text: COM(2025) 545 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2025) 545 final. 4 COM(2025) 545 final, p. 2. Annex I to the Proposal. 6 Annex II to the Proposal. 7 Annex III to the Proposal. 8 Annex IV to the Proposal. 9 Annex V to the Proposal. 4

text: COM(2025) 545 final, p. 2 and 3. 11

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (Text with EEA relevance), OJ L 119, 4.5.2016, pp. 1–88. 12 On the applicability of the EUDPR, see for instance Article 12 of the Proposal, on the Single Gateway. 13

text: Article 12(1)

text: (b) of the Proposal. 14

text: Article 38(2)

text: (b) of Regulation (EU, Euratom) 2024/2509. 15 Article 142(1) of Regulation (EU, Euratom) 2024/2509. 5

text: Article 18(5) of the Proposal. 17 Article 18(5) of the Proposal. The EDPS also notes a reference in this provision to the “website referred to in

text: Article 64(1)

text: of

text: specifying the functions and the information to be exchanged via this “website”. 18 On beneficiaries of EU funds, see judgment of the Court of justice of 9 November 2010, Joined Cases

text: and

text: , Volker und Markus Schecke GbR and Hartmut Eifert v Land Hessen, ECLI:EU:C:2010:662, paragraph 86, where the Court considered that the decision to publish personal data relating to a beneficiary should not be systematic and should be based on relevant criteria such as the periods during which those persons have received such aid, the frequency of such aid or the nature and amount thereof. 19 Article 19 of the Proposal. 20 Article 19(1) of the Proposal. 21 Article 4(1) of the Proposal. 22 Article 8 of the Proposal. 23 Article 14 of the Proposal. 6

text: Article 19(7)

text: , second sentence, of the Proposal. 25 Article 19(6) of the Proposal. 26 Article 19(7) of the Proposal. 27 See EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: , issued on 7 November 2019. 28 Article 14(1) of the Proposal. Further specifications on this exchange system are provided at page 52 of the Legislative Financial and Digital Statement accompanying the Proposal: “This system shall be interoperable and allow for an automatic electronic data exchange with the Single Gateway and the electronic data exchange system between the Member States and the Commission. Member States plans shall contain provisions on reporting of performance data and the electronic transmission to the Commission of the underlying monitoring data.” 7

text: Article 3(8) of the EUDPR; Article 4(7) of the GDPR and Article 3(8) of the LED. 30 See also EDPS Guidance for co-legislators on key elements of legislative proposals, 7 May 2025, paragraph 24 and in particular paragraph 27: “When a proposal establishes a legal obligation or a task in the public interest that requires processing of personal data involving multiple actors (e.g., a proposal requiring exchange of personal data between national public authorities an EU bodies, a provision that requires setting up a common repository at EU level, etc.), the proposal should as a rule identify the roles of the entities that will be involved in the processing. The designation of an entity as controller, joint controller or processor should take place in the enacting terms (operative text) of the proposal rather than in the recitals accompanying the enacting terms of the proposal.” 31 See

text: Article 19(9)

text: and (10) of the Proposal. 32 In particular, the wording creates confusion as to whether Member States competent authorities should still be considered as (joint) controllers when preparing the data and making them available to the Commission. See EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: , issued on 7 November 2019, specifying the criterion of ‘determining the purposes and means”, Section 3. 8

identifier: EDPS yttrande 09/2026

title: EDPS Opinion 9/2026 on the Proposal for a Regulation establishing a budget expenditure tracking and performance framework and other horizontal rules for the Union programmes and activities

text: Opinion 9/2026

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council establishing a budget expenditure tracking and performance framework and other horizontal rules for the Union programmes and activities. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 16 July 2025, the European Commission adopted the Proposal for a Regulation of the European Parliament and of the Council establishing a budget expenditure tracking and performance framework and other horizontal rules for the Union programmes and activities.

text: The Proposal would establish harmonised rules streamlining the reporting and collection of information on the tracking of expenditure of Union budget and on the measurement of the objectives achieved by the programmes and activities financed via the Union budget.

text: The EDPS welcomes the aim of the Proposal, fostering harmonization of information to be collected and, in some cases, published for transparency reasons. At the same time, to ensure a high level of protection of privacy and of personal data, as well as legal certainty, the EDPS recommends introducing clarifications and changes. In particular, the EDPS recommends:

text: - ensuring that the publication of personal data relating to a beneficiary takes place on the basis of criteria established either by EU or Member State law that include distinctions based on relevant criteria (such as the periods during which those persons have received such aid, the frequency of such aid or the nature and amount thereof);

text: - giving practical effect to the principle of data minimisation by clarifying which data is to be processed and in which form, taking into account the different purposes pursued;

text: - to specify the types of special categories of personal data under

text: Article 9

text: GDPR that would be processed for the purposes referred to in Article 19(4) of the Proposal, and - to further specify what are the “administrative and statistical registers” referred to in

text: Article 19(5)

text: . Finally, the EDPS recommends further clarifying the roles of the Commission and of the competent authorities of the Member States as (joint) controllers for the processing of personal data envisaged by the Proposal.

text: Contents 4. Dedicated provision on the processing of personal data .. 6

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 16 July 2025, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council establishing a budget expenditure tracking and performance framework and other horizontal rules for the Union programmes and activities .

text: 2. The Proposal aims to: - make consistent the provisions for supporting principles across the EU budget, thereby reducing complexity for beneficiaries and increasing the coherence of EU action; - streamline and harmonise the system for monitoring EU spending and the performance of the budget, making it possible to aggregate data across programmes, increasing transparency and reducing costs for stakeholders; - harmonise and rationalise the reporting of performance information and the provision of information about funding opportunities across the EU budget, increasing transparency for stakeholders and facilitating access to EU funds for potential beneficiaries .

text: 3. The Proposal is accompanied by five annexes, specifying: intervention fields and indicators ; lists of codes for the territorial dimension ; specific climate and environment spending 7 8 targets ; list of programmes and activities mainstreaming gender ; information, communication and visibility .

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 18 February 2026, pursuant to Article 42(1) of EUDPR. The EDPS recommends including a reference to the present consultation in a recital of the Proposal.

text: 2. General remarks

text: 5. The EDPS welcomes the objectives of the Proposal, particularly the objectives of harmonising provisions across the EU budget as regards horizontal principles (such as gender equality) and streamlining EU budget performance monitoring through standardised performance indicators .

text: 6. Recital 25 of the Proposal clarifies that the application of the Proposal would entail the processing of different categories of personal data relating to entities involved in the implementation of the Union budget so as to allow for, among others, the identification of those entities, calculation of appropriate performance indicators and evaluation of the achievement of objectives in the relevant sectors. Such processing may in particular be necessary for the purposes of carrying out their respective obligations in relation to monitoring and reporting, communication, publication, evaluation, financial management, verifications, audits and, where applicable, determining the eligibility of participants.

text: 7. Against this background, the EDPS recommends including in recital 25 the reference to the applicability of EU data protection law, namely

text: Regulation (EU) 2016/679

text: (‘the GDPR’) and the EUDPR , to any processing of personal data conducted in relation with the activities covered by the Proposal.

text: 3. Publication of personal data

text: 8. The EDPS notes that the Proposal provides for the setting up by the Commission of a dedicated publicly available website (the ‘Single Gateway’), having the functions listed at points (a)-(g) of

text: Article 12(1)

text: . This includes providing information referred to in

text: Article 38

text: and Article 142(1) of Regulation (EU, Euratom) 2024/2509 , which entails the processing of personal data such as the first and last name of the recipient of funds in case of a natural person and the name of persons in the context of publication of exclusion and financial penalties . The EDPS recommends clarifying in

text: Article 12(1)

text: (b) that the publication should occur in accordance with the criteria specified in paragraph (3) of

text: Article 38

text: and paragraph (2) of Article 142 of Regulation (EU, Euratom) 2024/2509.

text: 9. The Proposal requires Member States to ensure information, communication and visibility of support and achievements of the Union funds and communicate to citizens through a website . The EDPS welcomes the specification that publication of personal data must comply with the GDPR . However, the EDPS recommends deleting this reference and rather including this clarification in the recital recalling the applicability of GDPR and EUDPR as recommended in paragraph 7 of this Opinion. Instead, the EDPS recommends specifying in Article 18(5) of the Proposal that the information to be published should contain personal data only insofar as necessary and proportionate to the transparency objective pursued by the publication, on the basis of criteria to be established either by EU law or by Member States .

text: 4. Dedicated provision on the processing of personal data

text: 10. The Proposal contains a horizontal provision on the processing of personal data . The EDPS welcomes the specification according to which personal data can only be processed where necessary for the purpose of carrying out their obligations under the Proposal , as well as the indications provided regarding the categories of personal data to be processed.

text: 11. The EDPS considers that

text: Article 19(1)

text: and (2) of the Proposal reflect the principle of data minimisation enshrined in

text: Article 5(1)

text: (c) of the GDPR. The EDPS recommends adding an explicit reference to this provision by way of a recital. In addition, the EDPS understands that Article 19(2) of the Proposal aims to provide an indication of which categories of personal data may need to be processed in order to pursue the different purposes outlined in

text: Article 19(1)

text: . However, the EDPS understands that

text: Article 19(2)

text: is neither exhaustive (the wording includes “in particular”), nor normative (not each category of personal data mentioned in

text: Article 19(2)

text: will be necessary for each of the purposes mentioned in

text: Article 19(1)

text: 12. Against this background, the EDPS recommends introducing the contents of Article 19(2) of the Proposal to a recital. Instead of the current paragraph 2, the EDPS recommends making a distinction between, on the one hand, processing for which anonymous or pseudonymised data may be sufficient for the purpose being pursued (such as the monitoring of contributions by means of EU coefficients or in the context the budget expenditure tracking and performance framework ) and, on the other hand, processing for which non pseudonymised personal data is necessary (such as verifications of eligibility or in case of audits on beneficiaries of funds ). Such a paragraph would give effective criteria to determine which data is to be processed and in which form (personal, anonymous or pseudonymised).

text: 13. In this regard, the EDPS positively notes that the Proposal already provides that personal data must be provided to the third parties referred to in Article 11(5) of the Proposal only in pseudonymised format or in anonymised format where the disclosure of personal data is not necessary to achieve the objectives of the regulation .

text: 14. The EDPS also welcomes the provisions of the Proposal on data retention , and on access restriction and logs .

text: 15. However, the EDPS recommends specifying the types of special categories of personal data under Articles 9 of the GDPR and 10 of the EUDPR that would be processed only for the purposes referred to in Article 19(4) of the Proposal. The EDPS also recommends clarifying the articulation between this paragraph and Article 9 of the GDPR, by adding a Recital clarifying that the processing of data under this paragraph will take place under

text: Article 9(2)

text: (g) of the GDPR, which provides that the processing of personal data can take place for reasons of substantial public interest.

text: 16. The EDPS also recommends further specifying what are the “administrative and statistical registers” referred to in

text: Article 19(5)

text: , notably on the types of registers from which information, including personal data, would be re-used.

text: 17. Regarding the setting up by the Commission of the Single Gateway, having the functions specified in

text: Article 12(1)

text: (a)-(g), including displaying information on the activities financed by the budget, the EDPS understands that the Commission, as entity determining both the purpose and means of the data processing , would be the controller.

text: 18. The EDPS also notes that the Proposal does not designate as controller, joint controller or processor the Commission and the competent authorities of the Member States regarding the “electronic data exchange system between the Member States and the Commission referred to in Annex XVI to Regulation .../... [National and Regional Partnership Plans – SFC 2028]” .

text: 19. Therefore, the EDPS recommends designating in

text: Article 19

text: the Commission as controller for the processing of personal data provided in Article 12 of the Proposal, and to designate as controller, joint controller or processor the Commission and/or of the competent authorities of the Member States having regard to the “electronic data exchange system” referred to in Article 14(1) of the Proposal, taking into account their respective roles and involvement in the envisaged electronic data exchange system.

text: Article 19(8)

text: -(10) of the Proposal, refer, respectively, to the implementation of the resources of the Fund in accordance with

text: Article 62(1)

text: , first subparagraph, point (a), (b), and (c) of Regulation (EU, Euratom) 2024/2509 (“direct management”; “shared management”; “indirect management”). Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law . Against this background, the EDPS welcomes that the Proposal aims to clarify the roles of the actors involved . However, the EDPS considers that the reference to “data collected by Member States’ authorities and communicated to the Commission are processed for the Commission’s tasks” is not sufficiently clear to effectively determine the role of the Commission as controller (or as joint controller with the national entity or authority) . The EDPS therefore recommends clarifying the criteria to be followed to determine the role of the Commission as controller (or joint controller) when data is “communicated to the Commission and processed for the Commission’s tasks”.

text: 5. Conclusion

text: 21. In light of the above, the EDPS makes the following recommendations: (1) to add a recital to the Proposal referring to the consultation of the EDPS; (2) to add in recital 25 of the Proposal the reference to the applicability of the GDPR and of the EUDPR; (3) to add to

text: Article 12(1)

text: (b) of the Proposal that the publication should occur in accordance with the criteria specified in paragraph (3) of

text: Article 38

text: and paragraph (2) of Article 142 of Regulation (EU, Euratom) 2024/2509; (4) to clarify in Article 18(5) of the Proposal that the information to be published should contain personal data only insofar as necessary and proportionate to the transparency objective pursued by the publication; (5) to ensure that the publication of personal data relating to a beneficiary takes place on the basis of criteria to be established either by EU law or by Member States which makes appropriate distinctions based on relevant criteria such as the periods during which those persons have received such aid, the frequency of such aid or the nature and amount thereof; (5) to give practical effect to the principle of data minimisation by clarifying which data is to be processed and in which form (personal, anonymous or pseudonymised), taking into account the different purposes pursued; (6) to specify the types of special categories of personal data under

text: Article 9

text: GDPR that would be processed for the purposes referred to in Article 19(4) of the Proposal; (8) to specify in Article 19 of the Proposal the controller role of the Commission for the processing of personal data provided in Article 12 of the Proposal, and to specify the controller, joint controller or processor role of the Commission and of the competent authorities of the Member States having regard to the “electronic data exchange system” referred to in Article 14(1) of the Proposal; (9) to further clarify the criteria to be followed to determine the role of the Commission as controller (or joint controller) when data is communicated to the Commission and processed for the Commission’s tasks. Brussels, 17 April 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 9


text: OJ L 281, 23.11.1995, p. 31. OJ L 119, 4.5.2016, p. 1. OJ L 8, 12.1.2001, p. 1. COM/2016/0786 final - 2016/0389 (COD). See Note from the Presidency to delegations on ‘recital 16a and

text: Article 12

text: a in the Presidency text (data protection)’ (ref nr 12351/17) dated Brussels, 21 September 2017. This document is also publicly available in the Council's register under http://data.consilium.europa.eu/doc/document/ST-12351-2017-INIT/en/pdf . See Court of Justice, 7 May 2009, College van burgemeester en wethouders van Rotterdam v. M.E.E. Rijkeboer,

text: , paragraphs 49 to 54. See, e.g. EDPS Opinion 7/2015 on Meeting the challenges of Big Data, call for transparency, user control, data protection by design and accountability, Section 3.3 ‘New, innovative ways to provide information, access and control to individuals’, page 14. See Article 6(1) of the GDPR, last sentence following

text: Article 6(1)

text: (f). See

text: Article 2

text: (e) of

text: Regulation (EC) No 223/2009

text: on European Statistics, which defines statistical confidentiality as ‘the protection of confidential data related to single statistical units which are obtained directly for statistical purposes or indirectly from administrative or other sources and implying the prohibition of use for non-statistical purposes of the data obtained and of their unlawful disclosure’ (emphasis added). See also

text: Article 20(1)

text: and (2) of the same regulation, which sets out that ‘confidential data obtained exclusively for the production of European statistics shall be used by the [national statistical institutes] and other national authorities and by the Commission (Eurostat) exclusively for statistical purposes unless the statistical unit has unambiguously given its consent to the use for any other purposes’. Further, see Article 338 of the Treaty on the Functioning of the European Union (‘TFEU’), which requires that ‘the production of Union statistics shall conform to impartiality, reliability, objectivity, scientific independence, cost-effectiveness and statistical confidentiality’ (emphasis added). See Section 3.2.3, ‘Further processing for historical, statistical or scientific purposes’, on pages 28-33 of Opinion 3/2013 of the

text: Article 29

text: Data Protection Working Party on purpose limitation adopted on 2 April 2013 (

text: ). See Section 3.2.3, pages 28-33 of WP29 Opinion 3/2013 cited above in full.

identifier: EDPS yttrande 10/2017

publisher: Europeiska datatillsynsmannen

sprak: en

title: Regulation on integrated farm statistics

serie: yttranden

text: 20 November 2017 1 | P a g e

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 41(2) of Regulation 45/2001 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to privacy, are respected by the Community institutions and bodies’, and ‘…for advising Community institutions and bodies and data subjects on all matters concerning the processing of personal data’. Under Article 28(2) of Regulation 45/2001, the Commission is required, ‘when adopting a legislative Proposal relating to the protection of individuals’ rights and freedoms with regard to the processing of personal data...’, to consult the EDPS.

text: He was appointed in December 2014 together with the Assistant Supervisor with the specific remit of being constructive and proactive. The EDPS published in March 2015 a five-year strategy setting out how he intends to implement this remit, and to be accountable for doing so.

text: This Opinion responds to a formal consultation by the Council of the European Union pursuant to Articles 41(2)(2) and 46(d) of Regulation 45/2001 and provides comments and recommendations on how to better safeguard the right to privacy and the protection of personal data in the proposed Regulation on integrated farm statistics.

text: 2 | P a g e

text: Executive Summary

text: The draft Regulation on integrated farm statistics, as proposed by the European Commission, after consultation of the European Data Protection Supervisor, raises few data protection issues in and of itself. However, the amendments proposed in the context of discussions in the Council raise new issues not initially present in the Commission proposal. Notably, if these amendments were to be included in the final text, the draft Regulation would become the

text: first EU legislative instrument that would provide for a derogation from the rights of access, rectification, as well as from the right of restriction and the right to object for the processing of personal data for statistical purposes pursuant to Article 89 of the General

text: Data Protection Regulation. The EDPS therefore welcomes that the Council consulted him on this new development, thus providing the opportunity to the EDPS to issue an Opinion at this stage of the procedure.

text: This Opinion focuses on the necessity test for derogations under Article 89 of the GDPR read in the light of the Charter. The EDPS emphasises, in particular, that the rights of access and

text: components of the right to the protection of personal data. Any derogation to these rights must not go beyond what is strictly necessary to achieve its objective and must meet the high standards required by Article 52(1) of the Charter of Fundamental Rights of the European Union and Article 89 of the GDPR.

text: In addition to highlighting the need for a thorough assessment of necessity, the Opinion also points out to the need to minimise the scope of any restrictions, and discusses the nature of the safeguards required. The Opinion also discusses Article 11 of the GDPR, which may potentially help address some of the concerns of national statistical institutes raised by the Council, without the need for any derogations under Article 89 of the GDPR. In particular, in accordance with Article 11, in cases where a controller is able to demonstrate that it is not

text: in a position to identify the data subject, the rights of the data subjects under Articles 15

text: to 20 would not apply.

text: In light of the foregoing, the EDPS recommends that the Council re-assess the necessity for

text: the proposed derogations in the light of the standard established under Article 89 of the

text: GDPR read in the light of the Charter. Unless the EU legislator can provide further justifications for the need for such derogations, and tailor the scope of the provisions more narrowly, the EDPS recommends instead considering to what extent Article 11 of the GDPR may help address legitimate concerns of national statistical institutes. It may be relevant at stages of the data processing when the keys connecting the individuals to the datasets about them have already been deleted, and other technical and organisational measures have been taken to ensure that the individuals can no longer be re-identified by the statistical institutes or by any other party.

text: The EDPS emphasises, however, that for the initial period often necessary for the preparation of statistics during which the individuals must remain directly or indirectly identifiable, the general rules set forth in the GDPR continue to apply. The fact that putting in place technical

text: and organisational measures to provide access and other rights to individuals may require financial and human resources is by itself not a valid justification to derogate

text: from the rights of individuals under the GDPR. This is true for all data subject rights under the GDPR, and especially crucial for rights of access and rectifications explicitly required

text: 3 | P a g e

text: under the Charter, which constitute essential components of the fundamental right to the protection of personal data. 4 | P a g e

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof, Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data , and to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) , Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular Articles

text: and

text: (d) thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION AND BACKGROUND

type: rubrik

text: On 9 December 2016, the European Commission (‘Commission’) adopted a Proposal for a Regulation of the European Parliament and of the Council on integrated farm statistics and repealing Regulations

text: (EC) No 1166/2008

text: and

text: (EU) No 1337/2011

text: (‘Proposal’) . The aim of the Proposal is to create a more coherent, flexible, and inter-linked system of farm statistics, and provide the legislative framework for a programme of farm surveys starting with an agricultural census to run in 2020.

text: The draft Regulation itself, as proposed by the Commission, after consultation of the European Data Protection Supervisor (‘EDPS’), raised only few data protection issues, and these have been appropriately dealt with in the Proposal. Indeed, the EDPS welcomes that he has been consulted by the Commission prior to the adoption of the Proposal and that his informal comments have been taken into account. In particular, he supports the references, in recital 16, to the applicable data protection legislation, Directive

text: and its national implementing provisions, as well as Regulation 45/2001, as the case may be. He also welcomes the reference, in recital 26, to the fact that the EDPS has been consulted. As the Proposal, as published on 9 December 2016, raised no significant outstanding data protection concerns, the EDPS decided at that stage not to issue a formal Opinion.

text: However, some of the amendments discussed in the context of negotiations in the Council of the European Union (‘Council’) during the legislative process raise new issues not initially present in the Commission Proposal. If these amendments were to be included in the final text, the draft Regulation would become the first EU instrument that would explicitly provide a derogation from the rights of access and rectification, as well as from the right of restriction and the right to object pursuant to Article 89 of the General Data Protection Regulation (‘GDPR’).

text: 6 | P a g e

text: This significant new element justifies an Opinion of the EDPS at this stage of the procedure. The EDPS therefore welcomes that the Council decided to consult him on this new development and - on 26 September 2017 - specifically requested the EDPS to look into these amendments proposed in the context of the negotiations in the Council.

text: The purpose of this Opinion is to provide specific recommendations on the draft Regulation focusing on the relevant draft amendments under discussion in the Council. The focus of this Opinion, under Section 2, is to discuss and help assess whether or not the proposed derogations meet the necessity test for derogations for statistical purposes under Article 89 of the GDPR and under Article 52(1) of the Charter of Fundamental Rights of the European Union (‘Charter’). Additionally, in Section 3, the EDPS provides recommendations regarding the proposed provisions on the safeguards.

text: 2. MEETING THE NECESSITY TEST FOR DEROGATIONS

text: 2.1. Standards for derogations under the Charter of Fundamental Rights of the European Union

text: The EDPS, first, emphasises that any derogations from the right to the protection of personal data must not go beyond what is strictly necessary to achieve their objectives and must meet the high standards required by Article 52(1) of the Charter. This Article provides that ‘any limitation on the exercise of the rights and freedoms recognised by this Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others’ (emphasis added).

text: The EDPS also points out that the rights of access and rectification are set out in Article 8(2) of the Charter itself, and are generally considered as essential components of the right to the protection of personal data. Article 8(2) of the Charter specifically sets out that ‘everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified’. The right of access is of particular importance as it enables the data subjects to exercise the other rights provided for by data protection legislation . Therefore, any derogation from these essential data subject rights must be subject to a particularly high level of scrutiny.

text: 2. 2. Derogations relating to processing for statistical purposes under Article 89 of the GDPR

text: Article 89(2) of the GDPR outlines the - more specific - conditions under which Union or Member State law may derogate from certain provisions of the GDPR.

text: First,

text: Article 89(2)

text: limits the possibility to provide for derogations to four specific Articles in the GDPR: 

text: Article 15

text: on the right of access by the data subject; 

text: Article 16

text: on the right to rectification; 

text: Article 18

text: on the right to restriction of the processing; and 

text: Article 21

text: on the right to object.

text: 7 | P a g e

text: Third,

text: Article 89(2)

text: allows any derogations only ‘in so far as’ the rights to be derogated from are ‘likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes’ (emphasis added). This sets a high bar, in line with Article 52(1) of the Charter, discussed above in Section 2.1.

text: 2.3. Assessment of the justifications for the necessity of the derogations proposed by the Council

text: In the new

text: Article 12

text: a, the Council proposes a broad derogation to the fullest extent potentially possible under Article 89 of the GDPR. In particular, the proposed

text: Article 12

text: a provides that

text: ‘where personal data are processed by national statistical institutes and/or other national authorities in the public interest for the statistical purposes falling within the scope of [the Farm Statistics Regulation] and are kept in a form which permits identification of data subjects for no longer than is necessary for the sole purpose of creating Union statistics, the rights referred to in Articles 15, 16, 18 and 21 of [the GDPR] shall not apply in accordance with Article 89(2) of [the GDPR].’(emphasis added).

text: In order to justify the need for the derogations, the Council, in a new recital 16a proposes the following arguments:  ‘application of certain rights set out [in the GDPR] would render the production of Union statistics impossible or would seriously impair the production of such statistics in line with applicable statistical principles’ (emphasis added);  these principles include, in relevant part, the principles of ‘objectivity, reliability, costeffectiveness and statistical quality, including timeliness’ (emphasis added);  ‘granting an access to personal data in all circumstances would be technically extremely difficult given that personal data relating to a particular data subject are dissociated from the identification of the data subject’ (emphasis added);  ‘re-linking of data to a particular national identification number would in most cases require a linking of a large number of statistical files into which those data have been previously dissociated’; it would also require ‘keeping track of the original format in which data records have been received’ (emphasis added);  ‘the exercise of [the right to object and right of restriction], especially when exercised by a large number of subjects, would defeat the purpose of the production of Union statistics, more particularly as regards their representativeness and reliability’ (emphasis added).

text: Each of these arguments will be discussed below.

text: Cost-effectiveness

text: Providing rights of access, rectification, restriction and objection to the individuals concerned undeniably requires a number of technical and organisational measures to be put in place by the controller. Some of these measures may take significant investment of human and financial resources. This is, however, not unique to statistical organisations.

text: The fact that putting in place technical and organisational measures to provide access and other rights to individuals may require financial and human resources in and of itself is not a valid justification for derogating from the rights of individuals under Article 89 of the GDPR. Indeed,

text: Article 89

text: allows derogations only in so far as the data subject’s rights would be likely to ‘render impossible or seriously impair the achievement of the [statistical] purposes’.

text: 8 | P a g e

text: Upholding this high standard is especially crucial for rights of access and rectifications explicitly provided under the Charter, which constitute essential components of the fundamental right of the protection of personal data.

text: Technical difficulties in re-linking statistical files and keeping track of original format

text: In order to assess the validity of this argument, it is useful to distinguish between two different phases of statistical data processing:  the initial phase while re-linking the data is still possible, and indeed, desired in order to enrich statistical data by linking various datasets;  a later phase when statistical data has been prepared, and the keys allowing linking the various datasets can be destroyed.

text: Re-linking files during the initial phase

text: As a first step when creating statistics under the proposed Regulation of Farm Statistics, the respondents (e.g. individual farmers) typically complete a detailed set of survey questions. These survey questions cover items such as geographical location of a farm, details of the owner and manager of the farm, size of the area used for growing wheat, potatoes, grapes or other types of agricultural products, area used for organic farming, number of dairy cows and chickens and the like, set forth in annexes 1 to 5 of the draft Regulation. Other data sources, such as administrative data sources may also be used to complement the data (see

text: Article 4(2)

text: - (4) of the draft Regulation).

text: While preparing official statistics, and in order to ensure statistical confidentiality, statistical institutions, as the proposed recital 16a suggests, ‘dissociate’ the input data gathered from surveys and other sources. In other words, they pseudonymise the input data and also ensure that other technical and organisational measures are in place to minimise the risk that the individuals can be re-identified. This process usually includes key-coding the data and ensuring that the keys, that is, information to link the datasets to the individuals whom they relate to, are kept separately.

text: Once no longer necessary, the keys will be destroyed. For a time, however, typically while the statistical institutes are still in the process of enriching the survey data with data from other sources, the keys are instrumental in relinking the survey data to additional datasets that are necessary for the production of official statistics. During this time, ‘re-linking the data’ routinely occurs. Indeed, the very reason why the keys are not destroyed is often to enable this possibility. If re-linking the data can routinely occur to combine and enrich datasets, it should also be possible to put in place technical and organisational measures to ensure that the same ‘dissociated’ data can also be re-linked on a case by case basis when an individual submits a request for access, rectification, restriction or objection. While the EDPS acknowledges that this requires effort and an innovative mind-set, he considers that in accordance with the principle of data protection by design (now a legal requirement under Article 25 of the GDPR), organisations that invest a lot of effort into finding innovative ways to make use of personal data should use the same innovative mind-set when designing new, innovative ways to provide information, access and control to individuals .

text: For this phase of data processing, the fact that putting in place technical and organisational measures to provide access and other rights to individuals may raise ‘technical difficulties’ in and of itself does not provide an adequate justification for derogating from the rights of individuals under Article 89 of the GDPR.

text: 9 | P a g e

text: Re-linking files after the keys allowing re-linking are destroyed

text: Once re-linking of the files is no longer necessary for achieving the statistical purposes sought, the keys are typically destroyed (additional measures may often also need to be taken to ensure statistical confidentiality but eliminating possibilities to directly linking individuals to the datasets using the keys is typically a minimum requirement at the earliest possible time).

text: In some cases, the original input data can and should be destroyed, and only the final, aggregated statistical data is kept. If appropriate anonymisation techniques have been applied and these ensure that the aggregated statistical datasets no longer contain any personal data, the issue of derogation does not arise as the GDPR will no longer be applicable to these fully aggregated and anonymised datasets.

text: In some other cases, however, some raw data (including, possibly, entire datasets stripped of direct identifiers such as names and addresses but not meeting the high standards required for anonymisation) might need to be kept for statistical purposes for longer periods of time even after the keys are destroyed. Whether or not retaining any data is appropriate and compliant with the principle of data minimisation needs to be assessed case-by-case and is beyond the scope of this Opinion. However, for the cases where any such data would be retained, the EDPS acknowledges the technical difficulties of re-linking the files.

text: The EDPS considers, however, that

text: Article 11

text: GDPR might be relevant in this situation.

text: Article 11 of the GDPR

text: Article 11(1) of the GDPR provides that ‘if the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with [the GDPR].’.

text: Article 11(2)

text: further sets out that where, in the above cases ‘the controller is able to demonstrate that it is not in a position to identify the data subject, the controller shall inform the data subject accordingly, if possible. In such cases,

text: Articles 15

text: to 20 shall not apply except where the data subject, for the purpose of exercising his or her rights under those articles, provides additional information enabling his or her identification’.

text: These provisions may potentially help address some of the concerns of national statistical institutes raised during the discussions in the Council, without the need for any derogations under Article 89 of the GDPR. In particular, under

text: Article 11

text: , in cases where a controller is able to demonstrate that it is not in a position to identify the data subject (such as when the keys are destroyed and other technical and organisational measures are taken to ensure that the individuals cannot be identified, see above), the rights of the data subjects under

text: Articles 15

text: to 20 shall not apply. Consequently, there appears to be no need for specific derogations for such cases to be provided pursuant to

text: Article 89

text: Right to restriction of the processing and right to object

text: The draft recital 16a also suggests that the exercise of the right to restriction of the processing and the right to object under Articles 18 and 21 of the GDPR, especially when exercised by a large number of subjects, could jeopardise the representativeness and reliability of Union statistics.

text: 10 | P a g e

text: As a preliminary remark, the EDPS would like to point out that, far from hindering the reliability of Union statistics, the exercise of the rights of access and rectification is, on the contrary, likely to contribute to their reliability, since the individuals may become aware of any inaccuracies in their data and would be able to rectify these.

text: As far as the rights to restriction and objection are concerned, the EDPS recognizes that in specific circumstances, if a large number of individuals object to all or part of a statistical data collection, this may have a negative effect on the representativeness and reliability of statistics. This argument is sometimes raised in the scientific research context as well (for example, with regard to statistics on rare diseases, where even a few individuals withdrawing their consent or objecting to a processing may have a significant effect and possibly ‘seriously impair’ the outcome of long-term research studies). However, this is by no means true in all cases. Indeed, there are many other cases of statistical data collection, where answer to survey questions is entirely optional, withdrawal of consent is available and the statistical institutes are nevertheless able to design their collection in such a way that reliability and representativeness could be ensured despite any bias caused by ‘self-selection’ of the respondents.

text: Indeed, Article 5(2) of the draft Regulation provides that ‘the core data collection for the survey reference years 2023 and 2026 may be carried out as sample surveys. In that case, Member States shall ensure that the weighted survey results are statistically representative of agricultural holdings within each region’. This suggests that also in the context of the data collection under the draft Regulation, data collection can be organised in such a way as to allow individuals to object to the collection of their data.

text: Any derogation in this regard thus, should be more specifically justified and/or more narrowly tailored.

text: Other considerations regarding the right to object and the legal grounds for processing data

text: Pursuant to

text: Article 21(1)

text: GDPR, as a general rule, the right to object only applies in case the processing is based on one of two specific legal grounds under the GDPR: 

text: Article 6(1)

text: (e), which allows processing where it is necessary for the performance of a task carried out in the public interest; and 

text: Article 6(1)

text: (f), the so-called legitimate interest ground.

text: This means that the right to object does not generally apply in cases where the legal ground is other than the two legal grounds listed above, for example, where the processing is based on the data subject’s consent (

text: Article 6(1)

text: (a) of the GDPR) or where the processing is necessary for compliance with a legal obligation to which the controller is subject (

text: Article 6(1)

text: (c) of the GDPR).

text: The EDPS also notes that

text: Article 6(1)

text: (f) does not provide a suitable legal basis for processing carried out by public authorities in the performance of their tasks, and is therefore not relevant for data processing by national statistical institutes for statistical purposes .

text: In the case of preparation of official statistics, in cases where responses to survey questions are voluntary, processing is normally based on consent under

text: Article 6

text: (a) of the GDPR. In other cases, the processing of personal data is typically based on one of the following two legal grounds.

text: 11 | P a g e

text: First, processing may be based on the legal ground of the necessity for compliance with a legal obligation to which the controller is subject (

text: Article 6(1)

text: (c) of the GDPR). As far as these processing activities are concerned, the right to object would not apply.

text: Second, processing operations that would not directly follow from an explicit legal obligation could be based on the legal basis of

text: Article 6(1)

text: (e), since the purposes of producing official statistics can be considered to be necessary for a performance of a task carried out in the public interest. In that case, however, Article 21(6) of the GDPR already excludes the right to object where ‘such processing is necessary for the performance of a task carried out for reasons of public interest’. Therefore, an additional derogation on top of the one already provided under

text: Article 21(6)

text: does not appear necessary.

text: In light of the foregoing, it appears that there is no need for additional derogations from Article 21 of the GDPR, as this right either simply does not apply or another, appropriate derogation has already been set out in the GDPR.

text: Other considerations regarding the right of restriction of the processing

text: As far as the right of restriction of the processing is concerned, the Council has so far not provided convincing arguments to justify why this right should be derogated from. In any event, the EDPS considers that if an individual, after exercising their rights of access and rectification, corrects inaccurate data (for example, they point out that due to a typographical error, their data includes ten thousand, rather than one thousand dairy cows), this can only help, and not hinder, the reliability of European farm statistics.

text: Conclusions and recommendations on necessity

text: the GDPR read in the light of Article 52(1) of the Charter. The EDPS recommends instead considering to what extent Article 11 of the GDPR may help address legitimate concerns of national statistical institutes. In particular, it may be relevant at stages of the data processing when the keys connecting the individuals to the datasets about them have already been deleted, and other technical and organisational measures have been taken to ensure that the individuals can no longer be re-identified by the statistical institutes or by any other party. Should derogations still be considered necessary on the basis of further evidence, their scope should be, in any event, narrower than in the current proposal.

text: 3. RECOMMENDATIONS ON PROVISIONS ON SAFEGUARDS IN THE PROPOSED AMENDMENTS

text: 3.1. Safeguards relating to processing for statistical purposes under Article 89 of the GDPR

text: Article 89 of the GDPR sets out safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. To put our recommendations into context, below is a brief summary of the relevant provisions on safeguards, focusing on processing for statistical purposes only. Note that these safeguards apply in full, whether or not a derogation is in place.

text: Examples specified in the GDPR: data minimisation, pseudonymisation and anonymisation

text: 12 | P a g e

text: Article 89(1) of the GDPR sets out the requirement that processing for statistical purposes shall be subject to appropriate safeguards, in accordance with the GDPR, for the rights and freedoms of the data subject.

text: Article 89

text: does not provide an exhaustive list of the safeguards necessary. The non-exhaustive list of safeguards set out in

text: Article 89

text: focuses on the following:

text: - safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation; - these measures may include pseudonymisation; - however, in cases where the purposes of the processing (or further processing) can be fulfilled without identification of the individuals, the controller must go beyond pseudonymisation and must ensure that individuals can no longer be identified.

text: Functional separation and the notion of statistical confidentiality

text: It is important to bear in mind that pseudonymisation, while essential in many cases in the field of statistics, is just one of the many technical and organisational measures a controller is expected to take under Article 89 of the GDPR.

text: In the field of statistics, many of these technical and organisational measures are designed to ensure ‘functional separation’. This is a requirement flowing from the principle of statistical confidentiality , but is also considered by data protection authorities as an essential safeguard when processing personal data for statistical purposes . Functional separation and statistical confidentiality require organisations to put in place technical and organisational measures to ensure that personal data processed for statistical purposes cannot be used for non-statistical purposes. This requirement, importantly, includes the prohibition of using confidential data used for statistics for informing decisions or measures that would directly affect the individuals concerned. For example, the responses of an individual to a statistical survey cannot be used by tax authorities to determine the respondent’s tax liability.

text: While in most cases pseudonymisation is an essential minimum requirement to ensure functional separation and statistical confidentiality, the range of additional technical and organisational measures required are typically much larger .

text: 3.2. EDPS recommendations on the safeguards proposed

text: The draft

text: Article 12

text: a(1) as proposed during discussions in the Council provides the following conditions for the derogations to apply:

text:  personal data must be processed by national statistical offices and/or other national authorities;  personal data must be processed in the public interest for the statistical purposes falling within the scope of the [Farm Statistics Regulation];  personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the sole purpose of creating Union statistics.

text: Article 12

text: a(2), in turn, provides for the following safeguards:

text:  the personal data shall only be used for statistical purposes;  the personal data shall not be used for taking measures or decision regarding any particular data subject;  the personal data shall be subject to pseudonymisation or other appropriate safeguards within the meaning of Article 89(1) of the [GDPR] (emphasis added); and

text: 13 | P a g e

text:  the personal data (sic) shall comply with the requirements of statistical confidentiality laid down in

text: Regulation (EC) No 223/2009

text: As explained in Section 2 above, the main concern of the EDPS relates to the lack of sufficient justification for the proposed derogations to data subjects’ rights. However, should the necessity for specific derogations be justified at the later stage, the EDPS would offer the following additional recommendations regarding

text: Article 12

text: a related to the conditions and safeguards.

text: EDPS recommendations on

text: Article 12

text: The EDPS welcomes the clear specification and limitation of the purpose; and limitation of the period of retaining data in a form which permits identification. The EDPS would welcome further clarification on who the ‘other national authorities’ are who may have access to the data, why they need access (and derogations) and what safeguards they provide. He points out that statistical institutes in Member States are typically carefully regulated and have a long tradition of applying the principle of statistical confidentiality. This may not always be the case with regard to other national authorities, and they may also have a conflict of interest and a potential incentive to use the data for non-statistical purposes. If any derogations apply to data processing by these additional national authorities, it should be ensured that equivalent safeguards are also applied to their processing of personal data under Union and/or national law.

text: EDPS recommendations on

text: Article 12

text: The EDPS welcomes the clear statement that the personal data shall not be used for taking measures or decision regarding any particular data subject and the provision requiring that personal data shall only be used for statistical purposes.

text: The EDPS also welcomes reference to safeguards under

text: Article 89(1)

text: and pseudonymisation in particular. However, he warns that pseudonymisation is only one of the technical and organisational measures required and must always be combined with additional measures to be effective. Therefore, using the connector ‘or’ as in ‘pseudonymisation or other appropriate safeguards’ should be reconsidered.

text: To this end the EDPS recommends replacing the text ‘the personal data shall be subject to pseudonymisation or other appropriate safeguards within the meaning of

text: Article 89(1)

text: ’ by the following, or similar, text: ‘the processing of personal data shall be subject to pseudonymisation and other appropriate safeguards under

text: Article 89(1)

text: 4. CONCLUSIONS

text: If the proposed amendments were to be included in the final text, the draft Regulation would become the first EU legislative instrument that would provide a derogation from the rights of access, rectification, as well as from the right of restriction and the right to object for the processing of personal data for statistical purposes pursuant to Article 89 of the GDPR.Given the novelty and importance of this subject, the EDPS welcomes and appreciates the Council’s consultation and concerns for the impact this Proposal may have on the protection of personal data.

text: 14 | P a g e

text:  The EDPS recommends that the Council re-assess the necessity for the proposed derogations in the light of the standard established under Article 89 of the GDPR read in the light of the Charter.  Unless the EU legislator can provide further justifications for the need for such derogations, and tailor the scope of the provisions more narrowly, the EDPS recommends instead considering to what extent Article 11 of the GDPR may help address legitimate concerns of national statistical institutes. In particular, it may be relevant at stages of the data processing when the keys connecting the individuals to the datasets about them have already been deleted, and other technical and organisational measures have been taken to ensure that the individuals can no longer be re-identified by the statistical institutes or by any other party.

text: Should the necessity for specific derogations be justified at the later stage, the EDPS would offer the following additional recommendations regarding

text: Article 12

text: a related to the conditions and safeguards:  The EDPS welcomes the clear statement that the personal data shall not be used for taking measures or decision regarding any particular data subject.  The EDPS also welcomes the provision that requires that personal data shall only be used for statistical purposes.  The EDPS recommends that the text be revised to clearly provide that the processing of personal data shall be subject to pseudonymisation and (rather than or) other appropriate safeguards under

text: Article 89(1)

text: Brussels,

text: Giovanni BUTTARELLI European Data Protection Supervisor

text: 15 | P a g e

text: Notes

text: 16 | P a g e