types of data available for scientific research in line with the principle ‘as open as possible, as closed as necessary’. One of the key initiatives for facilitating discovery, sharing of, access to and reuse of data and services by researchers is the European Open Science Cloud (EOSC). The latter will also be used as a model for the creation of the future common European data spaces.

text: 37. Both the EDPS Preliminary opinion on data protection and scientific research and the EDPB Guidelines on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak underline that data protection rules , such as the GDPR, are fully compatible with and do not hinder genuine scientific research. At the same time, sharing of personal data always involves a degree of risk to the data subjects, including where the purpose is scientific research, especially in cases of sensitive data. Data protection rules are intended to serve as a robust safety net for individuals whose data are needed to support science, as well as a framework steering researchers toward innovation that reflects the European values.

text: 38. It is a common assumption that scientific research is beneficial to the whole of society and that scientific knowledge is a public good to be encouraged and supported. While the EDPS generally shares this viewpoint, performing an activity deemed to be research cannot be a carte blanche to take irresponsible risks on fundamental rights. From a data protection viewpoint, the principles of necessity, proportionality and purpose limitation are essential. As expressed in the Preliminary opinion on data protection and scientific research, data protection authorities, ethics committees and the research community have a common interest in working together to help the advancement of knowledge, while ensuring people are not treated as mere data sets. 9 | P a g e

text: 39. While scientific research benefits from a special data protection regime, the EDPS would like to remind the Commission and researchers relying on the common data spaces that each of the principles under Article 5 of the GDPR (lawfulness, fairness and transparency; purpose limitatio n; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability) fully apply to any personal data processing for research purposes.

text: 40. Scientific research often involves the processing and sharing of special categories of personal data of the people involved and thus, in certain cases, could be considered a high-risk data processing according to the GDPR. The EDPS therefore recommends that the appropriate safeguards are taken, and that access to the data stored in the data spaces is made on the basis of various factors, including but not limited to the actor requesting access; the purpose of the processing and its risk level; the existence of accountability frameworks and safeguards, etc. Furthermore, data protection impact assessments should be conducted when the research involves sensitive data, with the involvement the respective data protection officers (DPO) and ethical review boards.

text: 41. The GDPR provides for derogations to certain obligations (i.e. providing the data subject’s right of access (

text: Article 15

text: ), right to rectification (

text: Article 16

text: ), right to restriction (

text: Article 18

text: ) and right to object (

text: Article 21

text: )) for scientific research purposes, where the processing is proportionate to the aim pursued, respects the essence of the right to data protection, and provides for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. Nevertheless, this special regime cannot be applied in such a way that the essence of the right to data protection is compromised. Derogations from these data subject rights must be subject to a particularly high level of scrutiny. They require a case-by-case analysis, balancing of interests and rights at stake, and a flexible multi-factor assessment. Any limitation to fundamental rights in law has to be interpreted restrictively and should not be abused. Furthermore, under

text: Article 89(2)

text: GDPR, derogations can be applied only “in so far as the rights to be derogated from are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes”.

text: 42. There is no universally agreed definition of research or scientific research. Moreover, boundaries between public interest, academic freedom and private gain today are more blurred than eve r. This uncertainty may create loopholes in the protection of fundamental rights, including the right to privacy and to personal data protection. The EDPS therefore strongly recommends that the Strategy and the envisaged legislation address specifically the definitions and the scope of the key notions such as scientific research, innovation, public interest, to avoid inconsistency with existing notions in the GDPR .

text: 4. COMMON EUROPEAN DATA SPACES

text: 4.1. General comments on the concept

text: 43. A key element of the Data Strategy is the development of common European data spaces in strategic economic sectors and domains of public interest. The data spaces would combine large pools of data, technical tools and infrastructures necessary to use and exchange data, as well as governance mechanisms. They would be governed by a horizontal framework complemented, where appropriate, by sectoral legislation for data access and use.

text: 44. The common European data spaces fit into and support wider strategic objectives of the EU, such as the development of a fair and competitive Digital Single Market, uptake of new technologies like Artificial Intelligence and in particular machine learning, as well as asserting the EU digital sovereignty. 10 | P a g e

text: 45. The EDPS welcomes the commitment in the Strategy that the common European data spaces will be developed “in full compliance with data protection rules and according to the highest available cyber-security standards” and looks forward to examining the specific proposals and initiatives aimed at implementing this commitment.

text: 46. The EDPS welcomes the Commission’s intention to consider the adoption of sector-specific legislation to accompany the creation of certain common European data spaces. The European legislator has a responsibility to put in place additional legal safeguards in situations where the Strategy would lead to increased availability and reuse of personal data. The need for further specification and particularisation of the general rules contained in the GDPR at EU level seems most pressing in relation to the sharing of health data and for scientific research in general. At the same time, such specification, aiming at the harmonization at the maximum possible extent of the rules on the processing of personal data for scientific research in particular, may further foster the sharing of data.

text: 47. In addition to the horizontal data protection and cyber security standards, the Commission should invest in further fostering interoperability, including also in the context of data portability. Thus, the common data spaces would enable more data protection-compliant business models to emerge and thrive.

text: 48. While the EDPS agrees that one-size-fits-all approach might not be appropriate, he nevertheless encourages the Commission to further clarify that the common European data spaces should be populated only with personal data which has been demonstrably obtained in compliance with data protection legislation, including in particular with the principles of lawfulness, purpose limitatio n and data minimisation.

text: 49. According to the Strategy, data spaces will be used for multiple purposes. Hence, it should be clearly defined from the onset for each data space what are the permitted purposes (i.e. research and non-research, etc.). Moreover, the protection of the fundamental rights to privacy and to the protection of personal data, and the value of human dignity that underpins these rights, warrants, in certain scenarios, a clear limitation on the cross-context use of data, including prohibitions on the use of sensitive personal data for other purposes (for instance, the use of genetic data for insurance purpose). This is particularly relevant for the cross-sector use of personal data in the IoT context.

text: 50. The common European data spaces, based on the European values and fundamental rights with the human being at the centre, could also serve as evidence of the viability of alternative models to the current concentration of data in the hands of a few private corporations based outside the EU which play the role of self-appointed gatekeepers of internet or big IT solution providers. Therefore, the envisaged European data spaces should serve as an example with regard to transparency, effective accountability and proper balance between the interests of the data subjects and the shared interest of the society as a whole.

text: 51. The success of the common European data spaces and the Strategy as a whole depends heavily on the ability to create a solid level of trust between the various stakeholders - data subjects, governments, private companies, scientific research community and civil society organisations as well as data protection authorities and other relevant regulators. To this end, the governance model should specifically address the involvement of citizens and civil society. 11 | P a g e 4.2. Compulsory data sharing

text: 52. The EDPS takes note of the Commission’s intention to make data sharing compulsory in certain circumstances. There have been recent calls for regulated access across the EU to privately held personal data for research purposes that serve a public interest, such as improvin g healthcare provision and addressing the climate crisis . Such initiatives are expected to become even more prominent in the context of COVID-19 pandemic. In addition, in his Preliminary opinion on scientific research, the EDPS has highlighted the issue of corporate secrecy, particularly in the tech sector, which controls some of the most valuable data, as a major barrier to social science research.

text: 53. A possible public interest basis under data protection law to disclose data has to be clearly formulated and laid down in EU or Member State law, as well as to be accompanied by a rigorous proportionality test and appropriate safeguards against misuse and unlawful access. Therefore, the EDPS recommends an open and inclusive debate on this matter, which should involve all stakeholders, such as the research community, tech companies, civil liberties groups, supervisory authorities, etc.

text: 54. Finally, the EDPS calls for cautious approach towards initiatives aimed at compulsory access to personal data in the competition context, i.e. access to personal data held by the incumbent undertaking by its competitors. Such sharing and access to data among competitors must be balanced against other policy concerns, especially data protection. Any sharing or access to personal data must be strictly defined in scope and purpose and must occur in full compliance with the GDPR, taking into account the requirements of lawfulness, purpose limitation and the legitimate expectations of users. 4.3. Common European Health Data Space

text: 55. One of the nine strategic sectors, where the Commission sees a clear added value for the Union from pooling of data and technical resources, is healthcare. The objective of the proposed common European health data space is to improve access to and quality of healthcare, support scientific research and help competent authorities in taking evidence-based policy decisions.

text: 56. Given the significant impact and sensitiveness of cross-border exchange of health data, the EDPS wishes to highlight that all processing operations, which might result from the establishment of a common European health data space, will require a robust legal basis in line with EU rules on data protection. In this regard, he also points out to the need for further harmonization of data protection rules applicable to health data among the Member States. In addition, a European Code of Conduct on the processing of health data for the purpose of scientific research could be an effective enabler for greater cross-border exchange of health data within the EU.

text: 57. Sharing of health data could play an important role in addressing important individual and societal problems, when accompanied by appropriate data protection safeguards. The outbreak of COVID- 19, which has affected our lives in an unprecedented way, has very convincingly underlined that. In this regard, the EDPS recognises that data sharing could substantially contribute in managing the current crisis and its long-term consequences, as well as help the EU prepare for possible future crises of a similar nature.

text: 58. The EDPS would like to draw the attention on the recently adopted EDPB Guidelines on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak which highlight and further explain the essential data protection requirements, in particular legality, transparency, necessity and proportionality, as well as 12 | P a g e integrity and confidentiality. Personal data may only be processed for specified legitimate purposes, where necessary for these purposes, and not used in a way incompatible with those purposes.

text: 59. Finally, while acknowledging the limits of Union competence in the area of healthcare, in accordance with the Treaties, the EDPS invites the Commission to consider the possible role of the envisaged European health data space as an instrument for better preparedness, reaction and management of future health-related crises, together with the eHealth Digital Service Infrastructure (eHDSI) and others relevant EU structures and initiatives.

text: 5. SPECIFIC ISSUES

text: 5.1. Governance frameworks for data access and use

text: 60. The EDPS shares the view of the Commission that putting in place an enabling legislative governance framework is a priority for operationalising the Data Strategy and its core element - the common European data spaces. It should ensure legal certainty and consistency with other existing legal frameworks, in particular on data protection, by building upon and reinforcing them.

text: 61. The EDPS expects to be consulted on the future legislative proposals, such as the envisaged Data Act, in accordance with Article 42 of Regulation 2018/1725. Without prejudice to his future opinion(s), the present Opinion on the data strategy aims to provide some preliminary comments and recommendations related to the governance framework.

text: 62. Depending on the risks, nature, scope, context and purposes of processing, some type of formal “vetting” of organisations requesting access to common European data spaces might be warranted, for example in the form of a Clearinghouse. Furthermore, organisations involved in data pooling or sharing arrangements should adhere to certain common standards, not just in terms of interoperability, but also with a view of ensuring lawfulness of processing and facilitating data subject rights (e.g. through joint controller arrangements pursuant to Article 26 of the GDPR).

text: 63. Next, to ensure data controller accountability, the governance framework should include data traceability requirements. This is particularly relevant for the common European data spaces which would combine data from different Member States and from various sources, both public and private.

text: 64. Finally, the EDPS underlines that in the context of future governance mechanisms the competences of the independent supervisory authoritie s for data protection must be properly respected. Moreover, the implementation of the Strategy leading to wider use of data will require a significant increase of resources for DPAs and other public oversight bodies, in particular in terms of technical expertise and capabilities. Cooperation and joint investigations between all relevant public oversight bodies, including data protection supervisory authorities, should be encouraged. 5.2. Privacy preserving technologies

text: 65. The EDPS appreciates the fact that the Strategy identifies privacy preserving technologies as “crucial for the next stages of the data economy”. In the same spirit, the EDPS recalls the potential of privacy enhancing technologies (PETs) as enablers of data sharing which is both privacyfriendly and socially beneficial. 13 | P a g e

text: 66. There are a number of promising technological solutions, such as use of synthetic data, which may, inter alia, facilitate access to training data for machine learning. While there are still uncertainty and open questions related to possible feasibility and the efficacy of such solutions to mitigate data protection risks, the EDPS encourages the Commission to invest in further research and tests.

text: 67. In addition, in order to optimise the benefits of the various privacy preserving technologies, the EDPS emphasizes the importance of their standardization and interoperability. To this end, he welcomes the commitment in the Strategy for facilitation of the development of common European standards and requirements for the public procurement of data processing services and encourages the Commission to pursue further this objective. 5.3. ‘Data altruism’

text: 68. In the Strategy the Commission commits to “make it easier for individuals to allow the use of the data they generate for the public good, if they wish to do so (‘data altruism’), in compliance with the GDPR”. In relation to the concept of “data altruism”, also described as “data donation”, the EDPS considers that the added value of this notion is not entirely clear, taking into account that such ‘data altruism’ would rely on the consent of the data subject and that the GDPR already provides principles and rules on consent. Therefore, the EDPS invites the Commission to better define and lay down the scope, including the possible purposes, of such “data altruism” (for instance, data altruism for scientific research in the health sector).

text: 69. The EDPS would also like to reiterate that the fundamental right to the protection of personal data cannot in any case be ‘waived’ by the individual concerned, be it through a “donation” or through a “sale” of personal data. The data controller remains fully bound by the personal data rules and principles even when processing data that have been “donated” i.e. when consent to the processing had been given by the data subject. 5.4. Skills and digital literacy

text: 70. The EDPS welcomes the commitment of the Commission to invest in skills and general data literacy. In this regards, he would like to stress that data protection literacy is important for individuals to know their rights in general and to make informed decisions about whether or not to allow certain uses of their data. This is particularly relevant for young people who are among the most active users of digital services.

text: 71. Data protection awareness is a conditio sine qua non for ensuring that individuals’ consent is meaningful. Furthermore, data protection conscious individuals would make better use of their data subject rights and thus would push all actors in the data ecosystem to comply with the letter and the spirit of the GDPR. 5.5. International data sharing

text: 72. The EDPS welcomes the clear commitment that all companies and other organisations which sell goods or provide services related to the data economy in Europe must respect European legislatio n and this should not be compromised by jurisdictional claims from outside Europe.

text: 73. The EDPS would like to recall that all transfers of personal data to third countries or international organisations must comply with Chapter V and the other relevant provisions of the GDPR, or in the case of Union institutions and bodies, with

text: Regulation (EU) 2018/1725

text: . This obligation fully applies to cloud computing, as illustrated by the EDPS Guidelines on the use of 14 | P a g e cloud computing services by the EU institutions and bodies and the establishment of the Hague Forum - the first EU software and cloud suppliers customer council .

text: 74. The EDPS fully shares the view of the Commission that international cooperation must be based on an approach that promotes the EU’s fundamental values, including protection of privacy and personal data. The same approach is guiding the EDPS in his cooperation with other partner organisations and within international fora such as the Global Privacy Assembly.

text: 6. CONCLUSIONS

text: 75. The EDPS understands the growing importance of data for the economy and society and supports the ambition to make the European Union “the most attractive, most secure and most dynamic data-agile economy in the world”. At the same time, he would like to recall that “big data comes with big responsibility” and therefore appropriate data protection safeguards must be in place and effectively applied.

text: 76. The EDPS welcomes the Commission’s commitment to ensure that European fundamental rights and values, including the right to the protection of personal data, underpin all aspects of the Data Strategy and its implementation. In particular, he appreciates the assurance that the Strategy would be developed in full compliance with the General Data Protection Regulation, which provides a solid basis, also by virtue of its technologically-neutral approach.

text: 77. Today, the predominant business model of the digital economy is characterised by unprecedented concentration of data in the hands of a handful of powerful players, based outside the EU, and wide-scale pervasive tracking. The EDPS strongly believes that one of the most important objectives of the Data Strategy should be to prove the viability and sustainability of an alternative data economy model - open, fair and democratic. Therefore, the envisaged common European data spaces should serve as an example of transparency, effective accountability and proper balance between the interests of the data subjects and the shared interest of the society as a whole.

text: 78. The EDPS expects to be consulted on any legislative follow-up to the Data Strategy which will have an impact on data protection, as set out above, in line with Article 42 of Regulation 2018/1725, and remains at the disposal of the Commission, the Council and the European Parliament to provide further advice at the next stages of implementation of the European strategy for data, both in terms of legal framework and of practical aspects. The comments in this Opinion are without prejudice to additional comments in the future on particular issues and/or if further information is available. Brussels, 16 June 2020 Wojciech Rafał WIEWIÓROWSKI (e-signed) 15 | P a g e

text: Notes

text: 16 | P a g e


text: OJ L 119, 4.5.2016, p. 1 (hereinafter ʻGDPRʼ). OJ L 295, 21.11.2018, p. 39. OJ L 119, 4.5.2016, p. 89 (hereinafter ʻLEDʼ). See

text: Council Decision (EU) 2020/2252 of 29 December 2020

text: on the signing, on behalf of the Union, and on provisional application of the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, and of the Agreement between the European Union and the United Kingdom of Great Britain and Northern Ireland concerning security procedures for exchanging and protecting classified information, OJ L 444, 31.12.2020, p. 2 and the agreements, OJ L 444, 31.12.2020, p. 14 and OJ L 444, 31.12.2020, p. 1463. In addition, the European Atomic Energy Community (Euratom) and the UK negotiated a cooperation agreement on the safe and peaceful uses of nuclear energy. See

text: Council Decision (Euratom) 2020/2253 of 29 December 2020

text: approving the conclusion, by the European Commission, of the Agreement between the Government of the United Kingdom of Great Britain and Northern Ireland and the European Atomic Energy Community for Cooperation on the Safe and Peaceful Uses of Nuclear Energy and the conclusion, by the European Commission, on behalf of the European Atomic Energy Community, of the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, OJ L 444, 31.12.2020, p. 11. See Council Decision of 29 December 2020 on the signing, on behalf of the Union, and on provisional application of the EU-UK TCA and Security of information Agreement. See also the notice concerning the provisional application of the two agreements, OJ L 1, 1.1.2021, p.1. It is composed of representatives of the Union and of the UK and co-chaired by a member of the Commission and a representative of the UK Government. The Commission is to represent the Union. Each Member State is allowed to send one representative to accompany as part of the Union delegation. COM(2020)856. Article COMPROV.12 Essential elements and Article INST.35: Fulfilment of obligations described as essential elements. Article LAW.OTHER.136: Termination. Article LAW OTHER 137: Suspension. According to this provision, ‘relevant adequacy decision’ means: (a) in relation to the United Kingdom, a decision adopted by the European Commission, in accordance with

text: Article 36 of Directive (EU) 2016/680

text: or analogous successor legislation, attesting to the adequate level of protection; (b) in relation to the Union, a decision adopted by the United Kingdom attesting to the adequate level of protection for the purposes of transfers falling within the scope of Part 3 of the Data Protection Act 2018 or analogous successor legislation. ln relation to the suspension of Title Ill [Transfer and processing of PNR data] or Title X [Anti-money laundering and counter terrorist financing], references to a "relevant adequacy decision" also include: (a) in relation to the United Kingdom, a decision adopted by the European Commission, in accordance with Article 45 of the General Data Protection

text: Regulation (EU) 2016/679

text: or analogous successor legislation attesting to the adequate level of protection; (b) in relation to the Union, a decision adopted by the United Kingdom attesting to the adequate level of protection for the purposes of transfers falling within the scope of Part 2 of the Data Protection Act 2018 or analogous successor legislation. http://trade.ec.europa.eu/doclib/docs/2018/july/tradoc_157130.pdf https://ec.europa.eu/commission/presscorner/detail/en/MEX_18_546 See Article DIGIT.7(1). According to footnote 34 of the TCA, for ʻgreater certainty, “conditions of general application” refer to conditions formulated in objective terms that apply horizontally to an unidentified number of economic operators and thus cover a range of situations and casesʼ. Article 2(2) of the horizontal provisions. Article EXC.1: General exceptions (2) (c) (ii). Article X(3) of the horizontal provisions. Article LAW.GEN2.

text: Article LAW. GEN 4 provides only that: ʻ[t]o reflect that high level of protection, the Parties shall ensure that personal data processed under this Part is subject to effective safeguards in the Parties’ respective data protection regimes, including that: [...] (f) onward transfers to a third country are allowed only subject to conditions and safeguards appropriate to the transfer ensuring that the level of protection is not underminedʼ. See in this regard EDPS Opinion 2/2020 on the opening of negotiations for a new partnership with the UK, page 11: ʻhe recommends carefully assessing the issue of onward transfers of personal data for both the economic and the security partnerships, including in the context of the processing of DNA, fingerprints and vehicle registration data (Prüm), and not only in the framework of the processing of PNR dataʼ. See Recitals 104 GDPR and 67 LED. Declarations referred to in the Council Decision on the signing on behalf of the Union, and on a provisional application of the Trade and Cooperation Agreement and of the Agreement concerning security procedures for exchanging and protecting classified information, OJ L 444, 31.12.2020, p. 1475. See EDPS Opinion 2/2020 on the opening of negotiations for a new partnership with the UK, section 3. CJEU Judgment (Grand Chamber) of 16 July 2020, Facebook Ireland and Schrems, case

text: , ECLI:EU:C:2020:559. Article INST.10: Scope, paragraph 2 (i). CJEU Opinion 1/15 (Grand Chamber) of 26 July 2017, ECLI:EU:C:2017:592.

text: Directive (EU) 2016/681

text: of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, OJ L 119, 4.5.2016, p. 132. See Article LAW.PNR.19: Definitions of the TCA: ʻ(f) “serious crime” means any offence punishable by a custodial sentence or detention order for a maximum period of at least three years under the domestic law of the United Kingdomʼ. See the following pending preliminary references cases before the CJEU,

text: and

text: Regulation (EU) 2016/794

text: of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA, OJ L 135, 24.5.2016, p. 53.

text: Regulation (EU) 2018/1727

text: of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council Decision 2002/187/JHA, OJ L 295, 21.11.2018, p. 138. Emphasis added. OJ L 210, 6.8.2008, p. 1.

identifier: EDPS yttrande 03/2021

title: EDPS Opinion on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement

text: 22 February 2021 1 | P a g e

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’ and under Article 57(1)(g), the EDPS shall ‘advise on his or her own initiative or on request, all Union institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the EDPS' mission to advise the EU institutions on coherently and consistently applying the EU data protection principles, including when negotiating agreements with third countries. It builds on the general obligation that international agreements must comply with the provisions of TFEU and the respect for fundamental rights that stands at the core of EU law. In particular, compliance with Articles 7 and 8 of the Charter of Fundamental Rights of the EU and Article 16 TFEU must be ensured.

text: 2 | P a g e

text: Executive Summary

text: On 26 December 2020, the European Commission adopted a proposal for a Council Decision on the conclusion, on behalf of the Union, of the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, and of the Agreement between the European Union and the United Kingdom of Great Britain and Northern Ireland (UK) concerning security procedures for exchanging and protecting classified information.

text: Given the close cooperation that is expected to continue between the EU and the UK, the EDPS welcomes the agreements signed between the Union and the UK on trade and cooperation and concerning security procedures for exchanging and protecting classified information. In particular, he is very much satisfied that one of the essential elements of the trade and cooperation agreement (TCA) is the respect for and safeguarding of human rights. He also welcomes the Parties’ commitment in the TCA to ensuring a high level of personal data protection.

text: The EDPS is aware of the particular conditions under which these agreements have been negotiated and of the specific past and future relationship between the UK and the EU.

text: As far as the provisions on trade are concerned, the EDPS regrets that the TCA fails to

text: faithfully take over the horizontal “EU provisions on Cross-border data flows and protection of personal data and privacy in the Digital Trade Title of EU trade agreements”

text: endorsed by the European Commission in 2018. Indeed, the changes introduced to these horizontal provisions, combined with other provisions of the TCA cast doubt, in the field of digital trade, on the preservation of EU autonomy as far as the fundamental rights to data protection and privacy are concerned.

text: The EDPS has long taken the view that, as the protection of personal data is a fundamental right in the Union, it cannot be subject to negotiations in the context of EU trade agreements. It is for the EU alone to decide how to implement fundamental rights protections in Union law. The Union cannot and should not embark on any international trade commitments that are incompatible with its domestic data protection legislation. Dialogues on data protection and trade negotiations with third countries can complement each other but must follow separate tracks. Personal data flows between the EU and third countries should be enabled by using the mechanisms provided under the EU data protection legislation. Therefore, the EDPS invites the Commission to reiterate its commitment to the horizontal provisions as the only basis for future trade agreements by the EU with third countries and that personal data protection and privacy rights will not be up for negotiation.

text: As far as law enforcement and judicial cooperation in criminal matters are concerned, the EDPS praises the Commission for the safeguards introduced in the TCA regarding data protection, which are all the more important given the sensitivity of this cooperation. At the same time, he regrets that certain safeguards are missing both in the general provisions, which neither contain a categorisation of data subjects as set out in Article 6 of the Law Enforcement Directive nor more detailed and robust safeguards with regard to onward transfers and in the Prüm section in particular. He also would have wished the transitional period for the passenger name record data erasure be shorter than the possible 3 years and a list of serious crimes be included. He further recommends ensuring that any future changes in the Prüm framework between EU Member States leading to additional safeguards be fully reflected into the agreement and actually implemented by both parties.

text: 3 | P a g e

text: Concerning the interim provision for transmission of personal data from the EU to the UK, the EDPS underlines that this mechanism should remain exceptional and should not set a precedent for future TCAs with other third countries.

text: The EDPS expects to be consulted on any proposals or recommendations to the Council pursuant to Article 218 TFUE on the opening of negotiations for any subsequent supplementing agreements where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data.

text: Finally, the TCA appears to be drafted based on the assumption that adequacy decisions under GDPR and LED will be granted (and will remain in place for the foreseeable future). The EDPS therefore wishes to remind of his recommendation from Opinion 2/2020 that the Union take steps to prepare for all eventualities, including where no adequacy decision would be adopted at all, or where it would be adopted only in relation to some areas.

text: 4 | P a g e

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof, Having regard to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) , Having regard to

text: Regulation (EC) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular

text: Article 42(1)

text: , thereof, Having regard to

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA ,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION

text: 1. On 30 December 2020, the European Union (EU) and the United Kingdom of Great Britain and Northern Ireland (UK) signed a trade and cooperation agreement (ʻTCAʼ) and an agreement concerning security procedures for exchanging and protecting classified information .

text: 2. The agreements have been applicable on a provisional basis since 1 January 2021, pending the completion of the procedures necessary for their entry into force . According to the TCA, this provisional application will cease at the latest on 28 February 2021 or another date as decided by the Partnership Council .

text: 3. On 25 January 2021, the European Commission consulted the EDPS on its proposal for a Council Decision on the conclusion with the United Kingdom of Great Britain and Northern Ireland of these two agreements (hereinafter ‘the Proposal’) , in accordance with

text: Article 42(1) of Regulation (EU) No 2018/1725

text: . The Annexes to the Proposal contain the two agreements.

text: 4. The Proposal is based on the procedure laid down in Articles

text: and

text: Article 218(7)

text: and second subparagraph of Article 218(8) of the Treaty on the Functioning of the European Union (TFEU). It therefore requires the consent of the European Parliament. 6 | P a g e

text: 5. The agreement concerning security procedures for exchanging and protecting classified information does not raise comments as far as the protection of personal data is concerned. The following comments therefore focus on the TCA. The TCA is composed of seven parts (plus a number of annexes and three protocols): Part One on common and institutional provisions; Part Two on trade (including digital trade), transport, fisheries and other arrangements; Part Three on law enforcement and judicial cooperation in criminal matters; Part Four on thematic cooperation; Part Five on participation in Union programmes, sound financial management and financial provisions; Part Six on dispute settlement and horizontal provisions; and Part Seven on final provisions.

text: 2. GENERAL COMMENTS

text: 2.1. The EDPS consultation

text: 6. The EDPS welcomes this consultation and would welcome the inclusion in the preamble of the Council Decision a reference to a consultation of the EDPS, as it is the case for other legal acts where such consultation is mandatory.

text: 7. He expects to be consulted on any proposals or recommendations to the Council pursuant to

text: Article 218

text: TFUE on the opening of negotiations for any subsequent supplementing agreements where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data, as provided for under

text: 8. The EDPS regrets that he was not consulted on the proposal for a Council Decision to sign these agreements, in accordance with

text: . He trusts however that this will remain an exceptional case which will not set a precedent for other on-going and future negotiations having an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data. 2.2. Human rights

text: 9. The EDPS welcomes Article COMPROV.4 of the TCA by which the Parties commit to continue to uphold the shared values and principles of respect for human rights, which underpin their domestic and international policies and reaffirm their respect for the Universal Declaration of Human Rights and the international human rights treaties to which they are parties. He welcomes also that this provision is deemed an essential element of the TCA, so that one party may decide to terminate or suspend the operation of the TCA or any supplementing agreement in whole or in part in case of a serious and substantial failure by the other Party to fulfil its obligations under this provision . 7 | P a g e

text: 10. Furthermore, in Part Three concerning law enforcement and Judicial cooperation in criminal matters, the EDPS welcomes Article LAW.GEN.3 on the protection of human rights and fundamental freedoms, which specifically refers to the European Convention of Human Rights and the Charter of fundamental rights of the EU (hereinafter ʻthe Charterʼ) and to the specific termination mechanism for this this part in case one party denounces the European Convention of Human Rights . The EDPS considers also positively the provision on a specific mechanism to suspend this part in the event of serious and systematic deficiencies as regards the protection of fundamental rights or the principle of the rule of law and that it expressly provides that this includes, as regards the protection of personal data, cases where those deficiencies have led to a relevant adequacy decision ceasing to apply. 2.3. The TCA and data protection rules

text: 11. The EDPS praises the negotiators for introducing under Article COMPROV.10 of Part One of the TCA a provision whereby the Parties affirm their commitment to ensuring a high level of personal data protection, recognise that individuals have a right to privacy and to protection of personal data and undertake to respect, each in the framework of their respective laws and regulations, the commitments they have made in this Agreement in connection with that right. 2.3.1. Digital trade and the protection of personal data

text: 12. The EDPS takes note of the set of provisions included within Part two of the TCA on trade, transport, fisheries and other arrangements, under Heading I: Trade, Title III: Digital trade, in particular Article DIGIT.3 on the right to regulate, Article DIGIT.6 on cross-border data flows and Article DIGIT.7 on protection of personal data and privacy.

text: 13. While the EDPS welcomes the Union negotiators’ endeavours to ensure that the EU data protection legal framework remains unaffected by trade-related provisions, the EDPS regrets that the TCA fails to faithfully take over the horizontal “EU provisions on Crossborder data flows and protection of personal data and privacy in the Digital Trade Title of EU trade agreements” endorsed by the European Commission in 2018 (‘horizontal provisions’) . In amending the legal wording of the horizontal provisions, the TCA unnecessarily creates legal uncertainty as to the Union’s position on the protection of personal data in connection with EU trade agreements and risks creating friction with the EU data protection legal framework. 8 | P a g e

text: 14. The EDPS has long taken the view that, as the protection of personal data is a fundamental right in the Union, it cannot be subject to negotiations in the context of EU trade agreements. It is for the EU alone to decide how to implement fundamental rights protections in Union law. The Union cannot and should not embark on any international trade commitments that are incompatible with its domestic data protection legislation. Dialogues on data protection and trade negotiations with third countries can complement each other but must follow separate tracks. Personal data flows between the EU and third countries should be enabled by using the mechanisms provided under the EU data protection legislation.

text: 15. The EDPS supports the horizontal provisions endorsed by the European Commission in 2018, as the best outcome achievable to preserve individual’s fundamental rights to data protection and privacy. The horizontal provisions reach a balanced compromise between public and private interests as they allow the EU to tackle protectionist practices in third countries in relation to digital trade, while ensuring that trade agreements cannot be used to challenge the high level of protection guaranteed by the Charter and the EU legislation on the protection of personal data. Furthermore, the Commission has repeatedly stated that these horizontal provisions are not up for negotiation .

text: 16. The EDPS therefore regrets that the legal wording of the horizontal provisions was modified in the TCA. Besides not referring to the right to data protection as a fundamental right , the provision no longer states that ‘[e]ach Party may adopt and maintain the safeguards it deems appropriate to ensure the protection of personal data and privacy, including through the adoption and application of rules for the cross-border transfer of personal data’. In the TCA, this unconditional wording contained in Article 2 of the horizontal provisions has been replaced by Article DIGIT. 7(2) which merely reaffirms the possibility for a Party to adopt or maintain measures on the protection of personal data or privacy, including on cross-border data transfers, but conditioned on providing for ʻinstruments enabling transfers under conditions of general application for the protection of personal dataʼ. While this new clause seems to mirror the right to regulate (mentioned in Articles DIGIT.3 and GRP.1 of the TCA), the wording in Article DIGIT. 7(2) does not fully safeguard how the EU regulates the protection of personal data and privacy. This clause effectively means the TCA regulates what a law applying to data transfers should look like.

text: 17. In addition, the provision no longer states that ʻ [n]othing in this agreement shall affect the protection of personal data and privacy afforded by the Parties’ respective safeguards’ . Article 2 of the horizontal provisions was meant to ensure that if EU laws protecting privacy and related to data protection were challenged in a trade dispute, the EU would not need to justify its data protection and privacy laws under strict tests based on Article XIV of the General Agreement on Trade in Services. Furthermore, Article DIGIT. 4 of the TCA specifically provides for the application of Article EXC.1 on General exceptions thereof also in relation to digital trade: Article EXC.1 (2) (c) makes the adoption or enforcement of measures for the protection of personal data and privacy subject to two conditions: first, 9 | P a g e ‘such measures are not applied in a manner which would constitute a means of arbitrary or unjustifiable discrimination between countries where like conditions prevail, or a disguised restriction on investment liberalization or trade in services,’ and second, that these measures are ‘necessary to secure compliance with laws or regulations which are not inconsistent with the [TCA], including those relating to [...] ii) the protection of privacy in relation to the processing and dissemination of personal data and protection of confidentiality of individual records and accounts [...]ʼ . It therefore appears not to be excluded that the EU’s autonomy is limited in this regard and could e.g. mean that a party may not adopt or enforce personal data rules which would go against the prohibition of data localisation obligation under Article DIGIT.6 cross-border data flows. As a consequence, contrary to the horizontal provisions, the wording of the TCA does not seem to prevent the EU from having to pass strict trade tests to justify its measures safeguarding the fundamental rights to privacy and personal data protection.

text: 18. This raises all the more concerns given that, contrary to the approach of the horizontal provisions, the TCA does contain specific provisions on the transfers of personal data. Article COMPROV.10 (4) provides indeed that, in case of conflict, these provisions supersede the transferring Party’s rules on international transfers of personal data. It refers however merely as an example to Article DIGIT. 7, without clearly listing all the provisions of the TCA to be deemed specific provisions on the transfers of personal data. In addition, despite the wording “without prejudice” in Article COMPROV.10 (4), the operational relationship between Article DIGIT.7 and Article COMPROV.10 remains unclear.

text: 19. Also, while the horizontal provisions made clear that provisions on regulatory dialogue and cooperation on regulatory issues with regard to digital trade ‘should not apply to a Party’s rules and safeguards for the protection of personal data and privacy, including on crossborder data transfers of personal data’ , on the contrary the TCA now specifically empowers the Partnership Council to ‘make recommendations to the Parties regarding the transfer of personal data in specific areas covered by this Agreement or any supplementing agreement’ (Article INST.1 (4) (h)).

text: 20. The EDPS is concerned that these provisions create uncertainty as to the possibility for the EU to autonomously apply fully its domestic rules on personal data protection, in particular as regards transfers of personal data in its relation to the UK.

text: 21. At the same time, the EDPS understands that the TCA is based on a unique relationship between the EU and the UK. Also, UK data protection law to a large extent mirrors EU data protection law, at the time of the adoption of this opinion, which is not the case for other EU trading partners. Therefore, the EDPS underlines that the wording agreed with the UK on data protection and privacy must remain an exception and insists that the Commission should remain committed to the horizontal provisions.

text: 22. To make this approach clear to all stakeholders and trading partners, the EDPS therefore invites the Commission to clearly reiterate its commitment to the horizontal provisions as 10 | P a g e the only basis for future trade agreements by the EU with other third countries, and that personal data protection and privacy rights will not be up for negotiation. 2.3.2. Law enforcement and the protection of personal data

text: 23. Regarding Part Three of the TCA on law enforcement and Judicial cooperation in criminal matters, the EDPS welcomes that it contains definitions of concepts used under data protection law which are aligned with EU secondary law so as to ensure a stable basis for the cooperation between the EU and the UK, preventing each Party from unilaterally changing these concepts in its domestic law. For the same reason, the EDPS also very much supports the non-exhaustive list of safeguards provided for under Article LAW.GEN.4 on the protection of personal data. At the same time, the EDPS regrets that the need to apply the obligations of data-protection-by-design and -by-default for any new personal data processing operation is not explicitly mentioned. He also regrets that the TCA does not include among the list of safeguards, the categorisation of data subjects set out in

text: Article 6

text: LED and does not set out more detailed and robust safeguards with regard to onward 19 20 transfers , stemming in particular from the CJEU case-law such as opinion 1/15 .

text: 24. Finally, the EDPS considers positively Article LAW.GEN 4, which provides for the cooperation obligation of the supervisory authorities to ensure compliance with this Part and that both parties notify the Specialised Committee on Law Enforcement and Judicial Cooperation of the supervisory authorities responsible for overseeing the implementation of, and ensuring compliance with, data protection rules applicable to cooperation under this Part. This is all the more important given that, in the framework of the adequacy assessment under the GDPR and the LED, the third country should provide for cooperation mechanisms with the Member States' data protection authorities . 2.4. The TCA is not an adequacy decision

text: 25. The EDPS welcomes the fact that the TCA does not contain any provision that would change the nature of an adequacy assessment under the GDPR and the LED i.e. a unilateral procedure within the EU requiring the consultation of the EDPB and the adoption of a decision by the European Commission under the GDPR and under the LED.

text: 26. The EDPS takes note of the political declaration annexed to the TCA by which ‘the Parties take note of the European Commission’s intention to promptly launch the procedure for the adoption of adequacy decisions with respect to the UK under the General Data Protection Regulation and the Law Enforcement Directive, and its intention to work closely to that end with the other bodies and institutions involved in the relevant decision-making procedure’ .

text: 27. In this regard, the EDPS notes that the TCA appears to be drafted based on the assumption that adequacy decisions under GDPR and LED will be granted (and will remain in place for the foreseeable future). He therefore wishes to remind of his recommendations from Opinion 2/2020 that the Union take steps to prepare for all eventualities, including where no adequacy decision would be adopted at all, or where it would be adopted only in relation to some areas . 11 | P a g e 2.5. The interim provision for transmission of personal data to the United Kingdom

text: 28. The EDPS takes note of the interim provision for transmission of personal data to the UK set out in Article FINPROV.10A of the TCA (‘bridge mechanism’) according to which, during an interim provision of not later than 6 months, transmissions of personal data to the UK are not considered as transfers under the EU law. The bridge mechanism has the effect of de facto ensuring a free flow of personal data to the UK as if it were still a Member State, without the corresponding procedural safeguards - such as the GDPR ‘one-stop-shop’ mechanism or the supervision by the CJEU - which exist within the EU between the Member States and which were still applicable to the UK when applying EU data protection law during the transitional period. In addition, as a transmission to the UK during this interim period is deemed not to be a transfer, it would seem that this wording could be read as preventing a Member State’s data protection supervisory authority to suspend or ban such transmission to the UK, based on grounds applying to transfers under EU law as interpreted by the CJEU, and in particular its last Schrems II judgment , putting the UK in an even more privileged position than the one of an adequate third country. Equally, this raises issues regarding the protection of data subjects in case for instance of onward transfers of personal data to a third country where, at the same time, a Member State data protection supervisory authority would have suspended or banned transfers from the EU to the same third country on the basis that it does not comply with the requirements set out in EU data protection law as interpreted by the CJEU.

text: 29. Finally, it is to be noted that Title I [Dispute Settlement] of Part Six on the interpretation and application of the TCA does not apply to this provision .

text: 30. On this basis, it is therefore unclear which procedural mechanisms would be available during this interim period to compensate for the lack of effective powers of Member States’ data protection supervisory authorities, as well as the lack of CJEU jurisdiction.

text: 31. While the EDPS is aware of the particular relationship between the EU and the UK as a former EU Member State, as well as of the specific conditions under which the TCA was negotiated, he stresses that such mechanism should remain exceptional and should not set a precedent for future TCAs with other third countries.

text: 3. INTERNATIONAL COOPERATION IN SPECIFIC AREAS

text: 3.1 Passenger Name Record data

text: 32. The EDPS welcomes the fact that the provisions of the TCA related to Passenger Name Record data (PNR data) reflect Opinion 1/15 of the CJEU . He understands that, still, the TCA does not, on its own, constitute a legal ground for transfer of PNR data from the EU to the UK. However, he notes that, on one of the most controversial elements from law enforcement perspective that is the immediate erasure of PNR data of passengers departing from the UK, a transitional period of up to 3 years has been foreseen and regrets that no agreement could be found on a shorter transitional period.

text: 33. The EDPS also expresses regret that, unlike the PNR Directive , the concept of "serious crime" is not defined through a common agreed list of criminal offences which would have provided more legal certainty, but is based instead on UK law only . 12 | P a g e

text: 34. He recommends following closely the preliminary references pending before the CJEU on the interpretation of the PNR Directive in light of Articles

text: and

text: and the first paragraph of Article 52 of the Charter so as to adjust, as far as necessary and as the case may be, the provisions of the TCA on PNR so as to ensure its full compliance with Articles 7, 8 and 52 of the Charter. 3.2 Europol, Eurojust and Prüm

text: 35. The EDPS understands that the TCA does not, on its own, constitute a legal ground for transfer of personal data from Europol or Eurojust to the UK within the meaning of

text: Article 30

text: 31 25 of the Europol Regulation and Article 58 of the Eurojust Regulation .

text: 36. With regard to Prüm, the EDPS notes that under Article LAW.PRUM 19 (1), ʻin the event that the Union considers it necessary to amend this Title because Union law relating to the subject matter governed by [Title II: Exchanges of DNA, fingerprints and vehicle registration data] is amended substantially, or is in the process of being amended substantially, it may notify the United Kingdom accordingly with a view to agreeing on a formal amendment of this Agreement in relation to this Title. Following such notification, the Parties shall engage in consultationsʼ . In this regard, the EDPS recommends ensuring that any further changes leading to additional safeguards in the Prüm framework between EU Member States be fully reflected in the agreement and actually implemented by both parties. The EDPS furthermore regrets that the specific provisions on purpose limitation under Article 26 of the Council Decision 2008/615/JHA of 23 June 2008 on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime as well as the provisions on accuracy, current relevance and storage time of data under

text: Article 28

text: thereof were not included in the TCA, as they provide helpful guidance on the treatment of the specific categories of data.

text: 4. CONCLUSIONS

text: 37. The EDPS welcomes the agreements found between the EU and the UK on trade and cooperation and concerning security procedures for exchanging and protecting classified information. In particular, he is very much satisfied that one of the essential elements of the TCA is the respect for and safeguarding of human rights. He also welcomes the Parties’ commitment in the TCA to ensuring a high level of personal data protection.

text: 38. As far as trade is concerned however, the changes made to the 2018 European Commission horizontal provisions combined with other provisions of the TCA cast doubt, in the field of digital trade, on the preservation of EU autonomy as far as the fundamental rights to data protection and privacy are concerned. The EDPS recommends therefore that the wording agreed with the UK on data protection and privacy remains an exception and is not the basis for future trade agreements with other third countries. To make this approach clear to all stakeholders and trading partners, the EDPS therefore invites the Commission to clearly reiterate its commitment to the horizontal position as the only basis for future trade agreements by the EU with other third countries, and that personal data protection and privacy rights will not be up for negotiation. 13 | P a g e

text: 39. As far as law enforcement and judicial cooperation in criminal matters are concerned, the EDPS praises the Commission for the safeguards introduced in the TCA regarding data protection, which are all the more important given the sensitivity of this cooperation. He regrets however that it neither contains a categorisation of data subjects as set out in Article 6 of the LED nor more detailed and robust safeguards with regard to onward transfers. While welcoming that the PNR provisions reflect the CJEU Opinion 1/15, the EDPS regrets that it was neither possible to agree on a shorter transitional period for the erasure of PNR data, nor on a common list defining serious crimes. He also recommends ensuring that any further changes leading to additional safeguards in the Prüm framework between EU Member States be fully reflected into the agreement and actually implemented by both parties and regrets that the specific EU provisions on purpose limitation and on accuracy, current relevance and storage time of data were not included in the TCA.

text: 40. Concerning the bridge mechanism, the EDPS stresses that such mechanism should remain exceptional and should not set a precedent for future TCAs with other third countries.

text: 41. The EDPS expects to be consulted on any proposals or recommendations to the Council pursuant to

text: Article 218

text: 42. The EDPS further notes that the TCA appears to be drafted based on the assumption that adequacy decisions under GDPR and LED will be granted (and will remain in place for the foreseeable future). He therefore wishes to remind of his recommendations from Opinion 2/2020 that the Union take steps to prepare for all eventualities, including where no adequacy decision would be adopted at all, or where it would be adopted only in relation to some areas. Brussels, 22 February 2021 Wojciech Rafał WIEWIÓROWSKI (e-signed) 14 | P a g e

text: Notes

text: 15 | P a g e

text: 16 | P a g e

type: vagledning

utgivare: edps