text: OJ L281, 23.11.1995, p. 31. 2 OJ L8, 12.1.2001, p. 1. 3 COM(2014) 72 final.

text: See Communication, p. 2. 5 Commission Vice-President Neelie KROES, press release IP/14/142 of 12.02.2014.

text: UN Universal Declaration of Human Rights. Available at http://www.un.org/en/documents/udhr/index.shtml#a12. 7 UNHCR International Covenant on Civil and Political Rights. Available at http://www2.ohchr.org/english/law/ccpr.htm#art17. 8 OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data. Revised (2013) version available at http://www.oecd.org/sti/ieconomy/privacy.htm#newguidelines. 9 Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Council of Europe's Convention 108). Available at http://conventions.coe.int/Treaty/en/Treaties/Html/108.htm 10 See the Communication, p. 1. 11 See the Communication, p. 10. 12 The final statement adopted at the end of the summit is available at http://netmundial.br/wpcontent/uploads/2014/04/NETmundial-Multistakeholder-Document.pdf. 13 See the Communication, p. 5.

text: See below on the gTLD EWG report for ICANN 50. 15 The Moraes Report voted by the Parliament "[c]alls on the Commission and the EEAS to take action at the international level, with the UN in particular, and in cooperation with interested partners to implement an EU strategy for democratic governance of the internet in order to prevent undue influence over ICANN’s and IANA’s activities by any individual entity, company or country by ensuring appropriate representation of all interested parties in these bodies, while avoiding the facilitation of state control or censorship or the balkanisation and fragmentation of the internet". See Report on the US NSA surveillance programme, surveillance bodies in various Member States and their impact on EU citizens’ fundamental rights and on transatlantic cooperation in Justice and Home Affairs, 21.2.2014, 2013/2188(INI), para 105. 16 NTIA is the Executive Branch agency that advises the President of the United States on telecommunications and information policy. 17 See ICANN´s President opening address at ICANN meeting in Singapore on 24 March.

text: See Communication, p. 6. 19 See Communication, p. 5 20 Expert Working Group on gTLD Directory Services; https://www.icann.org/en/system/files/files/final-report- 06jun14-en.pdf. 21 http://www.internetgovernance.org/2014/06/07/icann-suppresses-a-privacy-advocates-dissent/.

text: E.g. Letter by

text: Article 29

text: Chair to ICANN General Counsel of 8 January 2014 http://ec.europa.eu/justice/dataprotection/article-29/documentation/other-document/files/2014/20140108_letter_icann.pdf.

text: Case C-131/12

text: , Google Spain and Google v AEPD, judgment of 13 May 2014. 24 Google v AEPD, para 97. 25 See Communication, p. 9.

text: See the EDPS Opinion of 14 June 2013 on the Joint Communication of the Commission and of the High Representative of the European Union for Foreign Affairs and Security Policy on a 'Cyber Security Strategy of the European Union: an Open, Safe and Secure Cyberspace', and on the Commission proposal for a Directive concerning measures to ensure a high common level of network and information security across the Union at https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/2013/13- 06-14_Cyber_security_EN.pdf. 27 Security requirements are contained in Articles

text: and

text: of Regulation (EC) No 45/2001, Articles

text: and

text: of Directive 95/46/EC and Articles

text: and

text: of Directive 2002/58/EC, as well as in Article 7 of the Convention 108 of the Council of Europe on Data Protection, adopted in 1981 and by now ratified by all EU Member States. 28 See Communication, pp. 8-9.

text: The EDPS has launched together with other DPAs an initiative for privacy-aware design of internet services, the Internet Privacy Engineering Network, IPEN. 30 See Communication, p. 3. 31 Opinion of 7 October 2011 on net neutrality, traffic management and the protection of privacy and personal data, OJ C 34/01, 08.02.2012, p. 1. 32 Deep packet inspection enables the ISP to access information addressed to the recipient of the communication only. Taking the usual postal service as an example, this approach is equivalent to opening the envelope and reading the letter inside to perform an analysis of the content of the communication (encapsulated inside the IP packets) in order to apply a specific network policy. 33 COM (2013)627 final. 34 Opinion of 14 November 2013 on the Proposal for a Regulation of the European Parliament and of the Council laying down measures concerning the European single market for electronic communications and to achieve a Connected Continent, and amending Directives

text: and

text: and Regulations

text: (EC) No 1211/2009

text: and

text: (EU) No 531/2012

text: , available at https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/2013/13- 11-14_Single_Market_Electronic_Communications_EN.pdf.

text: See Communication, p. 10. 36 See Communication, p. 11. 37 See Communication, p. 11.

text: See footnote 23, aboveError! Bookmark not defined.. 39 See Communication, p. 11. 40 See Communication, p. 3.

text: See footnote Error! Bookmark not defined., above. 42 Available at http://www.privacyconference2009.org/dpas_space/space_reserved/documentos_adoptados/indexiden-idweb.html . 43 Available at http://www.oecd.org/sti/ieconomy/privacy.htm#newguidelines. 44 Council of Europe Convention no. 185 on Cybercrime, available at http://conventions.coe.int/Treaty/Commun/QueVoulezVous.asp?NT=185&CM=8&DF=22/05/2014&CL=ENG 45 In Joined Cases

text: and

text: , Digital Rights Ireland, judgment of 8 April 2014, para 47, the Court of Justice has ruled that "where interferences with fundamental rights are at issue, the extent of the EU legislature’s discretion may prove to be limited, depending on a number of factors, including, in particular, the area concerned, the nature of the right at issue guaranteed by the Charter, the nature and seriousness of the interference and the object pursued by the interference".

title: Europe's role in shaping the future of Internet Governance

text: Opinion of the European Data Protection Supervisor

text: on the Commission Communication on Internet Policy and Governance - Europe`s role in shaping the future of Internet Governance

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, and in particular

text: Article 41

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: I. INTRODUCTION

text: I.1. Consultation of the EDPS

text: 1. On 12 February 2014 the European Commission published a Communication on Internet 3 Policy and Governance ("the Communication"). The Communication was adopted in the aftermath of revelations about a large-scale surveillance scheme implemented by the US National Security Agency on (and through) the Internet, which affected trust in the Internet and its current governance model and called for immediate reform.

text: 2. We regret that we were not consulted before the publication of the Communication. Nonetheless, as Internet Governance and the rights to privacy and data protection are closely related, we have decided to issue this Opinion on our own initiative, pursuant to Article 41(2) of Regulation 45/2001. I.2. Content of the Communication

text: 3. The Communication proposes a basis for a common European vision for Internet Governance. In particular, among other things, it purports to:  defend and promote fundamental rights and democratic values as well as multistakeholder governance structures based on clear rules and on the respect for those rights and values;  promote a single, unfragmented network, subject to the same norms and laws that apply in other areas of our lives, where individuals may benefit from rights and judicial remedies, in case their rights are breached.

text: 4. In order to do so, the Communication focuses on the main policy areas relevant to the complex Internet Governance ecosystem, namely the development of Internet Governance principles, cooperative frameworks and core Internet functions. It also makes concrete proposals on how to strengthen the current multistakeholder model. Last, it looks ahead to some of the key issues that must be addressed in the context of Internet Governance in the future, namely the strong interplay between technical norms and Internet policy, the key challenges in rebuilding trust, and conflicts of jurisdictions and laws.

text: 5. The underlying principles of the reform should - in the Commission´s view - consist of an increased transparency, accountability and inclusiveness of the way the Internet is managed.

text: 6. At the core of the reform, the Commission places fundamental freedoms and human rights that "are not negotiable" and "must be protected online". I.3. Aim of the Opinion

text: 7. Since the publication of the Communication, the discussion on the development of Internet Governance has carried on, notably at the ICANN meeting in Singapore in March 2014 and at the Global Multistakeholder Meeting on the Future of Internet Governance (NetMundial) in Brazil in April 2014. The discussion will continue at the ICANN meeting in London in June 2014.

text: 8. With this opinion, we wish to contribute to the debate, as any reform of Internet Governance will likely have a significant impact on citizens and on their fundamental rights, not least the rights to privacy and data protection. While this Opinion addresses an issue of global nature and while it takes account of the developments at global level, it focuses on the actions that the European Union and its institutions can perform to influence the debate and the Internet Governance structures and processes themselves.

text: 9. This Opinion consists of three sections. Section II draws upon the tight relationship existing between Internet Governance, on the one hand, and privacy and data protection on the other. Section III explores how the current system of EU law may help shaping the Internet, focusing on measures and rules ensuring that individual rights to privacy and data protection are properly fulfilled. Section IV touches upon further action which appears both desirable and necessary in order to achieve a satisfactory shaping of Internet Governance and aims at providing a timely response to the issues that the Internet poses on a daily basis. II. PRIVACY AND DATA PROTECTION ARE STRONGLY RELATED TO GOOD INTERNET GOVERNANCE II.1. The protection of privacy and data protection as internationally recognized fundamental values

text: 10. The Communication clearly underlines the need to base the future development of Internet Governance on the respect of fundamental rights. We welcome this principle, but we stress the need to translate it into practical policy initiatives, which is not always sufficiently the case.

text: 11. Privacy and data protection are recognized in several international instruments - such as Article 12 of the Universal Declaration of Human Rights , Article 17 of the International Covenant on Civil and Political Rights , the OECD Guidelines on Protection of Privacy and 8 Transborder Flows of Personal Data and the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data . These instruments provide a firm foundation for citizens' involvement in online interaction.

text: 12. We emphasise that, in order to "sustain and develop the Internet as an essential part of life" and to create a "single, open, free, unfragmented network of networks" with a "safe, secure, sound and resilient architecture" , Internet Governance should be built starting from commonly shared international rights and values. Consequently, privacy and data protection principles need to gain more weight within Internet Governance fora and mechanisms.

text: 13. We note some positive developments at international level in recognising privacy and data protection as essential values for the internet. At the Net Mundial, a general consensus was reached on the need to protect privacy on the Internet, by pointing out that "The right to privacy must be protected. This includes not being subject to arbitrary or unlawful surveillance, collection, treatment and use of personal data. The right to the protection of the law against such interference should be ensured".

text: 14. We therefore urge that privacy and data protection should be core elements of any Internet Governance model, and recommend that the European Union put its full weight behind initiatives ensuring that such integration process is undertaken at a global level. II.2. Data protection as a cornerstone for shaping Internet Governance

text: 15. The Communication emphasizes that the Internet has become a key infrastructure with global dimensions and that, as a consequence, greater international balance within the existing structures would increase the probability of issuing legitimate outcomes.

text: 16. When discussing Internet Governance, it should be kept in mind that the governance of the Internet's infrastructure and global resources such as names and addresses is not the only source for privacy risks, but that the services provided on the Internet often create even greater risks for the privacy of their users and of third parties. In order to develop a comprehensive policy for the protection of privacy on the Internet, the Union must not only look at the global processes, but also at other relevant rules and mechanisms. An example of a data protection issue which has to be addressed by the Internet governance bodies is the current WHOIS system with the authentication and data retention requirements. On the other hand, examples of activities performed on the Internet with significant data protection implications include eCommerce, eGovernment, eHealth, eMoney, ePayments. We would like to emphasise that, in each of the above cases, privacy and data protection principles must be at the core of policy considerations at global level, so as to ensure protection for every Internet user.

text: 17. In this context, it should be recalled that ICANN (Internet Corporation for Assigned Names and Numbers) remains a national organization essentially regulated by domestic – Californian– private law. This makes it difficult to ensure proper fulfilment of data protection rights of non-US internet users. In this respect, the European Parliament has indicated the need to end the control over Internet governance bodies by a single country. Since 2009, ICANN has taken steps in this direction, but its own status, based on a contractual relationship within a single country, has not changed.

text: 18. Other stakeholders have also addressed the pressing need for globalisation of Internet Governance bodies and rules and for ensuring the respect of the right to privacy online as well as compliance with the data protection laws enacted in numerous jurisdictions. In response, the NTIA (US National Telecommunications and Information Administration) announced on 14 March 2014 the intention to transfer the role it currently plays in the implementation of the policies of IANA (Internet Assigned Numbers Authority, a department of ICANN) to the global multistakeholder community by September 2015, by asking ICANN to provide a proposal for a multistakeholder body to take this role. Consequently, in its role as a facilitator, during the Singapore public meeting, ICANN initiated the discussion regarding the process for performing such transition. At the same time, ICANN has recently identified privacy and data protection as a new key area for its institutional activities. Moreover, in April 2014, the Net Mundial provided additional opportunities to address the globalisation of ICANN and the IANA functions.

text: 19. As the Communication rightly states, it has become crucial that Internet Governance be based on a shared and truly global model which would better ensure the fulfilment of privacy and data protection rights on the Internet. We suggest that the European Union, in particular the Commission, takes a leading role in developing an Internet Governance model based on global partnership and full respect of data protection and other fundamental human rights. II.3. A representative multistakeholder model

text: 20. In setting forth guidelines for shaping the new Internet Governance framework, the Communication refers to the need for a multistakeholder discussion model, in order to ensure that the rules adopted are truly inclusive of all interests and instances at stake.

text: 21. However - as the Commission rightly mentions - the fact that a process is claimed to be multistakeholder, does not per se guarantee outcomes that are legitimate and in line with 18 fundamental principles.

text: 22. The multistakeholder method must be shaped adequately in order to gather the opinions of all concerned stakeholders, and be flexible enough to allow the involvement of new categories of stakeholders. The Communication observes the need to make “efforts to counter the significant differences in the ability to participate across the various stakeholder groups to better ensure representativeness”. The Communication mentions remote participation at meetings as one such effort. We believe that remote participation alone cannot be sufficient to overcome the considerable asymmetry between internet giants and civil society organisations depending on volunteers and individual donations. The Commission should investigate the possibility of using the various programmes under its control to support efforts to ensure greater representativeness.

text: 23. This is particular important with respect to inclusiveness and accessibility. Respect for fundamental rights must be ensured for all users regardless of their means and capabilities.

text: 24. In this respect, we welcome that the Commission will implement a Global Internet Policy Observatory which could become an important resource for all groups of stakeholders to participate in internet governance processes.

text: 25. In particular, due to their expertise and practical experience with the implementation of data protection and privacy principles, data protection and privacy authorities can make a unique contribution to the development of appropriate policies, structures and procedures at global level. They should be able to participate in the multistakeholder discussions and submit their views in order to ensure that, in shaping the future Internet governance model, due account is taken of individuals’ rights to privacy and data protection. This responsibility should be taken into account in their legal mandates and the resources provided to them.

text: 26. We welcome that ICANN has undertaken the establishment of an expert working group on directory services for generic top level domains with a view to replacing the current WHOIS system with a solution taking account, inter alia, of privacy concerns. We also welcome the Commission’s participation in this group. We take note that the EWG has so far failed to reach a full consensus in particular on privacy related issues. We urge the ICANN bodies and stakeholders to take proper account of the report and the related arguments in the forthcoming stages of its governance process which may lead eventually to a replacement of the current WHOIS system. In this context, we fully share the position of the

text: Article 29

text: Working Party which has urged ICANN at numerous occasions to change practices which are in conflict with EU data protection law. III. HOW CAN THE EU HELP SHAPING THE INTERNET?

text: 27. Currently the rules applicable on the Internet as regards privacy and data protection are fragmented, as each country applies its own set of rules to the Internet. The European Union has adopted a set of harmonised rules on data protection as well as rules that impact how the Internet is governed in the EU, which must respect privacy and data protection requirements. With this experience of integrating privacy and data protection requirements in its legislation, the EU should take the lead in promoting at international level the respect of fundamental rights in the policy and governance of the Internet. III.1. Promoting better protection of privacy and data protection online

text: 28. Privacy and data protection are enshrined in the primary sources of European Union law.

text: Article 16

text: TFEU provides that "[e]veryone has the right to the protection of personal data concerning them". The Charter of Fundamental Rights of the European Union ("Charter") identifies and explains the fundamental rights to privacy (

text: Article 7

text: ) and to data protection (

text: Article 8

text: ). These rights are elaborated in secondary legislation, in particular Directive

text: and Regulation 45/2001, which lay down the general legal framework for data protection. Other legislation complements this general framework, in particular, Directive

text: governing the processing of personal data in electronic communications (“the ePrivacy Directive”). Updating the EU legal framework applicable to privacy and data protection to the Internet and technological progress

text: 29. In the Communication, the Commission commits itself to work to achieve rapid adoption and implementation of key legislation (including the proposed General Data Protection Regulation or GDPR) and, thus, strengthen trust online.

text: 30. We welcome this commitment, especially since the recent surveillance scandal has revealed the extent of undue interference with individuals’ rights to privacy and data protection and has shaken users´ confidence and trust in the Internet as a tool for engaging in social interaction and participating in the public debate.

text: 31. We consider, in addition, that once the GDPR has been adopted, it will provide the Commission with a solid basis to promote EU data protection rules as standards to be adopted at international level, including Internet Governance.

text: 32. The GDPR, in fact, introduces a number of provisions with significant effects on the regulation of data protection online and addresses a number of issues which are crucial for Internet Governance. Consistent application and enforcement

text: 33. The GDPR will introduce a mechanism for ensuring consistency in the application of data protection legislation across the entire Union, thus ensuring, inter alia, legal certainty for data subjects and controllers for transnational transactions on the internet. The mechanisms developed between EU Member States for this objective, including the one-stop-shop principle, provide a model for other cross-jurisdictional issues related to internet governance and other world regions. Improved data subject´s rights

text: 34. The GDPR brings about substantial improvements of the rights of the data subject, particularly in situations where interference with their right to privacy might be magnified by online interaction. Examples include

text: Article 11

text: (obligation on controllers to provide transparent and easily accessible and understandable information),

text: Article 12

text: (obligation on controllers to provide procedures and mechanism for exercising the data subject's rights, including means for electronic requests), and

text: Article 14

text: (controller's information obligations towards the data subject, additional information to be provided on storage period, right to lodge a complaint, international data transfers and source from which the data are originating). The strengthening of data subjects’ rights online is an important element of the EU data protection reform, which could be promoted by the Commission on a global scale so as to benefit all individuals interacting online. Right to be forgotten

text: 35. Article 17 of the GDPR provides for the right to be forgotten and erasure, which is particularly important in the Internet era. Interestingly -regardless of whether

text: Article 17

text: is ultimately adopted in the initial version of the proposal- the Court of Justice has defined the scope and conditions of application of the existing right of erasure, as laid down in

text: Article 12

text: (b) of Directive

text: , on the Internet. In Google v AEPD , the Court decided on the applicant`s request to erase links to information in a newspaper about his bankruptcy which, although obsolete, was still indexed by Google in its search engine. In balancing the right to erasure against the freedom of information, the Court concluded that the former overrides the general public's right to be informed, unless the data subject plays a role in public life that 24 justifies interference with his/her right to privacy.

text: 36. The consequences of the ruling for the Internet at a global scale remain to be seen. While it is most welcome that individuals should have the right to rectify or delete, under certain conditions, data processed over the Internet about them, the EU certainly has a role to play in guiding other jurisdictions on how to achieve a proper balance of all interests and rights over the Internet. III.2. Internet policies must reconcile security requirements and fundamental rights

text: 37. The Communication argues that confidence in the Internet and its governance is a prerequisite for the realisation of the Internet's potential as an engine for economic growth and innovation. The safety, security, stability and resilience of the Internet are crucial to 25 preserve and foster the economic and societal benefits of the digital ecosystem.

text: 38. We agree that -especially after the recent revelations about mass surveillance- there is a need to restore users´ confidence in the Internet and in the use of personal data on the Internet. As indicated in our previous opinion on the Cyber Security Strategy, we believe that, due to the ever growing use of Information and Communication Technologies, measures aimed at ensuring a high level of security on the Internet should help improve the security of all the information processed therein, including personal data. In particular, we consider that security of data processing has always been a crucial element of data protection as security requirements are included in a number of data protection provisions. Therefore, improving the security standards of the Internet will increase the protection of users` personal data and prevent undue interference to occur. We consider that improved standardisation of network and information security requirements at international level will also help address more efficiently the needs for trust and security.

text: 39. In this respect, we welcome the clarification that security is not opposed to privacy and data protection. We recall the explicit recognition of privacy and data protection in the Cyber Security Strategy and the fact that they are considered as core values which should guide cyber security policy in the EU and internationally.

text: 40. A Cyber Security system should complement, rather than overlap or contradict existing (and forthcoming) data protection provisions. To this end, we invite the Commission to take action to facilitate coordination of security policies at global level, as any conflict of such policies would jeopardise both security and data protection. III.3. Encouraging the design and development of privacy friendly solutions for the Internet

text: 41. The principles of data protection-by-design and by-default could serve as significant enablers of trust on the Internet. While the Communication does not refer to these principles, it points out that "design can impact on human rights such as users' data protection rights and security..." and that "[a]n effective multistakeholder approach to specification setting on the internet will be based on efficient mutual interactions between technical and public policy considerations so that technical specifications more systematically take into account public 28 policy concerns".

text: 42. We welcome that the Communication takes account of the importance of technical design, recognizing that standardisation and specification are crucial phases in which attention must be given to individual rights and public policy needs. Data protection-by-design ensures that important public policy concerns, such as privacy and data protection, are taken into account at the right time, where relevant.

text: 43. We particularly welcome the reference to RFC 6973, which aims to provide guidance on applying the data protection-by-design principle in the design of internet protocols. This is a promising starting point which needs to be put in practice not only in the technical design process but also in the structure and processes of the organisations promoting the technical design of the internet, such as IETF, W3C etc.

text: 44. The Commission should promote structures and mechanisms supporting the application of both data protection-by-design and by-default as guiding principles in the shaping of a new governance model. It should therefore ensure that data protection mechanisms and safeguards are included, from the outset, in the design of normative and technical governance tools.

text: 45. The Commission should also use its policy and financial instruments to support the development of technical solutions for the internet that demonstrate how privacy can be respected in internet protocols, services and applications. III.4. Guaranteeing net neutrality to Internet users

text: 46. Another challenge that should be addressed in discussing a new Internet Governance model is net neutrality. The Communication refers in various instances to the fact that the Internet infrastructure should remain "one single unfragmented space" without elaborating further on the topic of net neutrality. An extensive debate is currently going on in relation to net neutrality in different forms and shapes and the arguments in support of the various positions are well known.

text: 47. We have released a specific Opinion on the topic, addressing the impact of net neutrality on 31 privacy and data protection and pointing out the dangers to privacy from the technology. Our major concern is that, in a non-neutral network environment, in order to ensure paying content providers the priority they are subscribing for, ISPs engage in deep packet inspections, scanning extensively the data uploaded by Internet users, accessing the content 32 of their communications and filtering out data that should not have priority.

text: 48. In its proposal for a new regulation for a European single market of electronic communications, the Commission referred in

text: Article 23

text: to the "Freedom to provide and avail of open internet access, and reasonable traffic management". We commented on the proposal in a specific Opinion, expressing, inter alia, the concern that the proposal provides a number of grounds for traffic management measures that scan and discriminate among various types of content, thus leaving the door open to the interferences with data protection we have mentioned above.

text: 49. We strongly recommend, therefore, that, without any prejudice to a healthy public debate on network neutrality, any solution ultimately adopted on this delicate topic both at EU and international level gathers widespread consensus on the need to provide for adequate safeguards for users and their rights. We call on the Commission to defend this position in the debate on net neutrality. IV. PROPOSALS FOR FURTHER ACTION AT INTERNATIONAL LEVEL IV.1. Solving conflicts of jurisdiction and law

text: 50. In recalling the importance of the Internet as a single unfragmented infrastructure, the Communication also points to the important issue of jurisdiction over the Internet and conflicts of laws.

text: 51. In particular, it takes the view that a more thorough reflection on how existing rules apply on the Internet is needed, even more so as "extraterritorial application of national law, often based on the geographies of the Domain Name System, has led to a number of contradictory legal decisions". In addition, the complexity and, in some cases, the opaqueness of contractual arrangements between providers and users add uncertainty to the application of the correct jurisdiction and law.

text: 52. In this respect, the Communication notes that, at international level, conflict rules are insufficiently developed, leading to unsolved conflicts of laws beyond the Union. The Commission, therefore commits itself to addressing the tension between a global Internet and national jurisdictions.

text: 53. In doing so, the Commission will launch an in-depth review of the risks, at international level, of conflicts of laws and jurisdictions arising on the Internet and assess all mechanisms, 37 processes and tools available and necessary to solve such conflicts.

text: 54. We very much welcome these efforts, as legal uncertainty and multiplicity of legal provisions are certainly harmful to users and should be timely and effectively addressed.

text: 55. In particular, we note that, given the global and cross-border nature of the Internet, personal data are often transferred to and processed in jurisdictions other than those in which users have submitted their data, exposing them to the risk of lower or no data protection. In addition, controllers processing personal data on the Internet may be faced with conflicting laws and obligations and must choose between violating foreign obligations or EU data protection law. They may be obliged to disclose data of users regardless of EU data protection safeguards (e.g. access requests by surveillance bodies in foreign jurisdictions), which in consequence undermines the data protection safeguards afforded to users under EU law.

text: 56. In this respect, valuable guidance on the applicable law in connection with data processing taking place on the Internet is provided by the recent judgment of the Court of Justice in the Google v AEPD case. In that judgment, the Court has taken into account a number of elements, such as the presence of an establishment on the territory of an EU Member State and the relationship between the activities of that establishment and the data processing at issue, to decide on the applicability of EU data protection law to a processing carried out online.

text: 57. None the less, conflicts of jurisdiction remain possible and difficult to resolve in other cases, in particular as regards legal obligations imposed on controllers based in foreign jurisdictions (such as requests for access for surveillance purposes, financial reporting obligations to foreign authorities, etc).

text: 58. From a European perspective, we would encourage controllers processing the personal data of EU individuals on the Internet to increase the transparency and the amount of information they provide to users in relation to the law(s) they are subject to and the data protection rules they are bound to apply, including laws on access to data by governmental bodies, jurisdictions where data may be processed, what safeguards have been implemented to protect users’ data (e.g. in respect of international transfers of data). As a result, users would be better aware of their rights and possible restrictions thereof.

text: 59. We welcome the work to be done by the Commission in assessing all mechanisms, processes and tools available and necessary to solve such conflicts. This will necessarily involve closer cooperation of states at the international level in order to find ways to resolve conflicts (such as by defining common standards and developing better cooperation mechanisms between competent authorities). IV.2. Need for improved international standards and cooperation

text: 60. In discussing conflicts of jurisdiction, the Commission makes it clear that its work aimed at 39 finding an effective solution will build on existing policies. Also, at the beginning of the Communication, the Commission emphasizes that it does not call for any new international legal instrument to address the issues of Internet Governance.

text: 61. We do not support the view that the legal tools to address the challenges of a new Internet Governance model are already in place and will cater for all policy needs, once policy is clearly defined. We believe, on the contrary, that significant efforts need to be deployed in order to build a governance framework which is at the same time comprehensive and responsive to issues posed by the fast-changing reality of the Internet. In addition, much work will be needed in order to cause all international stakeholders to adhere to the same governance standards, whether they are already existing legal tools or minimum common rules and principles yet to be adopted.

text: 62. In this respect, there are many interesting initiatives at international level which provide excellent opportunities for discussing, seeking agreement and building consensus on the measures most needed. For example, we have already cited the Net Mundial meeting in 41 Brazil, which called for greater privacy safeguards.

text: 63. Other existing legal tools which may facilitate the convergence of different interests on common data protection standards include the Madrid International Standards on the Protection of Personal Data and Privacy and the international instruments mentioned above (paragraph 11), including Convention 108 of the Council of Europe - which provides workable standards of data protection to which all countries may subscribe - and the OECD revised Guidelines of 2013. Finally, on the topic of security and data protection, it is 44 important to refer to the Budapest Convention which provides standard rules in the field of the fight against cybercrime.

text: 64. We support the view that, in order to promote privacy standards internationally, third countries should accede to Convention 108, which is open to countries which are not members of the Council of Europe (as was the case of Uruguay in 2012). We also support the improvement of cooperation among data protection authorities and privacy enforcement authorities around the world, as this would facilitate the enforcement of national, regional and international privacy and data protection laws in cross-border situations.

text: 65. The initiatives listed above are remarkable efforts to address the open policy issues concerning the Internet. However, in shaping a new Internet Governance framework, it is crucial to ensure that EU standards are not undermined (by adopting legislation and/or committing to agreements and initiatives which do not respect the fundamental rights 45 enshrined in the Charter ) and that more sets of common rules and principles are adopted on specific issues - for instance, on access to data for surveillance and/or law enforcement purposes.

text: 66. In this respect, and in the light of the commitments made in the Communication, we expect the Commission to take the lead of, and act as a catalyst in, the discussions on the new Internet Governance model. In particular, we encourage the Commission as Guardian of the Treaties to internationally promote EU rules on the protection of personal data as well as to encourage the accession by third countries to relevant international data protection standards. Furthermore, we support the adoption of an international instrument requiring the respect of common data protection standards by intelligence and law enforcement bodies. V. CONCLUSION

text: 67. We welcome the Commission’s efforts in the Communication to identify the main policy areas in need of reform, in the aftermath of the surveillance scandals that have shaken the confidence of Internet users as a tool for participating in democratic debate.

text: 68. The Commission has recognised the need for a shared and truly global model of Internet Governance and, as a consequence, has committed itself to a number of initiatives aiming at making the reform process as inclusive and transparent as possible.

text: 69. Building on the Commission proposals and efforts we have formulated a number of suggestions in this Opinion designed to address effectively the critical issues concerning the tight relationship between privacy and data protection and the Internet.

text: 70. In particular, our remarks focus on the following points:  Internet policy discussions should take into account the nature of fundamental rights of privacy and data protection. Such rights are at the basis of users` online interactions and should be protected online as well as offline.  Discussions over Internet Governance should include privacy and data protection as a priority.  In the framework of a multistakeholder approach to Internet Governance, we support measures to ensure broad stakeholder representation, including the recognition of the role of data protection authorities in improving the consistency of enforcement of data protection rules at global level.  We welcome that the Commission is committed to promoting the swift adoption of key legislation, in particular the proposed General Data Protection Regulation. The strengthening of data subjects’ rights and the right to erasure should become part of the Internet Governance reform.  The Commission should promote a comprehensive approach to Internet Governance, and ensure security of personal data processing. We invite the Commission to take action in order to facilitate coordination of security policies at global level, as any conflict of such policies would jeopardise both security and data protection.  We welcome the Commission’s reference to the close relationship between technological design and data protection. We encourage the Commission to work towards the inclusion of optimal data protection standards in the technology at the early design phase (data protection-by-design and data protection-by-default).  In relation to network neutrality, we strongly recommend, that, without prejudice to the current debate on network neutrality, any solution ultimately adopted should gather widespread consensus as to the principles to be applied and on the need to provide for adequate safeguards for users and their rights.  We support the Commission`s efforts in finding a rapid solution to conflicts of law that often arise in connection with the Internet and jeopardise users´ rights to privacy and data protection. We also propose that, in cases involving conflicting jurisdictions, users are provided with additional and more accurate information as to the data protection laws and safeguards applied to the processing of their personal data.  We call for greater efforts, by the Commission and other private and public stakeholders, in order to reinforce international cooperation in the field of data protection as well as the convergence of international stakeholders on common technical and data protection standards.  We expect the Commission to show leadership and act as a catalyst in the discussions on the new Internet Governance model. In particular, we encourage the Commission to promote EU standards on data protection as well as to encourage the accession by third countries to relevant international data protection standards. Furthermore, we support the adoption of an international instrument requiring the respect of data protection standards by intelligence and law enforcement bodies. Done in Brussels, 23 June 2014 (signed) Giovanni BUTTARELLI


text: OJ L 281, 23.11.1995, p. 31. 2 OJ L 8, 12.1.2001, p. 1. 3 COM(2014) 43 final. 4 COM(2014) 40 final. Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: See EDPS policy paper: “The EDPS as an advisor to EU institutions on policy and legislation: building on ten years of experience”, 4 June 2014, available on the EDPS website at www.edps.europa.eu. 6

text: Article 4(1)

text: point 40 of

text: Regulation (EU) No 575/2013

text: of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending

text: Regulation (EU) No 648/2012

text: These ‘entities’ referred to in Article 12(2) of the proposal on transparency of SFTs include various national authorities and EU bodies, and also ‘relevant authorities of a third country which have entered into an agreement with the EU or with the ESMA’ (

text: Article 83(1) of Regulation (EU) No 648/2012

text: of the European Parliament and of the Council of 4 July 2012 on OTC derivatives, central counterparties and trade repositories, OJ L 201, 27.7.2012, p.52).

text: Joined Cases

text: and

text: , Schecke, judgment of 9 November 2010, paragraphs 56-64.

text: See detailed recommendations in EDPS Opinions of 10 February 2012 on proposals on markets in financial instruments and on proposals on criminal sanctions for insider dealing and market manipulation, available on the Consultation section of the EDPS website at www.edps.europa.eu. 10

text: Case C-131/12

text: Google Spain, judgment of 13 May 2014, paragraph 93.

text: Case C-131/12

identifier: EDPS yttrande (2014)

amnesord:
Finance & Economy
Internal Market

publisher: Europeiska datatillsynsmannen

sprak: en

title: Reporting and transparency of securities financing transactions

serie: yttranden

text: Opinion of the European Data Protection Supervisor

type: stycke

text: on the proposal for a Regulation of the European Parliament and of the Council on structural measures improving the resilience of EU credit institutions and on the proposal for a Regulation of the European Parliament and of the Council on the reporting and transparency of securities financing transactions

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular

text: Article 28(2)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION

text: 1. On 29 January 2014, the Commission adopted two proposals on the regulation of the European banking system: a proposal for a Regulation of the European Parliament and of the Council on structural measures improving the resilience of EU credit institutions (‘the proposal on credit institution resilience’), and a proposal for a Regulation of the European Parliament and of the Council on the reporting and transparency of securities 4 financing transactions (‘the proposal on transparency of SFTs’). The proposals form part of the wide-ranging overhaul of financial regulation and supervision which the EU has undertaken since the onset of the financial crisis. They set out rules for preventing the biggest and most complex banks from engaging in proprietary trading, they would give supervisors the power to require those banks to separate certain potentially risky trading activities from their deposit-taking business and would increase transparency of certain transactions in the shadow banking sector. They are accompanied by a single impact assessment and were adopted together as a package.

text: 2. Each proposal involves the processing of personal data including the publication of details about individuals who have been subject to sanctions for breaches of the proposed rules. It is regrettable therefore that the EDPS was not consulted prior to the adoption of the proposals, as required by Article 28(2) of Regulation (EC) No 5 45/2001 . The EDPS recognises the legitimate public policy goal behind these proposals, and welcomes the fact that some data protection safeguards are envisaged. However, there are several areas where greater attention to the rights of the individual is required.

text: 2. GENERAL COMMENTS

text: 3. Both proposals refer to the protection of personal data under EU law. Recital 33 of the proposal on credit institution resilience recalls that ‘the disclosure of information relating to prudential supervision and for the application of this Regulation’ may involve personal data which should ‘be retained by the competent authority only for the period necessary in accordance with the applicable data protection rules’. Recital 25 of the proposal on transparency of SFTs states, ‘This Regulation respects the fundamental rights and observes the principles recognised in the Charter of Fundamental Rights of the European Union, in particular the right to the protection of personal data, the right to respect private and family life (…). This Regulation must be applied according to these rights and principles’.

text: 4. Neither proposal includes a correct reference to the applicable data protection rules. Recital 33 of the proposal on credit institution resilience refers to

text: Regulation (EC) No 45/2001

text: , which addresses personal data processing by EU institutions and bodies. Given that, as indicated in

text: Article 31

text: and Recitals 32 and 42 of the proposal, some personal information, notably on sanctions, may be provided by competent authorities to an EU body, the European Banking Authority (EBA), Regulation 45/2001 is indeed relevant. However, ‘competent authority’, under Article 5(7) of this proposal, is defined in another instrument,

text: Regulation (EU) No 575/2013

text: , as ‘a public authority or body officially recognised by national law, which is empowered by national law to supervise institutions as part of the supervisory system in operation in the Member State concerned’. Such national supervisory bodies are subject to rules and obligations on data protection contained not in Regulation 45/2001 but rather in national provisions implementing Directive

text: 5. Meanwhile, the proposal on transparency of SFTs envisages data processing by various physical or legal persons (including managers of alternative investment funds, trade repositories and national competent authorities) to which Directive

text: applies, and by the European Securities and Markets Authority (ESMA), another EU body, to which Regulation 45/2011 applies. However, the proposal contains no reference to applicable data protection law.

text: 6. A correct and consistent reference to applicable law, citing both national provisions implementing Directive

text: and Regulation 45/2001, should therefore be included in both proposed instruments.

text: 3. SPECIFIC COMMENTS 3.1. Transparency of SFTs

text: 7. Under Article 4 of the proposal on transparency of SFTs, counterparties to SFTs must keep a record of any transaction that ‘they have concluded, modified or terminated for at least ten years following the termination of the transaction’ and must report details of these transactions to a registered trade repository. These records and reports on SFTs will include ‘at least: the parties to the SFT and, where different, the beneficiary of the rights and obligations arising from it’.

text: 8. Neither the proposal nor the impact assessment explains why a minimum retention period of ten years for information which includes personal data was considered proportionate and appropriate. The EDPS recommends that this provision should stipulate an appropriate maximum retention term for personal information. As it is envisaged that the ESMA will develop draft regulatory standards specifying the details of the SFT to be included, the EDPS will be pleased to provide advice on the inclusion of appropriate limitations and safeguards in due course. 3.2. Confidentiality and professional secrecy

text: 9. Article 4(4) of the proposal on transparency of SFTs requires trade repositories (defined under

text: Article 3(1)

text: as ‘the legal person that centrally collects and maintains the records of security financing transactions’) and the ESMA to observe confidentiality, integrity and protection with respect to SFTs information.

text: Article 18(1)

text: states, ‘The obligation of professional secrecy shall apply to all persons who work or have worked for the entities referred in

text: Article 12(2)

text: and the competent authorities referred to in

text: Article 16

text: , for ESMA, EBA and EIOPA or for auditors and experts instructed by the competent authorities or ESMA, EBA and EIOPA. No confidential information that those persons receive in the course of their duties shall be divulged to any person or authority except in summary or aggregate form such that an individual counterparty, trade repository or any other person cannot be identified, without prejudice to cases covered by criminal or tax law or to this Regulation.’ . “18(2) Without prejudice to cases covered by criminal or tax law, the competent authorities, ESMA, EBA, EIOPA, bodies or natural or legal persons other than competent authorities which receive confidential information pursuant to this Regulation may use it only in the performance of their duties and for the exercise of their functions, in the case of the competent authorities, within the scope of this Regulation or, in the case of other authorities, bodies or natural or legal persons, for the purpose for which such information was provided to them or in the context of administrative or judicial proceedings specifically relating to the exercise of those functions, or both. Where ESMA, EBA, EIOPA the competent authority or another authority, body or person communicating information consents thereto, the authority receiving the information may use it for other non-commercial purposes. 8(3) Any confidential information received, exchanged or transmitted pursuant to this Regulation shall be subject to the conditions of professional secrecy laid down in paragraphs 1 and 2. However, those conditions shall not prevent ESMA, EBA, EIOPA, the competent authorities or the relevant central banks from exchanging or transmitting confidential information in accordance with this Regulation and with other legislation applicable to investment firms, credit institutions, pension funds, insurance and reinsurance intermediaries, insurance undertakings, regulated markets or market operators or otherwise with the consent of the competent authority or other authority or body or natural or legal person that communicated the information.”.

text: 11. These derogations in sub-articles

text: and

text: appear convoluted and vague as such could pose risks to relevant data subjects. The provisions do not indicate clearly the extent to which ‘information’ and ‘confidential’ information referred to in this article include personal data, although it is fair to assume that some personal information, such as the identity of employees or clients of a credit institution, would be involved. Furthermore, the list of individuals or organisations between whom information exchange is envisaged is very broad, goes beyond the competent authorities and EU bodies primarily concerned by the proposal, and does not address whether or not these other individuals or organisations need to obtain this information. The provisions do not indicate either whether the transfer of personal data to a third country, which is subject to specific restrictions under Articles

text: and

text: of Directive 95/46/EC, could take place under this derogation. It is unclear who would be legally responsible for its processing as data controller under

text: Article 2

text: (d) of Directive

text: and

text: Article 2

text: (d) of Regulation 45/2001.

text: 12. We note that ‘information’ could be exchanged or ‘transmitted’ for purposes other than were originally processed. Insofar as this information includes personal data, the further use of the personal data for other purposes must respect the principle of purpose limitation set forth in

text: Article 6(1)

text: (b) of Directive

text: and

text: Article 4(1)

text: (b) of Regulation 45/2001. According to the principle of purpose limitation, personal data must be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes.

text: 13. The EDPS recommends that Articles

text: and

text: are reformulated to clarify whether or not personal data are within the scope of this derogation and, if so, to state that those data may only be processed for compatible purposes and in accordance with applicable data protection rules. It should also be clarified whether personal data transfers to third countries are envisaged and if so, that such transfers may only take place in accordance with national provisions implementing Articles

text: and

text: of Directive 95/46/EC. 3.3. Administrative sanctions and measures

text: 14. Case law from the CJEU has established that any publication obligation which entails the processing of personal data must be based on a balanced assessment of the public interest objective pursued and the need to respect individuals’ rights to privacy and the protection of personal data, and on an assessment of whether there are less restrictive measures to attain the same objective. Such an obligation should in any event be supported by adequate safeguards to ensure respect of the presumption of innocence, the right of the persons concerned to object, the security and accuracy of the data and their deletion after an appropriate period of time . Moreover, data relating to offences, criminal convictions or security measures benefit of a specific protection under

text: Article 8(5) of Directive 95/46/EC

text: and may only be processed under the control of official authority, or if suitable specific safeguards are provided under national law, subject to derogations which may be granted by the Member State under national law.

text: Article 28(4)

text: (c) of the proposal on credit institution resilience and

text: Article 20(4)

text: (c) of the proposal on transparency of SFTs each provide that, in the event of breaches of the proposed rules, competent authorities should have the power to issue ‘a public warning indicating the person responsible and the nature of the breach’. As this could interfere with the individual’s right to protection of personal data, such a power should not be exercised automatically but rather only on a case by case basis and where appropriate and proportionate.

text: 16. In relation to whistleblowing, both proposals (

text: Article 30(2)

text: Article 22(2)

text: (c) of the proposal on transparency of SFTs) correctly provide for the protection of personal data both of the person who reports the breach and the natural person who allegedly committed the breach. Similarly, it is welcome that the proposals (Article 31 of the proposal on credit institution resilience and Article 23 of the proposal on transparency of SFTs) provide for competent authorities to communicate information to ESMA on any criminal sanctions for breaches only in an anonymous and aggregated format. These provisions envisage development by the EBA and ESMA respectively of implementing technical standards to determine procedures and forms for exchange of information; the EDPS would be pleased to advise on how to ensure adequate data protection safeguards as part of this process.

text: 17. Article 32 of the proposal on credit institution resilience and Article 24 of the proposal on transparency of SFTs provide for the publication on the Internet of information on sanctions which would include the type and nature of the breach and the identity of the person subject to the decision. This provision includes a number of appropriate safeguards protecting the rights to privacy and to data protection of the individuals concerned, including a number of alternatives where the competent authority considers on a case-by-case basis that publication of the identity of a legal person would be 10 disproportionate. As the CJEU has recently ruled, publication on the Internet raises specific risks for privacy and data protection and the institution or body responsible for the processing is bound to ensure that the data are adequate, relevant and not excessive in relation to the purposes for which they are processed. In view of the particular intrusiveness of the publication of personal data on the internet in individuals’ rights to privacy and data protection, the EDPS recommends reinforcing the safeguards by making it a requirement for all authorities to consider separately each case and its particular circumstances and to be guided by the principles of necessity and proportionality prior to any decision to publish the identity of the person subject to a sanction.

text: 18. These provisions also would require competent authorities to ensure information on sanctions decisions to be accessible on the website for a minimum period of five years, while personal data in those decisions ‘should be kept on the website of the competent authority for the period which is necessary in accordance with the applicable data protection rules.’ The CJEU held in that respect that even initially lawful processing of accurate data may, in the course of time, become incompatible with Directive

text: where, having regard to all the circumstances of the case, the data appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to the purposes for which they were processed and in the light of the time that has elapsed. A maximum retention period for personal data would therefore be more appropriate.

text: 4. CONCLUSION

text: 19. The EDPS is pleased to note that some account has been taken of data protection aspects in the proposals, and recommends a fuller integration of respect for the rights to privacy and the protection of personal data by means of the following changes: a) the inclusion of a general provision for all processing of personal data pursuant to the proposed regulations to be subject to the rules laid down in Directive

text: and Regulation 45/2001; b) an appropriate maximum term in the proposal on transparency of SFTs for personal information to be retained by counterparties to an SFT; c) regarding the provisions derogating from the obligation for confidentiality and professional secrecy in the proposal on transparency of SFTs, (i) clarification on whether or not personal data are within the scope of this derogation, and if so, the inclusion a statement that those data may only be processed for compatible purposes and in accordance with applicable data protection rules; (ii) clarification whether personal data transfers to third countries are envisaged and if so, add a statement that such transfer may only take place in accordance with national provisions implementing Articles

text: and

text: of Directive 95/46/EC; d) clarifying that the power to issue a public warning about identified individuals should not be exercised automatically but rather only on a case by case basis and where appropriate and proportionate; e) regarding the provisions for publication of sanctions, (i) the inclusion of a requirement in both regulations to consider separately each case and its particular circumstances on the basis of necessity and proportionality prior to any decision to publish the identity of the person subject to a sanction, and (ii) specifying a maximum retention period for personal data published as part of information on sanction decisions on competent authorities websites. Done in Brussels, 11 July 2014 (signed) Giovanni BUTTARELLI

type: vagledning

utgivare: edps


text: OJ L281, 23.11.1995, p. 31. 2 OJ L8, 12.1.2001, p. 1. 3 COM(2014) 212 final. Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: Explanatory Memorandum, Sections 1, 2 and 3.

text: See ECJ 20 May 2003, Rundfunk, Joined Cases

text: and

text: and ECJ 9 November 2010, Volker und Markus Schecke, Joined Cases

text: and

text: See Schecke and Eifert, cited above; in particular, paras 81, 85 and 86. In this case the CJEU underlined that derogations and limitations in relation to the protection of personal data must apply only in so far as strictly necessary. The CJEU considered, in particular, that the European institutions should explore different methods of publication in order to find the one which would be consistent with the purpose of the publication while causing the least interference with the data subjects' rights to private life and to the protection of personal data.

text: For example, in general, there is likely to be little or no public interest in the public accessibility of information about the identity of the single member of a company several years after this individual has ceased to be a single-member of the company.

amnesord:
Article 8 - right to data protection
Necessity & Proportionality
Privacy by Design
Accountability
Large-Scale IT Systems
IMI
Internal Market
Transparency

title: Single-member private limited liability companies

text: Opinion of the European Data Protection Supervisor

text: on the Commission Proposal for a Directive of the European Parliament and of the Council on single-member private limited liability companies

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of 2 such data, and in particular

text: Article 28(2)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION 1.1. Consultation of the EDPS

text: 1. On 9 April 2014, the Commission adopted a proposal for a Directive of the European Parliament and of the Council on single-member private limited liability companies ('the Proposal'). On the same day, the Commission sent the Proposal to the EDPS for consultation. 1.2. Objective and scope of the Proposal

text: 2. The overall objective of the Proposal is to ‘make it easier for any potential company founder, and in particular for SMEs, to set-up companies abroad’. To this end, the Proposal aims to ‘harmonise the conditions of setting-up and operation of singlemember limited liability companies’. The Proposal provides for ‘the possibility of online registration, with the standard template for the articles of association, a minimum capital requirement of EUR 1, accompanied by a balance sheet test and a solvency statement.’ To help ensure transparency, it also requires disclosure of certain information about the single-member company in a register accessible to the public.

text: 2. ANALYSIS OF THE PROPOSAL 2.1. Personal data processed under the Proposal

text: 3. Although the processing of personal data is not the main focus of the Proposal, the Proposal nevertheless requires processing of a significant amount of personal data. These typically relate to the single-members of the companies, if they are individuals, as well as to the individuals who are representing the companies. The following provisions of the Proposal are particularly relevant from the data protection perspective: Registration requirements 

text: Article 13

text: requires certain data about the company, its single-member and its representatives to be registered. These include, in relevant part, the name, address, and other identifying information about the founding member, beneficial owner, and representative that registers the company; as well as names, addresses and other identifying information about the persons authorised to represent the company, along with information about whether or not the representatives of the company have been disqualified from serving as such. Information exchange via the internal-market information system (‘IMI’)  Recital 17 and Articles

text: and

text: provide for the possibility to exchange information in connection with the registration process via IMI. This also includes information about the identity of the founder and about the disqualification of the proposed representatives. Public disclosure requirements  Recital 2 and

text: Article 3

text: require the compulsory disclosure of the identity of the single member in a publicly available register. This includes personal data in case the single-member is an individual.  Recital 14 refers to compulsory public disclosure of all other registered documents related to the company. 2.2. References to applicable data protection law and to the EDPS consultation

text: 4. In light of the processing of personal data outlined above, we recommend that a substantive provision, or at least a recital, be added to refer to applicable data protection legislation, including national law implementing Directive

text: 5. Further, we recommend that the preamble refer to the fact that the EDPS has been consulted. 2.3. Registration requirements (Chapter 4)

text: Article 13

text: requires certain data about the company, its single-member and its representatives to be registered in the register of companies maintained by the competent body of the Member State concerned. These include, in relevant part, the name, address, and other identifying information about the founding member; as well as information about whether or not the representatives of the company have been disqualified from serving as such.

text: 7. Making available this information to the entities responsible for registration prima facie appears to be adequate, relevant and not excessive in relation to the purpose of registering the single-member companies in question, and thus, complies with

text: Article 6(1)

text: (c) of Directive

text: . Therefore, the EDPS raises no objections regarding the data to be collected, even if this may include significant amount of personal data. This is a matter distinct from the issue of what personal data may be made publicly available via the registry, which we will discuss in Section 2.5 below. 2.3. Information exchange via IMI

text: 8. Recital 17 and Articles

text: and

text: 9. We welcome the fact that the Commission considers the use of an existing information exchange tool such as IMI, taking into account that it has already invested significant efforts in ensuring that IMI is developed taking into account the principle of data protection by design.

text: 10. At the same time, we would welcome further clarifications in the Proposal regarding what personal data may be exchanged via IMI. In particular, it is not clear from the Proposal whether personal data will be exchanged routinely, as a standard practice to verify the identity of the founder of the single-member company to be registered or only in case doubts arise as to the identity of the founder.

text: 11. Similarly, it is not clear whether the intention is to routinely check on each occasion via IMI whether the statements regarding lack of disqualification of the representatives of the company are truthful, or whether this is done only in case of doubt.

text: 12. It is also not clear whether IMI can be used only to check whether a statement regarding disqualification is truthful (yes or no) or also whether it can be used to require further details regarding the reasons for the disqualification.

text: 13. We recommend that these points be clarified in the text of the Proposal itself, in order to ensure legal certainty, and prevent potential inconsistent practice arising out of different implementation in the Member States concerned.

text: 14. The EDPS would also welcome a general reference in the text of the Proposal to the requirement that any personal data exchanged must be proportionate to the objective of the information exchange, in accordance with

text: Article 6(1)

text: (c) of Directive

text: . 2.5 Public disclosure requirements

text: 15. Recital 2 and

text: Article 3

text: require the compulsory disclosure of the identity of the single member in a public register (or in a register kept by the company and accessible to the public). This includes personal data in case the single-member is an individual.

text: 16. In addition, Recital 14 suggests that ‘in order to ensure a high level of transparency, all documents registered at the register of companies should be made publicly available via the system of interconnection of registers referred to in

text: Article 4

text: (a)2 of Directive

text: ’. These data, in relevant part, may include the name, address, and other identifying information about the founding member, beneficial owner, and representative that registers the company; as well as names, addresses and other identifying information about the persons authorised to represent the company, along with information about whether or not he or she has been disqualified from serving as such. Balancing transparency and data protection/privacy

text: 17. The EDPS acknowledges the importance of the objectives of transparency and accountability, which these provisions serve.

text: 18. With regard to the interplay between EU law and national law in this regard, the EDPS would like to underline that unlike data protection laws, which are harmonised to a certain degree based on Directive

text: , access to information laws significantly diverge across EU Member States. Same is true for laws regulating what information is to be published in trade registers, and in registers held by the companies themselves, and in what way the public is given access to this information.

text: 19. In principle, access regimes typically call for a balancing test that compares the interests protected by privacy and data protection rules against the benefits of openness and transparency. Considering the divergences, the outcome of the balancing exercise may be different in the different EU Member States. For example, trade registers in some Member States may publish the addresses of company’s representatives, whereas another Member State would consider this as information that, in general, while registered, should not be made publicly available.

text: 20. That being said, national legislation must comply with Article 8 of the European Convention on Human Rights (‘ECHR’) as well as Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘EU Charter’) when implementing EU law. This implies, as the European Court of Justice held in the sterreichischer Rundfunk and Schecke cases that it should be ascertained that the disclosure is necessary for and proportionate to the legitimate aim pursued by the law.

text: 21. In view of the lack of harmonisation on these issues at EU level, the EDPS would have welcomed more clarity and legal certainty in the text of the Proposal and more detailed and more specific consideration of alternatives in the Impact Assessment. That said, he does not, in principle, have objections against the possibility of public disclosure of registration information, so long it is clear what data will be made publicly available and further provided that any public disclosure is made taking into account the principle of proportionality, and subject to appropriate safeguards under the Proposal and/or under national law. This should be made clear in the text of the Proposal. What registration data should be publicly disclosed and subject to what safeguards?

text: 22. Recital 14 appears to require publication of all ‘registered documents’ via the common European platform it refers to. At the same time, the Proposal has no substantive provision among its articles that would clearly specify this requirement. Only with respect to the identity of the sole member,

text: Article 3

text: provides for a substantive provision.

text: 23. We recommend that Recital 14 be revised to specifically refer to the documents to be made available publicly - rather than simply saying ‘all’ must be public. We also recommend that a substantive provision, similar to

text: Article 3

text: , be added to this effect to ensure legal certainty.

text: 24. Finally, we also recommend that with regard to publication of addresses and identifying information of individuals (be them the founders, beneficial owners or representatives), legislators make a careful assessment as to the proportionality of public disclosure of any personal data, and also that the Proposal provide that any publication will be made subject to data protection safeguards under national law. Information regarding disqualification

text: 25. The EDPS welcomes the fact that

text: Article 22(6)

text: limits the registration and public disclosure of information regarding disqualification to cases when the disqualification is currently in effect. In other words, no information has to be provided during the registration process (or publicly disclosed) with regard to any past disqualification that is no longer in effect (or that has not yet come into effect). Purpose limitation and limitations on accessibility

text: 26. As an additional safeguard, the EDPS calls attention to the principle of purpose limitation set forth in

text: Article 6(1)

text: (b) of Directive

text: . He recommends that the Proposal clearly specify that the personal data made publicly available under the Proposal may be used for purposes of transparency and accountability and shall not be used (by anyone) for any incompatible purposes (such as, for example, for marketing to these individuals, or creating profiles of these individuals).

text: 27. As a related point, the EDPS recalls that once data have been made publicly available, especially if this has been done via the internet, it is very difficult, if not impossible, to have any definitive control over what will happen to that information. For example, it will not be possible to definitely ensure deletion or inaccessibility of the data after a certain period of time.

text: 28. Nevertheless, considering that the information published, in principle, will not serve its intended purposes after an appropriate, limited period of time , we recommend that the Proposal require that Member States ensure that the companies/registers take appropriate technical and organisational measures to limit the accessibility of personal data after an appropriate period of time. For example, measures can ensure that the companies/registers concerned will either take off from their websites information relating to out-dated information, or that the personal data available in the archives of the registry will not be searchable by the names of the single-members concerned, and not be available for search by external search engines either in this manner.

text: 29. Accurate and prompt updates are particularly important with regard to information of more sensitive nature, such as disqualification. It is also essential to ensure that the accessibility of the name, address and any other identifier of the single member, if an individual, will be limited to the extent possible once they are no longer singlemembers. Data subjects rights, including information to the data subjects

text: 30. Sections IV to VII of Directive

text: require that certain information be given to the data subjects and also give certain rights to the data subjects, including rights of access, and the right to object.

text: 31. With regard to the information given to data subjects, we note that, as discussed elsewhere, it is essential that some information be already provided in the Proposal and/or in national law, such as the types of data to be processed (registered, exchanged via IMI or published, as the case may be) and the purposes of processing (accountability and transparency in case of publication). Additional information should also be provided to the individuals concerned by the controllers (companies, company registers, as the case may be) about the processing of their personal data, in accordance with Articles

text: and

text: of Directive 95/46/EC (such as the time limit for retention of personal data and information on how individuals can exercise their rights).

text: 3. CONCLUSIONS  We welcome the consultation of the EDPS on this Proposal and the fact that the Proposal limits the collection of data on disqualifications currently in effect, and that it specifies that information exchanges could be carried out under the IMI system.  In the present Opinion we recommend the following further improvements:  A substantive provision, or at least a recital, should be added to refer to applicable data protection legislation, including 'national law implementing Directive

text: ’.  The preamble should refer to the fact that the EDPS has been consulted.  The Proposal should be more explicit on what personal data may be exchanged via IMI, including whether additional information can be collected with regard to disqualifications.  The Proposal, in a substantive provision, should more clearly specify the documents to be made available publicly, subject to a careful assessment of proportionality, and should also specify that any publication will be made subject to data protection safeguards under national law.  Further, the Proposal should specify that the personal data made publicly available under the Proposal may be used for purposes of transparency and accountability and shall not be used for any incompatible purposes .  Finally, the Proposal should also require the registers/companies to ensure that technical and organisational measures are put in place to limit accessibility of the information regarding individuals (such as single-members or company representatives) after a certain period of time. Done in Brussels, 23 July 2014 (signed) Giovanni BUTTARELLI


text: OJ L281, 23.11.1995, p. 31. 2 OJ L8, 12.1.2001, p. 1. 3 (2014)333/EU. Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: COM(2008)328 final, 30.5.2008.

text: Opinion 06/2014 on the notion of legitimate interests of the controller under

text: Article 7 of Directive 95/46/EC

text: , adopted on 9 April 2014 (

text: These issues can be particularly of concern with regard to the interconnection of criminal records. Criminal records must be translated with a full explanation of the meaning of sentences, and the court process. Concerns arise regarding accuracy and understanding of the information stored and regarding how any misunderstanding can be rectified.

text: Relevant Opinions of the

text: Article 29

text: Data Protection Working Party, including Opinion 3/2013 on purpose limitation, adopted on 03.04.2013 (

text: ), and Opinion 06/2013 on open data and public sector information ('PSI') reuse, adopted on 05.06.2013 (

text: ) may facilitate this reflection.

amnesord:
Judicial Cooperation
Technologies

title: European e-Justice Portal

text: Opinion of the European Data Protection Supervisor

text: on the Commission Decision on the protection of personal data in the European e- Justice Portal

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of 2 such data, and in particular

text: Article 41(2)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION 1.1. Consultation of the EDPS

text: 1. On 5 June 2014, the Commission adopted a Commission Decision on the protection of 3 personal data in the European e-Justice Portal ('the Decision').

text: 2. We welcome the fact that we were consulted on this Decision prior to its adoption and that we were given the possibility to provide informal comments to the Commission. The Commission took into account several of these comments. As a result, the data protection safeguards in the Decision have been strengthened. We also welcome the reference in the preamble to the consultation of the EDPS. 1.2. Context, objective and scope of the Decision

text: 3. As explained in recitals 1-3 of the Decision, in its communication of May 2008 , the Commission stated that it would design and set up the European e-Justice Portal ('Portal'), to be managed in close cooperation with the Member States. The Portal was launched on 16 July 2010 and is now ready for the first interconnection of national registers involving the processing of personal data. The Portal's objective is to contribute to the achievement of the European judicial area by facilitating and enhancing access to justice and leveraging information and communication technologies to facilitate cross-border electronic judicial proceedings and judicial cooperation.

text: 4. Recitals 4-5 of the Decision highlight the importance of data protection and provide that since the various Portal-related tasks and functions of the Commission and the Member States will entail different responsibilities and obligations as regards data protection, it is essential to delimit them clearly. Accordingly, the Decision aims at providing more clarity and legal certainty with regard to the responsibilities of the Commission as a controller in connection with its activities relating to the operation of the Portal.

text: 2. ANALYSIS OF THE DECISION 2.1. Introduction and general comments

text: 5. Article 1 of the Decision (under the heading 'Subject matter') provides that the 'Decision lays down the functions and responsibilities of the European Commission in relation to data protection requirements whilst processing personal data in the European e-Justice Portal'.

text: 6. We welcome the fact that the Commission adopted the Decision with the aim to provide clarifications regarding the roles and responsibilities of the Commission with respect to the processing of personal data through the e-Justice Portal.

text: 7. As a general comment, we highlight the importance of ultimately adopting a new legal instrument (the future Regulation on e-Justice) under the ordinary legislative procedure, in order to establish a comprehensive legal basis and provide more transparency, specificity and legal certainty with regard to the processing of personal data through the Portal and the data protection safeguards that apply under Regulation 45/2001, Directive

text: and national data protection law.

text: 8. A clear legal basis is especially important as the Portal is an ambitious project that already facilitates the processing of large amounts of personal data and will only grow in volume and complexity over time.

text: 9. We highlighted the need for such a legal basis in previous communications with the Commission services, and also in our Opinion of 27 March 2013 on the Commission proposal for a Regulation amending

text: Council Regulation (EC) No 1346/2000

text: on insolvency proceedings.

text: 10. The adoption of the Decision is a significant and welcome step towards transparency, legal certainty, and specific safeguards to protect the personal data processed via the Portal. We certainly understand the Commission's preference for a step-by-step approach and also acknowledge that in some areas separate legal bases are already in place or are currently in the legislative process (e.g. insolvency, ECRIS and business registers).

text: 11. We understand that the work on the development of a draft Regulation on e-Justice has already started. We encourage the Commission to increase its efforts for a swift adoption of the future Regulation on e-Justice. The following specific comments, while directly reflecting on the text of the Decision itself, are primarily aimed at providing preliminary guidance with regard to drafting the future e-Justice Regulation. 2.2. Specific comments 2.2.1. Scope of the e-Justice Portal

text: 12. Article 3 of the Commission Decision (under the heading 'Data processing') provides that the 'Commission shall process personal data in the Portal only in so far this is necessary for the purposes of: (a) providing access to interconnected national databases holding personal data; (b) providing interactive services allowing registered users to communicate directly with the appropriate authorities in another Member State; (c) providing access to public information targeted towards registered users;(d) providing contact information'.

text: 13. Pursuant to the e-Justice Communication of 30 May 2008, examples of what the e- Justice Portal may be used for include interconnection of national criminal records, inter-connection of insolvency registers, business registers, land registers, and others.

text: 14. To help ensure legal certainty, the future Regulation on e-Justice should more clearly specify the current and possible future scope of the e-Justice Portal. This could include a list of the various interconnected national databases and inter-active services (now only generally referred to in

text: Article 2

text: (c) and in Article 3 of the Decision), to be updated where necessary. A similar technique has already been used, for example, in connection with defining the scope of the Internal Market Information System in the IMI Regulation (

text: Regulation (EU) No 1024/2012

text: ). 2.2.2. Legal grounds for the processing of data in the e-Justice Portal

text: 15. The Decision is silent on the legal basis for the processing of personal data via the Portal. Here it is useful to point out that the Commission Decision in itself does not provide a sufficient legal ground for the processing of personal data via the e-Justice Portal.

text: 16. As the

text: Article 29

text: Data Protection Working Party provided in its Opinion on legitimate interest 'sufficiently detailed and specific authorisation by law is ... required ... in case the processing by public authorities interferes with the privacy of the data subjects'.

text: 17. This 'sufficiently detailed and specific authorization by law' can, of course, be given in separate legislation, for example, for each interconnected system, such as, in the legislation that provides a legal basis for the interconnection of the insolvency registers or the interconnection of criminal records. In addition, it is also possible that the future e-Justice Regulation may itself provide a legal basis for some types of processing operations. 2.2.3. Responsibilities of the Commission as a controller within the Portal as referred to in this Article'.

text: 19. We welcome this statement and the clarifications of the role of the Commission in the remainder of

text: Article 4

text: . Further, we also welcome the fact that

text: Article 5(2)

text: imposes additional requirements on the Commission to provide information to data subjects, including 'on whom to contact for the effective exercise of their rights to information, to access, to rectify and to object according to applicable data protection legislation'.

text: 20. We also welcome the efforts of the Commission in Article

text: and

text: to make it clear for which aspects of the operation of the e-Justice Portal it is not responsible for.

text: 21. At the same time, we would welcome further clarifications on who bears responsibility and needs to take action if something goes wrong, legally, technically, or otherwise, with the operation of the Portal or the operation of one or another of the interconnected public registers.

text: 22. These specifications can also be made in separate legislation, for each interconnected system, such as, for example, in the legislation that provides a legal basis for the interconnection of the insolvency registers. In the long term, a more horizontal approach, with general rules in the future e-Justice Regulation and, as needed, specific rules in specific thematic legislation if needed could perhaps be most workable.

text: 23. These provisions could specify, for example:  who is responsible for erroneous machine translations or any errors arising out of the pre-determined text and terminology used across linguistic/legal differences ;  who is responsible for eventual design faults of the portal, or any interfaces with national systems.

text: 24. With regard to security of the personal data, we welcome the fact that

text: Article 4(5)

text: requires the Commission to implement the necessary technical measures not only with regard to the data while 'in transit' but also 'during their display on the Portal'. Indeed, the Commission has responsibility for security of data processing in all cases when personal data are in the Commission's control.

text: 25. In this respect, we also note that while

text: Article 3

text: mentions different types of processing that may happen via the Portal,

text: Article 4

text: appears to focus almost exclusively on the interconnection of national databases. Less attention is paid to other important potential data processing activities such as the 'interactive services allowing users to communicate directly with appropriate authorities in another Member States'. Dealing with these types of processing activities should also be addressed in the future e-Justice Regulation.

text: 26. Finally, we would also recommend that a governance system will be put in place for the e-Justice Portal to ensure that:  each party involved in the operation and design of the portal and the inter-connected national databases clearly understands its respective tasks and responsibilities;  proactive measures are taken to implement the data protection by design principle;  swift and efficient measures are taken in case anything goes wrong, and  any decisions taken by the Member States to make data available through the e- Justice Portal from their national databases can be better considered at an early stage.

text: 27. These requirements should also be clearly reflected in the future e-Justice Regulation. 2.2.4. Purpose limitation

text: 28. With the interconnection of various databases concerns invariably arise as to what extent information gathered for one purpose can be used for another purpose, and to what degree, personal data can be combined.

text: 29. Recital 11 of the Decision specifies in this respect that 'it should not be possible to combine information from different interconnected national databases for different purposes through the Portal'. We welcome that the issue of purpose limitation is specifically raised in the Decision and we look forward to cooperate with the Commission, with particular regard to the future e-Justice Regulation, in order to ensure that the purpose limitation principle will be adhered to in practice, while at the same time not presenting unnecessary obstacles to the development of new value-added services and access to information.

text: 3. CONCLUSIONS

text: 30. We welcome the fact that we were consulted on this Decision prior to its adoption and that the Commission took into account several of our comments.

text: 31. In the present Opinion we encourage the Commission to increase its efforts for a swift adoption of the future Regulation on e-Justice. This Opinion contains preliminary guidance to drafting such a future Regulation and provides a non-exhaustive list of items that should be addressed in this future Regulation, including:  Scope of the Portal  Legal grounds for processing of data in the Portal  Responsibilities of the Commission and the various other parties involved as controllers, including with regard to security and data protection by design  Purpose limitation and restrictions, where applicable, on data combination. Done in Brussels, 05 September 2014 (signed) Giovanni BUTTARELLI Assistant European Data Protection Supervisor