text: OJ L 281, 23.11.1995, p. 31. 2 OJ L 201, 31.7.2002, p. 37. 3 OJ L 8, 12.1.2001, p. 1. 4 COM (2013) 627 final. Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, 'A Digital Agenda for Europe,' COM (2010) 245 final/2, 26.08.2010.

text: See, on IP addresses,

text: Case C-70/10

text: Scarlet v SABAM [2011] ECR I-11959, para. 51 and on communications content, by analogy,

text: Case C-360/10

text: SABAM v Netlog [2012] ECR I-00000, para. 49.

text: EDPS Opinion on net neutrality, traffic management and the protection of privacy and personal data, 7 October 2011, p. 2. 8 While this subsection addresses the aspect of transparency in relation to the text of the proposal itself, transparency requirements for the pre-contractual and contractual information provided to end-users will be discussed in points 25-33 below. 9 For an overview of techniques used to inspect information transmitted over the Internet, see EDPS Opinion on net neutrality, op.cit, pp. 8-9. 10 Cf EDPS Opinion on net neutrality, op.cit, p. 8.

text: Case C-70/10

text: Scarlet v SABAM, op. cit., paras. 39, 51 and 53. 12 See e.g. EDPS Opinion on net neutrality, op. cit., p.13.

text: See EDPS Opinion on net neutrality, op. cit., pp. 13-14; Cf.

text: Article 29

text: Working Party Opinion 15/2011 on the definition of consent, 13 July 2011,

text: , pp. 12-13.

text: See, by analogy, Joined cases

text: and 93/09 Volker und Markus Schecke [2010] ECR I-11063, para. 53.

amnesord: Electronic Communications, Information Society

title: European single market for electronic communications

text: Opinion of the European Data Protection Supervisor

text: on the Proposal for a Regulation of the European Parliament and of the Council laying down measures concerning the European single market for electronic communications and to achieve a Connected Continent, and amending Directives

text: and

text: and Regulations

text: (EC) No 1211/2009

text: and

text: (EU) No 531/2012

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular

text: Article 16

text: thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles

text: and

text: thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

text: Having regard to Directive

text: of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular

text: Article 28(2)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION 1.1. Consultation of the EDPS

text: 1. On 11 September 2013, the Commission adopted a Proposal for a Regulation laying down measures concerning the European single market for electronic communications and to achieve a Connected Continent, and amending Directives

text: and

text: and Regulations

text: (EC) No 1211/2009

text: and

text: (EU) No 531/2012

text: (hereinafter - 'the proposal') . A request for consultation was sent by the

text: 2. The EDPS had an opportunity to provide his advice before the proposal was adopted, which he welcomes. This Opinion builds on the comments provided within the context of that informal consultation. 1.2. Context and objectives of the proposal

text: 3. The proposal is adopted against the background of the Digital Agenda for Europe , having as its overarching goal the enhancement of economic growth and social improvements derived from the European digital economy. The proposal is thus aimed at achieving a single market for electronic communications in the EU by harmonising various legal and technical aspects relating to the provision of electronic communications services to the public.

text: 4. The proposal, firstly, facilitates the provision of cross-border electronic communications services by enabling providers to offer services across the Union based on a single EU authorisation and thus with minimum administrative hurdles. It further harmonises the conditions of radio spectrum assignment for WiFi services, as well as the features of products allowing virtual access to fixed networks.

text: 5. Next, the proposal harmonises the rights of end-users, inter alia those relating to the open Internet. It also harmonises publication by providers of information on electronic communications services they offer and the inclusion of such information in contracts, as well as the modalities of switching an operator and charges applicable to roaming services.

text: 6. The present Opinion focuses on those aspects of the proposal which are likely to have the most significant effect on the rights to privacy and the protection of personal data as laid down in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, as well as on the confidentiality of communications.

text: 2. GENERAL COMMENTS

text: 7. Within the past decade, the Internet has infiltrated all aspects of everyday life, including personal communications, education and work, with the types of content, applications and services available to end-users dramatically increasing as well. In that context, end-users' right to benefit from an open Internet, where information can be freely accessed and transmitted, should remain a general rule.

text: 8. In that respect, the EDPS welcomes the inclusion of the principle of a free access to and distribution of content, applications and services by end-users - 'net neutrality' - in the proposal. However, the EDPS is concerned that the proposal provides a number of grounds for traffic management measures that scan and discriminate among various types of content. Such measures significantly limit net neutrality and interfere with end-users' rights to privacy and the protection of personal data, as laid down in the

text: 9. The EDPS emphasises that adherence to the rights to confidentiality of communications, privacy and personal data protection is a key part of building consumer trust and confidence in the EU electronic communications market, and thus its success. End-users need to be certain that these rights are respected whenever they make use of electronic communications services and networks, and that any interference with these rights is proportionate and necessary to achieve a clearly specified legitimate purpose. The EDPS underlines that such grounds for instituting traffic management as 'implementing a legislative provision' and 'preventing and impeding serious crimes', foreseen in

text: Article 23(5)

text: (a) of the proposal, appear overly broad and have a considerable potential to trigger a wide-scale, preventive monitoring of communications content. A surveillance of this kind will not only go contrary to the right to confidentiality of communications, as well as privacy and personal data protection, but furthermore may seriously undermine consumer confidence in electronic communications services across the Union.

text: 10. While any measures allowed under the proposal that interfere with end-users' data protection and privacy rights should be subject to strict proportionality and necessity limitations, the EDPS emphasises that transparency, as further developed in this Opinion, is another key requirement for such measures. In relation to traffic management, for instance, clear and adequate pre-contractual and contractual information would enhance consumer choice, allowing end-users to opt for the services of those providers which apply less privacy-intrusive communications inspection techniques within the context of traffic management.

text: 11. The supervision of compliance, by electronic communications providers, with the requirements of transparency, proportionality and necessity when instituting privacyintrusive measures such as traffic management is crucial to ensuring the effectiveness of these safeguards in practice. In that regard, the role of national regulatory authorities in supervising providers' compliance with net neutrality and assessing the quality of pre-contractual information should be complemented by that of the national data protection authorities, which can add specific expertise to this oversight and thus contribute to its overall effectiveness.

text: 3. SPECIFIC COMMENTS 3.1. Applicability of the EU data protection framework

text: 12. The proposal regulates the provision of electronic communications services across the EU. Such services are subject to the requirement of confidentiality of communications, while they further entail the processing of IP addresses and communications content, which both are related to end-users and thus commonly constitute personal data. Directives

text: and

text: are thus applicable to the processing of data envisaged under the proposal. The EDPS recommends that this be clarified in a substantive provision of the proposal, which should not be seen as derogation from EU data protection instruments.

text: 13. In this connection, the EDPS further notes that recital 46 of the proposal states that the latter defines the limits of the restrictions that may be imposed on the right of endusers to benefit from net neutrality by providers of electronic communications to the public, yet is 'without prejudice to other Union legislation, including copyright rules and Directive

text: '. The EDPS recommends complementing this text with a specific reference to Directives

text: and

text: , which define the limits to traffic management measures from the data protection and privacy perspective. 3.2. Net neutrality and traffic management measures

text: 14. Article 23(1) of the proposal grants end-users the right to freely access and distribute content, services and applications of their choice via their Internet access service, thus laying down the principle of net neutrality. Net neutrality has as its basis the impartiality of Internet service providers towards the different types of information accessed and transmitted by end-users, and thus the absence of discrimination in the quality of Internet access services based on the content, source or destination of such 7 information.

text: 15. Net neutrality does not only encourage the freedom to impart and receive information and access to culture - where this principle is observed, risks of surveillance of endusers' Internet activity, based on the information they access or transmit, are minimised. In that regard, EDPS welcomes the inclusion of net neutrality in Article 23(1) of the proposal as the general principle applicable to Internet use in the Union.

text: 16. This notwithstanding, the EDPS points out that the proposal should not leave endusers unaware of the measures that might restrict them in benefiting from the open Internet. This is all the more crucial as, by way of exception from

text: Article 23(1)

text: , Article 23(5) of the proposal provides for 'reasonable traffic management measures', under which ISPs could discriminate against, degrade, slow down or block traffic, but does not provide information on communication inspection techniques that underlie such measures.

text: 17. The EDPS notes that traffic management measures based on techniques such as Deep Packet Inspection (DPI) presuppose a detailed analysis of the content of information transmitted over the Internet, which may thus reveal substantial and detailed 9 information about users. Should traffic management measures be based on less intrusive communications inspection techniques, such as those that analyse IPheaders, they would nevertheless reveal information on the websites visited by endusers, and thus allow inferring the content of their communications. Communications content may include information on individuals' political views, religious beliefs, or health or sex life, and thus its analysis - both directly and via the IP headers - may entail processing of sensitive data within the sense of

text: Article 8(1) of Directive 95/46/EC

text: . In order to provide certainty for end-users on the data protection and privacy impact of traffic management measures,

text: Article 23(5)

text: should thus provide clear information on communications inspection techniques that are allowed to be used within the context thereof.

text: 18. Next, any traffic management measures instituted on the basis of the proposal should be subject to strict proportionality and necessity limitations. The EDPS notes that Article 23(5) of the proposal lists the grounds on which traffic management measures could be instituted. These grounds include 'implementing a legislative provision' and 'preventing and impeding serious crimes' (

text: Article 23(5)

text: (a)). The EDPS is concerned about the reference to these two grounds as a possible basis for instituting traffic management measures.

text: 19. As regards the ground of 'implementing a legislative provision', the EDPS notes that Article 23(3) of the proposal explicitly provides that this provision is 'without prejudice to Union or national legislation related to the lawfulness of the information, content, application or services transmitted'. Read in conjunction with the implementation of a legislative provision as a ground for traffic management this would, essentially, give green light to discriminating against, degrading or blocking any content deemed unlawful under the EU or national legislation. Given both the overly broad scope of traffic management measures that may be instituted under this ground and the fact that they may entail the processing of sensitive data, the EDPS emphasises that such measures would disproportionately affect end-users' rights to confidentiality of communications, privacy and data protection, going contrary to Articles 7 and 8 of the EU Charter of Fundamental Rights, as well as

text: Article 5(1) of Directive 2002/58/EC

text: and Directive

text: . The EDPS thus considers it an absolute necessity that the ground of implementing a legislative provision is excluded from the text of the proposal.

text: 20. In relation to the ground of preventing or impeding serious crimes, the EDPS emphasises that

text: Article 23(5)

text: (a) already provides for traffic management measures for the purposes of implementing a court order - thus, allowing such measures in specific cases where, inter alia, serious crime may be at stake. Preventing or impeding serious crimes is a much broader purpose, which could trigger wide-scope traffic management measures used for preventive and potentially systematic analysis of communications content. This is, as the Court of Justice stated in Scarlet v SABAM, contrary to the fundamental right to personal data protection , as well as privacy and confidentiality of communications. For this reason, and in view of the fact that

text: Article 23(5)

text: (a) already allows for traffic management within the context of specific legal proceedings, the EDPS strongly recommends removing the reference to preventing or impeding serious crimes from

text: Article 23(5)

text: (a) of the proposal.

text: Article 23(5)

text: (c) provides for a further ground of traffic management - namely, preventing the transmission of unsolicited communications to end-users based on their prior consent. In that regard, the EDPS recalls that such consent should be informed, specific and unambiguous, as well as freely given. In the case at hand, a freely given consent entails a situation where, in case end-users do not agree to traffic management for the purposes of preventing the transmission of unsolicited communications, this does not prevent them from benefiting from the services of a particular electronic communications service provider. The EDPS recommends that principles applying to end-user consent are reiterated in a recital to the proposal.

text: 22. The EDPS welcomes the fact that

text: Article 23(5)

text: , last subparagraph, states that reasonable traffic management allowed by the proposal 'shall only entail processing of the data that is necessary and proportionate to achieve the purposes set out in [that same provision]'. In that regard, the EDPS notes that, in a number of cases, processing of IP headers may provide sufficient basis for discriminating, for instance, among various types of content accessed by end-users, while being less privacy-intrusive than a full communications content inspection. The EDPS thus recommends that

text: Article 23(5)

text: explicitly provides that, whenever sufficient for the achievement of one of the purposes set out in that provision, traffic management measures will involve communications inspection techniques based on the sole analysis of the IP-headers, as opposed to those involving DPI.

text: 23. The EDPS notes that Article 24(1) of the proposal foresees that national regulatory authorities will monitor and ensure the ability of end-users to benefit, inter alia, from net neutrality, as well as ensure compliance with the restrictions applicable to traffic management measures. In view of the effect of such measures on confidentiality of communications, privacy and the protection of personal data, the EDPS recommends that

text: Article 24(1)

text: further refers to the cooperation between national regulatory authorities and national data protection authorities. 3.3. End-users' rights a) Itemised billing

text: 24. The EDPS recalls that

text: Article 7(1) of Directive 2002/58/EC

text: grants subscribers the right to receive non-itemised bills. In that regard, the EDPS notes that Article 27(4) of the proposal appears to reverse this situation, granting end-users the right to opt for receiving itemised bills. While non-itemised bills do not reveal the identities of call addressees or calling subscribers, thus ensuring that end-users' communications remain confidential, itemised bills, on the other hand, grant end-users an opportunity to access their own personal data and where relevant rectify them, for instance, where there is a mistake on the bill. For the purposes of legal certainty there is a need to clarify the exact interrelationship between

text: Article 7(1) of Directive 2002/58/EC

text: and Article 27(4) of the proposal. In case the latter provision is aimed at amending

text: Article 7(1) of Directive 2002/58/EC

text: , this should be justified and specified in the 'Organisational and final provisions' of the proposal. b) Information to be provided to end-users  Transparency and publication of information

text: 25. Article 25(1) of the proposal obliges providers of electronic communications to the public to publish 'transparent, comparable, adequate and up-to-date information', inter alia, on their contact details, services offered and relevant quality of service parameters, prices and applicable charges, as well as specific information on Internet access services. The EDPS welcomes this obligation, as well as a further requirement upon communications providers in

text: Article 25(1)

text: to publish such information, inter alia, in a clear, comprehensible and easily accessible manner and regularly update it.

text: 26. The EDPS further welcomes the fact that

text: Article 25(1)

text: (e), point iv, obliges communications providers to publish information on the procedures they implement to 'measure and shape traffic so as to avoid congestion of a network', as well as the potential effect of such procedures on the protection of personal data.

text: 27. However, the EDPS notes that

text: Article 25(1)

text: (e) does not presuppose the provision of information on traffic management instituted for any other purposes listed in

text: Article 23(5)

text: , such as, for instance, implementation of a court order. In view of a significant effect of such measures on the rights to privacy and data protection, the EDPS recommends that

text: Article 25(1)

text: (e) requires the provision of clear and adequate information on traffic management measures instituted for all purposes listed in Article 23(5) of the proposal. Such information should, in particular, provide an indication of the communications inspection technique used for traffic management, as well as explain its effect on end-users' privacy and data protection rights.

text: 28. The EDPS further notes that, according to

text: Article 25(1)

text: , communications providers may supply information for end-users, before its publication and upon request, to the relevant national regulatory authority. In view of the fact that such information will also address traffic management measures, the EDPS recommends including, in

text: Article 25(1)

text: , a further obligation on communications providers to provide information on traffic management measures, upon request, to the competent national data protection authority. The provision should further foresee cooperation between national regulatory authorities and national data protection authorities in their assessment of the quality of information to be provided to end-users.  Information requirements for contracts

text: 29. Similarly to

text: Article 25(1)

text: (e), point iv,

text: Article 26(2)

text: (d) mandates that communications providers, in their contracts with end-users, supply information on the procedures they establish to 'measure and shape traffic so as to avoid congestion of a network', and the data protection impact of such procedures. Furthermore,

text: Article 26(1)

text: (j) obliges providers to inform end-users on the type of action that might be taken in response to 'security and integrity incidents or threats and vulnerabilities'. While

text: Article 26(1)

text: (j) does not explicitly mention traffic management measures, the EDPS notes that such measures could be used as a response to security and integrity threats - for instance, in order to locate and block harmful traffic in case of distributed denial-of-service (DDoS) attacks.

text: 30. In view of the above,

text: Article 26

text: thus appears to require the provision of information on traffic management measures undertaken for the purposes of minimising the effects of network congestion, as well as those aimed at preserving security and integrity of the network, which the EDPS welcomes. However, the EDPS notes that

text: Article 26(1)

text: (j) should not only require to provide information on the types of security-related traffic management measures, but also on the communications inspection techniques that underlie such measures, as well as their effect on end-users' privacy and data protection rights.

text: 31. The EDPS further notes that

text: Article 26

text: is silent on the information that could be provided to end-users on traffic management instituted, inter alia, for the purposes of implementing a court order or preventing the transmission of unsolicited communications to end-users, as laid down in

text: Article 23(5)

text: , (a) and (c). Clear and adequate information on the types of traffic management measures set in place to achieve these purposes, the communications inspection techniques that underline such measures, as well as their data protection impact, should form an integral part of the contracts between communications providers and end-users, and thus be required under Article 26 of the proposal.

text: 32. In relation both to the public provision of information (

text: Article 25(2)

text: ) and information to be provided in contracts with end-users (

text: Article 26(4)

text: ), the proposal grants powers to the Commission to adopt implementing acts, setting out the details of information to be supplied. In view of the necessity to ensure that clear and adequate information is provided to end-users, and especially taking into account that such information will include the description and the data protection and privacy impact assessment of traffic management measures, the EDPS welcomes further consultation on such implementing acts.

text: Article 26(1)

text: (g) further obliges providers of electronic communications to the public to include the following information into the contracts with end-users: 'where an obligation exists in accordance with

text: Article 25 of Directive 2002/22/EC

text: , the endusers' options as to whether or not to include their personal data in a directory, and the data concerned'. In that regard, the EDPS recalls that

text: Article 25 of Directive 2002/22/EC

text: is to apply subject to the requirements of

text: Article 12 of Directive 2002/58/EC

text: . In view of the indirect and complex character of such referencing, the EDPS recommends that

text: Article 26(1)

text: (g) is amended to include a reference to

text: Article 12 of Directive 2002/58/EC

text: , which further foresees that end-users should be informed about the purposes of the directory in question, as well as any further possibilities of the use of their personal data based on search functions available in that directory. According to

text: Article 12 of Directive 2002/58/EC

text: , end-users should also be further given information on the modalities of exercising their rights to verify, correct or withdraw their personal data from the directory in question. 3.4. Public registry of notifications by communications providers

text: 34. Article 4(5) of the proposal provides for the establishment, by the Body of European Regulators for Electronic Communications (BEREC) Office, of a publicly accessible registry of notifications made by communications providers to the regulatory authority of the home Member State on their intention to begin the provision of electronic communications networks and services.

text: Article 4(2)

text: further provides the categories of the data to be included in the notification, among them being the name, legal status and form and, where applicable, registration number of the provider, geographical address of its main establishment, its contact person and the description of services and networks to be provided. According to

text: Article 4(5)

text: , notifications are to be transferred to the BEREC Office by the regulatory authority of the home Member State of the provider.

text: 35. The EDPS points out that some of the data to be included in the registry may relate to natural persons - this being the case for the contact persons of communications providers or, in very limited cases, where the name of a communications provider 14 identifies a natural person.

text: 36. The EDPS notes that Article 4(3) of the proposal obliges communications providers to notify the relevant national regulatory authority of any changes to the information provided in the notification within one month of such change. This provision thus effectively enables rectification of the data by communications providers and is therefore welcomed by the EDPS.

text: 37. However, the EDPS notes that

text: Article 4(5)

text: neither provides information on the format of the registry or explicitly specifies its purpose, nor lays down the retention periods for the data included in notifications. The provision further does not provide for a right of a communications provider to request deletion of the data from the registry. This information should be provided in

text: Article 4(5)

text: . This provision should also specify that, regardless of the format (electronic or printed) of the registry selected by BEREC Office, the latter should apply adequate security measures in its maintenance of the registry, in accordance with

text: Article 22 of Regulation (EC) No 45/2001

text: . Finally,

text: Article 4(5)

text: should provide for an obligation upon BEREC to grant communications providers information in accordance with

text: Article 12 of Regulation (EC) No 45/2001

text: , which can be disseminated via the regulatory authority of a provider's home Member State. 3.5. Data protection by design

text: Article 17(1)

text: (f) of the proposal lists the requirements to be met by a European virtual broadband access product, among them being 'respect of the rules on protection of privacy, personal data, security and integrity of networks and transparency in conformity with Union law'. The EDPS welcomes this reference to privacy and data protection rules and recommends that, in addition, compliance with the principle of data protection by design, laid down in Article 23 of the proposal for a General Data Protection Regulation, is added to the list of relevant requirements.

text: 39. According to Article 23 of the proposal for a General Data Protection Regulation, compliance with the 'data protection by design' principle should encompass respect, inter alia, for accuracy, security, integrity and confidentiality of end-users' personal data at all stages of its processing. European virtual broadband access products should thus comply with the requirements of data security, integrity and confidentiality within the context of transmission of communications over the network. Data accuracy, security, integrity and confidentiality requirements should further be met by relevant ancillary IT systems as mentioned in Annex I of the proposal, such as, for instance, those used for managing maintenance and repair requests and end-user billing. In that regard, the EDPS welcomes further consultation on delegated acts to be adopted by the Commission under

text: Article 17(2)

text: , adapting technical requirements for European virtual broadband access products specified in Annex I.

text: 40. Similarly to the conditions applicable to the European virtual broadband access product,

text: Article 19(4)

text: (e) provides for respect for privacy and data protection as requirements for the European Assured Service Quality (ASQ) connectivity product. While welcoming this general reference, the EDPS further recommends specifying, in

text: Article 19(4)

text: (e), that European ASQ products are to comply with the data protection by design requirement. In relation to the ASQ connectivity products, such compliance should entail respect for the confidentiality, integrity and security of the data processed within the course of transmitting communications over the network.

text: 41. The EDPS further notes that Article 19(5) of the proposal grants the Commission the power to adopt delegated acts in order to adapt the requirements for European ASQ connectivity products, specified in Annex II. In view of the fact that only a very limited number of such requirements are provided in that Annex, the EDPS recommends, firstly, amending it to further specify the list of relevant requirements. Next, the EDPS highly welcomes further consultation on the relevant delegated acts.

text: 42. Finally, in view of the necessity for both the European virtual broadband access product and the European ASQ connectivity product to comply with the data protection and privacy rules, including the principle of data protection by design, the EDPS equally welcomes consultation on the implementing acts specifying technical and methodological rules for the implementation of these products, adopted pursuant to

text: Article 20(2)

text: 4. CONCLUSIONS

text: 43. The EDPS recalls that respect for the rights to privacy and the protection of personal data, and for the confidentiality of communications, is crucial to building consumer trust and confidence in the European single market for electronic communications. In that regard, the EDPS provides the following key recommendations:  Traffic management measures constitute a restriction to net neutrality, which the proposal sets out as the key principle applicable to Internet use in the EU, and interfere with end-users' rights to confidentiality of communications, privacy and personal data protection. In view of this, such measures should be subject to strict transparency, necessity and proportionality requirements. In particular: o Using traffic management for the purposes of implementing a legislative provision or preventing and impeding serious crimes may entail a widescale, preventive and systematic monitoring of communications content which would be contrary to Articles 7 and 8 of the EU Charter of Fundamental Rights, as well as

text: Article 5(1) of Directive 2002/58/EC

text: and Directive

text: . Reference to these grounds should be removed from

text: Article 23(5)

text: (a) of the proposal; o Article 23(5) of the proposal should provide clear information on communications inspection techniques that are allowed within the context of traffic management measures; o

text: Article 23(5)

text: should explicitly provide that, whenever sufficient for the achievement of one of the aims set out in that provision, traffic management measures will involve communications inspection techniques based on the sole analysis of the IP-headers, as opposed to those involving Deep Packet Inspection; o Articles 25(1) and 26 of the proposal should require the provision of information on traffic management measures, instituted for all purposes laid down in

text: Article 23(5)

text: . In particular, these provisions should require providers to indicate the communications inspection techniques underlying such traffic management measures, as well as explain the effect of such techniques on end-users' privacy and data protection rights; o

text: Article 24(1)

text: , laying down the powers of national regulatory authorities to, inter alia, supervise the application of traffic management measures, should include the possibility for the latter to cooperate with national data protection authorities. Similarly,

text: Article 25(1)

text: should provide for a possibility for national data protection authorities to obtain for inspection information on traffic management measures before its publication;  Both

text: Articles 17(1)

text: (f) and 19(4)(e) of the proposal should be amended to include the requirement for the European virtual broadband access product and the European ASQ connectivity product, respectively, to comply with the principle of data protection by design. Done in Brussels, 14 November 2013 (signed) Peter HUSTINX European Data Protection Supervisor


text: On 27 July 2013, the Commission adopted a draft proposal for a Directive of the European Parliament and of the Council on payment services in the internal market amending Directives

text: and

text: and repealing Directive

text: (the proposed Directive), and for a Regulation of the European Parliament and of the Council on interchange fees for card-based payment transactions. These proposals were sent to the EDPS for consultation on 28 July 2013.

text: OJ L 281, 23.11.1995, p. 31. 2 OJ L 8, 12.1.2001, p. 1. 3 COM (2013) 547 final and COM (2013) 550 final. Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: See EDPS letter of 11 April 2012 in response to DG MARKT public consultation on the Green Paper entitled "Towards an integrated European market for card, internet and mobile payments", available at: https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Comme nts/2012/12-04-11_Mobile_Payments_EN.pdf

text: COM (2012) 11 final. 6 See EDPS Opinion of 18 March 2010 on 'Promoting Trust in the Information Society by Fostering Data Protection and Privacy' and EDPS Opinion of 10 April 2013 on the Communication from the Commission on 'The Digital Agenda for Europe - Driving European growth digitally', available on the Consultation section of the EDPS website: www.edps.europa.eu .

text: For instance,

text: Articles 37

text: - 42, 44-46, 49-51 and Recitals 32, 35, 39-42

text: Proposal for a Directive of the European Parliament and of the Council concerning measures to ensure a high common level of network and information security across the Union, COM(2013) 48 final. 9 EDPS Opinion of 14 June 2013 on the `Cyber Security Strategy of the European Union´, available on the Consultation section of the EDPS website: www.edps.europa.eu

identifier: EDPS yttrande (2013)

amnesord:
Rights of the Individual
Right of Information
Privacy by Design
Privacy by Default
Information Security
Internal Market

publisher: Europeiska datatillsynsmannen

sprak: en

title: Payment services

serie: yttranden

text: Opinion of the European Data Protection Supervisor

type: stycke

text: on a proposal for a Directive of the European Parliament and of the Council on payment services in the internal market amending Directives

text: and

text: and repealing Directive

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular

text: Article 16

text: thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles

text: and

text: thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular

text: Article 28(2)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION 1.1. Consultation of the EDPS

text: 2. The EDPS welcomes the fact that he is consulted by the Commission and welcomes that a reference to this Opinion has been included in the preamble of the instruments.

text: 3. Before the adoption of the proposed Regulation, the EDPS was given the possibility to provide informal comments to the Commission. Some of these comments have been taken into account. As a result, the data protections safeguards in the proposed Regulation have been strengthened.

text: 4. As the proposal for a Regulation does not raise any issues from a data protection point of view, the EDPS will concentrate his comments on the proposed Directive. 1.2. Objectives and scope of the proposed Directive

text: 5. The aim of the proposed Directive is to help develop further an EU-wide market for electronic payments, which will enable consumers, retailers and other market players to enjoy the full benefits of the EU internal market, in line with Europe 2020 and the Digital Agenda. To achieve this and promote more competition, efficiency and innovation in the field of e-payments, the Commission states that there should be legal clarity and a level playing field, leading to downward convergence of costs and prices for payment services users, more choice and transparency of payment services, facilitating the provision of innovative payment services, and to ensure secure and transparent payment services.

text: 6. The Commission claims that these objectives will be achieved by updating and complementing the current framework on payments services, providing for rules that enhance transparency, innovation and security in the field of retail payments and improving consistency between national rules, with an emphasis on the legitimate needs of consumers.

text: 2. Specific comments on the proposed Directive 2.1. General reference to data protection law

text: 7. The EDPS notes that the provision of payment services requires the processing by different stakeholders of personal data: names, bank account numbers and content of contracts need to be exchanged between payers and payees and through their respective payment service providers in order to guarantee a smooth functioning of the transfers.

text: 8. The EDPS welcomes the introduction in Article 84 of a substantive provision stating that any processing of personal data taking place in the frame of the proposed Directive should be done in full respect of the national laws implementing Directive

text: and Directive

text: , and of Regulation EC No 45/2001.

text: 9. However, the EDPS recalls that clarifying the applicable data protection legislation is essential but not sufficient. The references to applicable data protection law should be specified in concrete safeguards that will apply to any situation in which personal data processing is envisaged.

text: 10. In his letter in response to the Commission´s public consultation on the Green Paper entitled "Towards an integrated European market for card, internet and mobile payments" , the EDPS underlined that the full respect of EU data protection rules requires specific safeguards to be applied. In particular, he indicated that the exchange and processing of personal data related to payers and payees and with the various payments service providers must respect the principles of necessity, proportionality and purpose limitation, as well as the obligation not to keep the data for longer than it is necessary. The EDPS also highlighted the crucial importance of transparency as a means of ensuring the effective exercise by individuals of their data protection rights. The EDPS therefore recommends that specific safeguards are explicitly included in the text of the proposed Directive, as detailed further below. 2.2. The legal basis for the processing of personal data

text: 11. As to the processing of personal data by payment systems and payment service providers, it should be made clear in the proposed Directive that the provision of payment services entails the processing of personal data. Currently the proposed Directive envisages the processing of personal data solely in the context of the prevention, investigation and detection of payment fraud according to Recital 71, without taking into account the fact that the provision of the payment service itself may imply the processing of personal data. As to the legal basis justifying such processing, it should be clarified expressly in the proposed Directive that the processing of personal data may be carried out insofar it is necessary for the performance of payment services.

text: 12. As regards the processing of personal data for the prevention, investigation and detection of payment fraud, the EDPS considers that Article 84 of the proposed Directive is not precise enough to be considered as a valid legal ground for such processing. The provisions regulating fraud prevention should - at least in main lines - define more precisely the purpose(s) of the processing, the personal data concerned and the modalities of the processing. When defining these elements for the processing of personal data, due account should be taken of the principle of proportionality (only those personal data that are necessary for the purpose of the processing may be processed). The EDPS therefore recommends inserting a more precise provision in the proposed Directive. 2.3. Proportionality of the processing

text: 13. It should be ensured that the different actors only access and process the data that are necessary for the performance of their services (see for instance Recital 26). As an illustration, in principle mobile operators responsible for the transmission of the transaction order should not have access to content information on the details of payments. This should be expressly stated in a substantive provision of the proposed Directive.

text: 14. In the same way, the provisions on third party access (see below under 2.7.) in Articles 58 and 59 of the proposed Directive should make clear that information about ‘availability of sufficient funds’ should consist in a simple ‘yes’ or ‘no’ answer to the question if there are sufficient funds available – not in for example a statement of the account balance.

text: 15. The EDPS underlines the importance of implementing the principles of "privacy by design" and "privacy by default" in all data processing systems developed and used under the proposed Directive. These concepts have emerged under the current data protection Directive

text: and are expected to receive legal recognition under the proposed General Data Protection Regulation (see

text: Article 23

text: ) . “Privacy by design” refers to the integration of data protection and privacy from the very inception of new products, services and procedures that entail the processing of personal data, while “privacy by default” refers to the selection of the most privacy friendly configuration by default.

text: 16. “Privacy by design” implies inter alia – that it is ensured that data processing systems are designed to process as little personal data as possible (data minimization); that “privacy by default” settings are implemented; that access to individual's information is limited to what is strictly needed in order to provide the service; and that tools enabling users to better protect their personal data (e.g. access controls, encryption) and exercise their rights are implemented.

text: 17. The EDPS has repeatedly underlined the importance of appropriately taking into account these concepts in the implementation of the Digital Agenda , in anticipation of the adoption of the proposed General data protection Regulation. He therefore recommends adding in a substantive provision of the proposed Directive stating the obligation that "privacy by design/privacy by default" be embedded in all data processing systems developed and used in the frame of the proposed Directive. 2.4. Supervision by competent authorities

text: 18. The EDPS welcomes that the proposed Directive in Recital 32 introduces a duty for competent authorities to exercise their powers “with respect to fundamental rights, including the right to privacy” when supervising the compliance of payment institutions. The recital also states that for the exercise of those powers which may amount to serious interferences with the right to respect private and family life, home and communications, Member States should have in place adequate and effective safeguards against any abuse or arbitrariness, for instance, where appropriate through prior authorisation from the judicial authority of the Member State concerned. The EDPS recalls that these requirements are without prejudice to the control of an independent authority (national Data protection authority) under Article 8 (3) of the Charter of fundamental rights of the European Union.

text: 19. The EDPS would, however, like to see the concretisation of such requirements in a substantive provision of the proposed Directive. He therefore recommends introducing in Article 22 of the requirement for competent authorities to request documents and information by formal decision, specifying the legal basis and the purpose of the request and what information is required, as well as the time-limit within which the information is to be provided. 2.5. Exchange of information

text: 20. Article 25 of the proposed Directive requires competent authorities to exchange information between them and with the European Central Bank, and with the national central banks of the Member States, EBA or other relevant competent authorities designated under national or EU legislation applicable to payment service providers.

text: Article 26(3)

text: provides that competent authorities shall exchange all essential and/or relevant information, in particular in the case of infringements or suspected infringements by an agent, a branch or an entity to which activities are outsourced. In some cases these exchanges of information will undoubtedly relate to identified or identifiable individuals, for example to an agent, a payment service user or a consumer.

text: 22. The EDPS considers that both provisions are too vague and, consequently, do not provide adequate legal basis for the required processing of personal data. As regards purpose limitation, the proposed Directive fails to specify the purposes of the exchange of information and the kind of data that will be exchanged, including any personal data. Furthermore, the EDPS notes that the proposed Directive does not lay down any concrete limitation of the period for the retention of the personal data potentially processed. This is likely to lead to uncertainty and undue diversity in national implementation and/or practice.

text: 23. On the basis of the foregoing, the EDPS recommends (i) mentioning the purposes for which personal data can be processed by national competent authorities, the EU central bank, the national central banks and the other authorities referred to in

text: Article 25

text: , (ii) specifying the kind of personal information that can be processed under the proposed Directive, and (iii) fixing a proportionate data retention period for the above processing (or at least introducing precise criteria for its establishment at national level). 2.6. Transparency and information of individuals

text: 24. The EDPS takes note that several provisions set forth a number of requirements to increase transparency towards users. He believes that the requirement of transparency as regards payment services should also include the obligation of transparency in respect of the processing of personal data of individuals. Data subjects should know who processes what data for which purpose, for how long, and how they can exercise their rights, including those related to the access to their data and to their rectification or erasure.

text: 25. The EDPS therefore recommends including in a substantive provision of the proposed Directive a specific reference to the obligation to provide individuals with appropriate information about the processing of personal data in accordance with national provisions implementing Articles

text: and

text: of Directive 95/46/EC and to Article 11 of Regulation EC No 45/2001.

text: 26. Furthermore, Recital 35 should also be amended to require the provision of all information required under the Directive "as well as under Directive

text: and Regulation EC No 45/2001" (also, the word "only" should be deleted, as the information requirements laid down in the Directive are not the only ones that need to be complied with).

text: 27. The provision of information about the processing of personal data in due time before requiring the payment service is all the more important as consent of the user is meant to play a central role and authorisation of payment transactions would only be considered to be given if the payer has given his consent. Before providing his/her consent to the transaction, the payer should not only be informed about the price and fee calculations but also of the modalities of the processing of his/her personal data so that he can take an informed decision about such payment and the implications on the processing of his/her personal data.

text: 28. The EDPS welcomes that the provisions on transparency provide clear rules on the means of providing information to users and on the necessity that such information remains available at all times. He recommends that it is expressly stated in the provisions concerning transparency that the modalities set forth as regards the provision of information to users also apply to the provision of information about the processing of personal data pursuant to Articles

text: and

text: of Directive 95/46/EC. 2.7. Third party access

text: 29. Articles 58 and 59 of the proposed Directive introduce rules governing the access to and use of payment account information by third party service providers and third party payment instrument issuers.

text: 30. The EDPS notes that the Commission has paid attention to data protection when drafting these Articles, especially the principle of data minimisation. However, in the view of the EDPS the relevant provisions leave too much margin for interpretation. For example, the terms ‘availability of sufficient funds’ and ‘sensitive payment data’ are not defined anywhere in the text of the proposed Directive. This could lead to divergent transposition in Member States with the possibility of data protection risks involved with third party access if these undefined terms are given a broad interpretation in national legislation.

text: 31. In the case of ‘availability of sufficient funds’ the EDPS recommends that it should be made clear that the information transmitted to the third party should consist in a simple ‘yes’ or ‘no’ answer to the question if there are sufficient funds available – not in for example a statement of the account balance.

text: 32. The term ‘sensitive payment data’ does not exist in data protection law.

text: Article 8 of Directive 95/46/EC

text: lists the special categories of sensitive data that are granted a higher level of protection. Payment data is not among the categories listed. This does not mean that personal data concerning payments is not protected by data protection law, but it is not characterised as ‘sensitive data’. The EDPS therefore recommends that the word ‘sensitive’ is deleted and that the term ‘payment data’ is used instead. 2.8. Security requirements

text: 33. The EDPS welcomes the obligation for payment institutions in

text: Article 5

text: (j) to provide the competent authorities with a security policy document, a detailed risk assessment in relation to its payment services and a description of security control and mitigation measures taken to adequately protect the payment services against the risks identified including fraud and illegal use of sensitive and personal data.

text: 34. As security is of crucial importance in the field of payment services, it must be ensured that the processing of personal data, and their passing along through the various intermediaries, respect the principles of confidentiality and security in compliance with Articles

text: and

text: of Directive 95/46/EC. The EDPS recommends adding in recital 6 and

text: Article 85

text: that the processing of personal data must respect the security requirements laid down in Articles

text: and

text: of Directive 95/46/EC.

text: 35. Recital 6 and

text: Article 85

text: provide for an obligation to report within undue delay major security incidents to the European Banking Authority. The EDPS wishes to underline that similar notification requirements are also set forth under Directive

text: , as revised by Directive

text: , for the telecoms sector whenever personal data of individuals have been compromised, pursuant to which the responsible entity must notify the competent authority of that breach (i.e. the data protection authority or the telecommunication regulator) as well as the individuals concerned where relevant.

text: 36. Consistency must therefore be ensured with the personal data breach requirements that are already applicable to telecom providers under Directive

text: , as revised by Directive

text: , and with the planned personal data breach provisions of the proposed General Data Protection Regulation that would apply to all data controllers (Articles

text: and

text: ). It should be clarified in a recital of the proposed Directive that the security incidents reporting obligations are without prejudice to other incident reporting obligations set forth in other legislation, in particular the personal data breaches requirements set forth under data protection law (in Directive

text: and in the proposed General Data Protection Regulation) and the security incidents notification requirements planned under the proposed Directive on network and information security , a proposal on which the EDPS has published an Opinion on 14 June 2013. The EDPS would also like to stress that the fact that the Proposed Directive in

text: Article 85

text: refers to the proposed Directive on network and information security, which is still under negotiation, creates an ambiguous situation which further strengthens the need for clarification.

text: 37. Article 87 of the proposed Directive states that Member States shall ensure that a payment service provider applies third party authentication. The Article also states that the European Banking Authority (EBA) in cooperation with the European Central Bank (ECB) shall issue guidelines addressed to payment service providers on state of the art customer authentication and any exemption of the use of strong customer authentication. The EDPS recommends including references in the proposed Directive to the need to consult the EDPS in so far as the guidelines concern the processing of personal data. 2.9. Standardisation and interoperability

text: 38. The proposed Directive stresses the need to develop and to reinforce standardisation and interoperability. As underlined in our response to the public consultation, we believe that the development of these standards should be preceded by privacy impact assessments that would analyse the implications of new technologies available on the privacy and data protection of individuals. This process should allow identifying which are the risks associated to each of the technical options available and which are the remedies that could be put in place to minimize data protection threats. We therefore suggest adding in a substantive provision of the proposed Directive the obligation that these standards are developed on the basis of, and after having conducted, privacy impact assessments.

text: 3. CONCLUSIONS The EDPS welcomes the introduction in Article 84 of a substantive provision stating that any processing of personal data taking place in the frame of the proposed Directive should be done in full respect of the national laws implementing Directive

text: and Directive

text: , and of Regulation EC No 45/2001. The EDPS recommends that:  references to applicable data protection law should be specified in concrete safeguards that will apply to any situation in which personal data processing is envisaged.  it should be made clear in the draft Directive that the provision of payment services might entail the processing of personal data.  it should be clarified expressly in the proposed Directive that the processing of personal data may be carried out insofar that it is necessary for the performance of payment services.  a substantive provision is added stating the obligation that "privacy by design/privacy by default" be embedded in all data processing systems developed and used in the frame of the proposed Directive.  regarding exchanges of information: (i) mentioning the purposes for which personal data can be processed by national competent authorities, the EU central bank, the national central banks and the other authorities referred to in

text: Article 25

text: , (ii) specifying the kind of personal information that can be processed under the proposed Directive and (iii) fixing a proportionate data retention period for the processing or at least introducing precise criteria for its establishment.  a requirement should be introduced in

text: Article 22

text: for competent authorities to request documents and information by formal decision, specifying the legal basis and the purpose of the request and what information is required should be introduced, as well as the time-limit within which the information is to be provided.  it is introduced in

text: Article 31

text: and

text: of Directive 95/46/EC.  in the case of the term ‘availability of sufficient funds’ in Articles

text: and

text: it is made clear that the information transmitted to the third party should consist in a simple ‘yes’ or ‘no’ answer to the question if there are sufficient funds available – not in for example a statement of the account balance.  in the case of the term ‘sensitive payment data’ in

text: Article 58

text: that the word ‘sensitive’ is deleted and that the term ‘payment data’ is used instead.  it should be clarified in a recital that the security incidents reporting obligations are without prejudice to other incident reporting obligations set forth in other legislation, in particular the personal data breaches requirements set forth under data protection law (in Directive

text: and in the proposed General Data Protection Regulation) and the security incidents notification requirements planned under the proposed Directive on network and information security.  it must be ensured that the processing of personal data, and their passing along through the various intermediaries, respect the principles of confidentiality and security in compliance with Articles

text: and

text: of Directive 95/46/EC.  a substantive provision is added to the proposed Directive with the obligation that standards are developed on the basis of, and after having conducted, privacy impact assessments.  a reference should be included in the proposed Directive to the need to consult the EDPS in so far as the EBA guidelines on state of the art customer authentication and any exemption of the use of strong customer authentication concern the processing of personal data. Done in Brussels, 5 December 2013 (signed) Giovanni BUTTARELLI Assistant European Data Protection Supervisor

type: vagledning

utgivare: edps