text: Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: These comments take into account: (i) the draft report (‘Draft Report’) prepared by MEP Marju Lauristin for the LIBE Committee; (ii) the (draft) opinions of the three other EP Committees involved (IMCO, IURI and ITRE); and (iii) the additional amendments 136 to 827 submitted by Members of the LIBE Committee to the Draft Report. All relevant EP documents available at the European Parliament’s Legislative Observatory at http://www.europarl.europa.eu/oeil/popups/ficheprocedure.do?reference=2017/0003(COD)&l=en The EDPS also takes note of developments at the Council. See, e.g. Council 11995/17, 8 September 2017. For instance, some amendments to

text: Article 19

text: suggest a specific list of topics on which guidelines should be issued by the European Data Protection Board (‘EDPB’). A general reference to the possibility to issue such guidelines, as already provided for in the Commission Proposal should be sufficient instead. Similarly, the remedies in

text: Article 21

text: could merely refer to the respective articles of the GDPR and be complemented by the categories of persons entitled to remedies, such as end-users. See EDPS Opinion 06/2017, WP29 Opinion 1/2017 and reports of independent academics such as the study commissioned for the LIBE Committee, prepared in 2017 by Borgesius and others, available at http://www.europarl.europa.eu/RegData/etudes/STUD/2017/583152/IPOL_STU(2017)583152_EN.pd f Such as for the definition of ‘electronic communications network’, ‘electronic communications service’, ‘interpersonal communications service’, ‘number-based interpersonal communications service’, ‘number-independent interpersonal communications service’, ‘end-user’, and ‘call’. EDPS, ‘Assessing the necessity of measures that limit the fundamental right to the protection of personal data: A Toolkit’, II.4, and the recent Opinion of the CJEU 1/15, para. 140 which re-states the strict necessity requirement. See also the recent CJEU Opinion 1/15, para. 141, which states that a measure limiting the rights must lay down clear and precise rules governing the scope and application of the measure and imposing minimum safeguards in terms of circumstances and conditions under which a measure limiting a right may be adopted. CJEU Opinion 1/15, para. 141 in conjunction with 177.

identifier: EDPS yttrande 06/2017

title: ePrivacy Regulation

text: 5 October 2017

text: The proposed ePrivacy Regulation, once adopted, will update the “rules of the road” for privacy and electronic communications. It will modernise existing principles, clarify the technological requirements and provide for effective enforcement. The EDPS issued his advice on the ePrivacy review in a Preliminary Opinion (5/2016) and on the European Commission’s proposed Regulation in Opinion 06/2017. Given developments in deliberations on the proposal, and for the benefit of the co-legislator, we have decided to offer advice and clarifications on some specific issues, in line with our previous opinions. These recommendations focus on the need to ensure legal certainty and a high level of protection of the fundamental rights to privacy and data protection.

text: Key messages

text:  The ePrivacy Regulation should reflect the importance of the principle of confidentiality of communications which is closely linked to the right to private life and as such protected by the EU Charter of Fundamental Rights, the European Convention of Human Rights, and constitutional and legal orders of most of the Member States. The confidentiality of communications encompasses both content and metadata and data related to the terminal equipment. This should be adequately reflected in the permitted purposes of processing and the legal bases of processing.

text: These considerations apply to all provisions of the ePrivacy Regulation.

text:  The ePrivacy Regulation should provide for a genuine protection in line with current and anticipated technological developments, in particular in the context of machine-tomachine communications. Therefore, we support amendments explicitly providing for the protection of the confidentiality of communications to “data related to or processed by terminal equipment”. The confidentiality of communications should also be ensured when data are stored in the cloud rather than only in transmission.

text:  The approach according to which the ePrivacy Regulation particularises and complements the GDPR should be maintained to reflect the importance of the confidentiality of communications. The ePrivacy Regulation should not lower the level of protection as foreseen in the GDPR. Instead, a higher level of protection than the one the GDPR offers should be provided. At the same time, unnecessary repetitions of GDPR provisions should be avoided for the sake of clarity and legal certainty: selectively repeating some GDPR provisions risks failing to include important provisions.

text:  Broad legal bases for processing of communications data by reference to the GDPR or by re-stating the GDPR would undermine the rationale for a specific legal instrument and would not adequately reflect the importance of the confidentiality of communications enshrined in both the Charter of Fundamental Rights and the CJEU and ECtHR case law. In particular, there should be no possibility under the ePrivacy Regulation to process metadata under the legitimate interest ground. Allowing processing on legitimate interest ground would significantly lower the standards applicable today under the ePrivacy Directive

text: and put into question the added value of the draft Regulation. Similarly, further processing of metadata would create a loophole and allow circumventing the high level of protection. Data related

text: to the terminal equipment should be processed only upon consent or if technically necessary for a service requested by the user and only for the duration necessary

text: for this purpose. We, therefore, support amendments which remove the broad legal basis for tracking of individuals across time and space for any purpose.

text:  Appropriate definitions are crucial to implement the protection of the fundamental rights. Therefore, we support amendments that provide for standalone definitions, replacing the reference to the European Electronic Communications Code, ensuring that consent, when a legal entity subscribes to a service, is given by the natural person who is using the service and/or the technical equipment. We also support that services merely provided as ancillary features should be included in the definition of “interpersonal communications services”. Finally, we strongly recommend that the definition of metadata shall not exclude data not required for the purpose of transmitting electronic communications content nor for the provision of the service. In this way, no loopholes are created for the processing of these data on the basis of the GDPR.

text:  Consent under the ePrivacy Regulation must have the same meaning as in the

text: GDPR, including that it must be freely given and specific.

text: o Therefore, we support amendments clarifying that all GDPR provisions, including

text: Article 4(11)

text: on the definition of consent,

text: Article 7

text: and

text: Article 8

text: GDPR, apply also for purposes of the ePrivacy Regulation.

text: o We support amendments that clarify that access to services and functionalities must not made conditional to consenting to the processing of personal data and the processing of information related to or processed by the terminal equipment of end-users;

text: o We also welcome amendments requiring that the technical settings enabling user control under

text: Article 9

text: should allow for sufficient granularity. This requirement reflects the rule in the GDPR that consent to be specific shall be given for specified purposes and for specific data controllers (here providers). As mentioned above, there should be no unnecessary repetitions of the GDPR. Therefore, we recommend that the settings shall ‘allow the user to actively select the purposes and the service providers’.

text:  Without appropriate technical, privacy settings expressing and withdrawing consent in an on-line, highly sophisticated environment can be substantially hampered. We therefore support amendments strengthening

text: Article 10

text: and require privacy protective settings by default. Moreover, privacy settings should genuinely support expressing and withdrawing consent in an easy, binding and enforceable manner against all parties. This includes that the last sentence of recital (24) of the Commission’s proposal should become a substantive provision and a legal requirement. Accordingly, end-users shall be given the possibility “to change their privacy settings at any time during use

text: and to allow the user to make exceptions for or to whitelist certain websites or to specify for which websites (third) party cookies are always or never allowed”.

text:  Any restrictions on rights under

text: Article 11

text: should properly reflect the importance of the confidentiality of communications, in line with the CJEU settled case-law. For this reason, the restrictions should be more limited in scope than in the GDPR, and specific obligations should be provided towards enhancing transparency of access requests. When restricting the scope to serious crimes, this notion should be further defined. The minimum requirements for a legislative measure from

text: Article 23(2)

text: should apply in all cases.

text:  The Data Protection Authorities should be entrusted with the supervision of the ePrivacy Regulation. As the supervisory authorities in charge of ensuring compliance with the GDPR, they are best placed to ensure legal certainty and consistent application between the two, strongly interrelated, legal instruments. Moreover, the DPAs will be uniquely placed to deliver consistent application of the ePrivacy Regulation throughout the Union thanks to the European Data Protection Board.

text:  Protection against unsolicited communications should be effective. We therefore welcome amendments that provide that semi-automated calling systems are permitted only upon consent and call on the EU legislator to ensure that such systems are clearly included in the definition for “automated calling and communication system”. We also welcome amendments that provide for effective technical measures, in particular the combined application of presenting the calling line and using a prefix to identify unsolicited calls, and support broadening the scope of protection to all forms of unsolicited communications rather than only “direct marketing communications”.

text: The following pages provide our specific recommendations on the key points highlighted above.

text: 1. Any processing of communications data must be based on a legal ground under the ePrivacy Regulation (

text: Article 6

text: , recital 5)

text: One of the main potential benefits of the draft ePrivacy Regulation is that - as the ePrivacy Directive today - it would provide additional protection for electronic communications by limiting and specifying the legal grounds on which basis these data can be processed.

text: We welcome the proposed amendments to

text: Article 6

text: , which clarify that ‘notwithstanding Article 6 of the [GDPR]’, electronic communications data may ‘only’ be processed [on the legal grounds specified in the ePrivacy Regulation]. This Article, as amended, helps ensure clarity and legal certainty regarding the fact that other legal grounds such as the legitimate interest ground, are not applicable for processing under the Proposed Regulation.

text: We also welcome LIBE 4, which also clarifies, by amending recital 5, that processing should only be permitted ‘on a legal ground specifically provided for under the [ePrivacy] Regulation’. As an additional improvement we would recommend to rephrase this sentence in order to make this provision applicable to any parties, not just providers of electronic communications services.

text: We would further welcome, as advocated in our Opinion, amendments, which would specify, in a substantive provision, that ‘neither providers of electronic communications services, nor

text: any third parties, shall process personal data collected on the basis of consent or any other legal ground under the ePrivacy Regulation, on any other legal basis not specifically

text: provided for in the ePrivacy Regulation.’

text: 2. Legal grounds under the ePrivacy Regulation must not include legitimate interest

text: Some amendments propose an additional exemption to the confidentiality of communications based on legitimate interest of service providers and other parties to process electronic communications data.

text: Neither the current ePrivacy Directive nor the Proposed Regulation contain such exemption and the Draft Report also did not propose any such exemptions, neither for metadata nor for content. The data protection authorities and independent experts support this position and all agree in their assessment that an additional exemption on legitimate interest grounds, either for

text: metadata or for content, would risk creating a loophole and would take away much of the

text: protection provided by the ePrivacy Regulation for the confidentiality of communications. 3

text: The legislator should keep in mind that the information about the circumstances of communications and who participated in it are explicitly protected by the fundamental right to communications secrecy, and as such it is protected by the constitutions and legal order of many Member States. Allowing the processing of communications related data without consent or a limited purpose which is specifically and with sufficient precision laid down in the legislation could affect the very essence of this fundamental right and end the tradition of trustworthy messengers.

text: For these reasons, we strongly oppose any amendments that would introduce the ground of legitimate interests as a basis for processing under the ePrivacy Regulation. Any possibility for

text: further processing must not create a back-door to the high level of protection of confidentiality of communications.

text: We would welcome amendments introducing a a provision to clarify that ‘when the processing

text: is allowed under any exception to the prohibitions under the ePrivacy Regulation, any other processing on the basis of Article 6 of the GDPR should be considered as prohibited, including processing for another purpose on the basis of Article 6(4) of the GDPR. This should not prevent controllers from asking for additional consent for new processing

text: operations’.

text: We take note of amendments introduced to

text: Article 7

text: , suggesting that ‘the user may further process the data in accordance with [the GDPR], if applicable. This clarification may also be acceptable, in addition to the amendments suggested above.

text: At the same time, we strongly oppose any amendments that would allow further

text: processing more broadly, as this would seriously undermine the protection of confidentiality of communications and create a dangerous loophole allowing circumvention of the Regulation, as explained in our Opinion.

text: 3. Confidentiality of communications data shall be ensured ‘at rest’ and for machine-to-machine communications (

text: Article 5

text: In the Opinion, we argued that the ePrivacy Regulation must not only clearly provide for the confidentiality and security of communications while in transit but must also protect the confidentiality and security of end user equipment and communications data stored in the ‘cloud’. We recommended that

text: Article 5

text: and Recital 15 of the Proposal should be revised

text: to clearly cover both situations.

text: To this end, we would further suggest extending this provision to also cover communication data not only in transit but also when stored by the provider or any other party (a typical case may be content of emails stored in the ‘cloud’). Amendments to

text: Article 5

text: specifying that the prohibition set forth in paragraph 1 shall also apply to ‘electronic communications data that is stored after the transmission has been completed’ (see LIBE 399 and 400) are a good example of the type of language that may be used to this effect. The language used in LIBE 401, ‘regardless of whether this data is in transit or stored’ may also be helpful.

text: As explained in our Opinion, the protection of communications privacy should not be

text: dependent on whether humans themselves speak or listen, type or read the content of a communication, or whether they simply rely on the increasingly smart features of their

text: terminal devices to communicate content on their behalf.

text: To this end, we support amendments (based on LIBE 59, 409, 410) providing that ‘confidentiality of electronic communications shall also apply to data related to or processed by terminal equipment’. Another way of formulating the same provision could be: ‘the prohibition set forth in paragraph 1 shall also apply to data related to or processed by terminal

text: equipment.’

text: 4. The protection of data related to the terminal equipment deserve equally high protection

text: The protection of data related to terminal equipment should be implemented in line with the technological developments, and consistently with the principle of confidentiality of communications and with the rule that the ePrivacy Regulation should not lower the level of protection provided by the current ePrivacy Directive and the GDPR.

text: We therefore welcome the amendments that require the consent of the user and remove the overbroad exception in

text: Article 8(2)

text: (b) of the Commission Proposal. We also welcome that the information provided to users is turned to an additional requirement in line with the principle of transparency and does not become a legal basis for tracking of individuals across time and space for any purpose. We support amendments that clarify that when the processing is permitted for the sole purpose of establishing a connection, this is limited to the time necessary.

text: At the same time, we do not encourage detailed additional legal grounds to be added to the ePrivacy Regulation to provide further, specific exceptions (with a possible, very narrowly tailored exception for ‘people-counting’).

text: Nevertheless, if such detailed exceptions were to be proposed as part of a compromise at any stage of the legislative process, it must be ensured, at a minimum, that they are drafted in such a way to avoid creation of inadvertent loopholes. This applies, in addition to ‘people counting’, to the proposed legal grounds relating to establishing a connection, security updates, employment relationships, and web audience measuring.

text:  With regard to ‘people counting’, we recommend, at the minimum, adding requirements to ensure that ‘the purpose of processing is limited to mere statistical counting of individuals or objects’; ‘data are anonymised as soon as possible after collection’; and processing is ‘strictly limited to a distinct and limited geographical area’; and that ‘users are given effective opt-out possibilities’.

text:  With regard to ‘establishing a connection’, we endorse amendments that specify that this must be done for the ‘sole purpose of’ establishing a connection ‘requested by the user’.

text:  With regard to ‘web audience measuring’, we reiterate our concern that this ground must be narrowly tailored and interpreted and should not be unduly broadened during the legislative process. Amendments adding the requirement that ‘such measurement does not adversely affect the fundamental rights of the user’ are welcome.

text:  With regard to ‘security updates’, we recommend, at a minimum, that security updates must be ‘strictly necessary’, ‘not lowering the level of confidentiality provided by user settings’, and that the user is ‘informed before each update’ and ‘has the possibility to turn off the automatic installation of these updates’.

text:  With regard to proposed exceptions in the employment context, any exception must be ‘strictly limited for what is necessary for the execution of an employee’s task’, ‘limited to cases where the employer provides and/or is the subscriber of the terminal equipment’, and the ‘employer does not use this legal ground for monitoring its employees’.

text: 5. Appropriate definitions are crucial to implement the protection of the fundamental rights (

text: Article 4

text: 5.1 Replacement of reference to the definitions of the European Electronic Communications Code (Code) by self-standing definitions (

text: Article 4

text: For certain key definitions the Proposal refers the reader to the European Electronic Communications Code (Code).

text: We welcome, as advocated in our Opinion, the amendments that replace the reference to

text: the Code, still undergoing the legislative process, by standalone definitions (see LIBE 46 onwards). It is important to ensure that the definitions used in the ePrivacy Regulation are independent from the proposal for the Code and that central terms are defined in the ePrivacy Regulation.

text: Standalone definitions are particularly important in all cases when the definition of a term differs, in one or more significant aspects, from the definition used in the Code, such as the case with the definition of ‘interpersonal communications service’, which is also to include ‘services enabling interpersonal and interactive communication merely as an ancillary feature’. We welcome amendments aiming at such clarifications.

text: Standalone definitions are also important in all other cases, even when at present the Code definitions appear suitable, considering that the definitions in the Code may be subject to changes in a separate ongoing legislative procedure. For this reason, we recommend that a standalone definition be included for ‘call’ as well, instead of referring to Article 2(21) of the Code as in the Draft Report.

text: 5.2 Definition of ‘user’ and/or ‘end-user’

text: We welcome amendments aiming to re-introduce the definition of ‘user’, based on the currently existing definition in the ePrivacy Directive, which reads as follows: ‘any natural person using a publicly available electronic communications services, for private or business purposes, without necessarily having subscribed to this service’.

text: If these amendments are made, however, it is equally crucial that the term ‘user’ be then consistently used throughout the Regulation instead of the term ‘end-user’, which is defined in the draft Code, and was used in the Commission Proposal.

text: As a general rule, the term ‘user’ should be used throughout the Regulation in all cases where this was also already the case in the current ePrivacy Directive in equivalent provisions. As explained in our Opinion, it must be clear that it is the individuals concerned and affected,

text: rather than, for example, their employers or landlords who should be in a position to

text: provide valid consent to the processing of their communications.

text: Special attention should be paid, however, that in some cases, in particular, where a provision specifically aims at protecting the rights of legal persons who are requesting, subscribing to, or using a service, another, more appropriate term and definition be used instead or in addition to the term ‘user’ to ensure that legal entities also remain protected. Under the current Directive, the term ‘subscriber’ is usually used for this purpose.

text: 5.3 Definition of Metadata

text: The proposed amendments show that MEPs are aware of the privacy and data protection

text: risks of processing metadata. Notwithstanding this awareness, the amendments continue to follow the approach of the Proposal and limit the notion of metadata to data ‘processed for the purpose of transmitting, distributing or exchanging electronic communications content’ and/or limit it to data that is ‘processed for the provision of the service’.

text: While these definitions encompass a large part of metadata, this definition is not exhaustive as it neglects any metadata that is neither required for the purpose of transmitting, distributing or exchanging electronic communications content nor processed for the provision of the service. An example for this is location data in an instant messaging application. Thus, the EDPS proposes to change the definition to cover all metadata, as follows: c) ‘electronic communications metadata’ means data processed in an electronic communications network that is not ‘electronic communications content’, as well as data broadcast or emitted by the terminal equipment that provides additional information about the communication or is used to identify end-users’ terminal equipment in the network or to enable it to connect to such network or to other terminal equipment. It includes, but is not limited to, data used to trace and identify the source and destination of a communication, data on the location of the device and the date, time, duration and type of communication.

text: 6. Consent must have the same meaning as in the GDPR, including be freely given and specific (Article

text: and

text: ). Technical and privacy settings should genuinely and in an easy manner support giving and withdrawing consent (Article

text: and

text: With regard to

text: Article 9(1)

text: , we would welcome amendments clarifying that all GDPR provisions relating to consent (including Article 8 of the GDPR on children’s consent) apply also for purposes of the ePrivacy Regulation. In particular, we would welcome the following text: ‘The definitions of and conditions for consent provided for in

text: Regulation (EU) 2016/679

text: /EU, including, inter alia, in its Article

text: and

text: shall apply’. When this is ensured, unnecessary repetitions of constitutive elements of consent, such as “specific” consent, may be omitted.

text: The elements of consent, notably a freely given consent, imply that the processing does not have adverse effects on the rights and freedoms of individuals. We therefore welcome amendments requiring that ‘any processing based on consent must not adversely affect the

text: rights and freedoms of individuals whose personal data are related to or transmitted by the

text: communications, in particular their rights to privacy and the protection of personal data.’

text: We strongly support amendments which re-enforce the principle that consent must be freely given, and prohibit take it or leave it approaches. In particular, we support the proposed amendments to

text: Article 6

text: , which clarify that consent to the processing must not be ‘a condition to access or use a service’. This should apply to processing of both content and metadata.

text: Similar proposed amendments to

text: Article 8

text: , clarifying that consent must not be a ‘condition to access or use a service or use a terminal equipment’ are also welcome. We also welcome the proposed amendments requiring that ‘no user shall be denied access to any information society

text: service or functionality, regardless of whether this service is remunerated or not, on ground that he or she has not given his or her consent under

text: Article 8(1)

text: (b) to the processing of personal data and/or use of the storage capabilities of his or her terminal equipment that is

text: not necessary for the provision of that service or functionality.’

text: referred to in this paragraph should allow for sufficient granularity in terms of purposes

text: and providers, while avoiding unnecessarily repeating provisions of the GDPR. As an alternative to further improve current amendments, the provision may provide instead that the settings shall ‘allow the user to actively select the purposes and the service providers’.

text: These amendments should further specify that the technical settings signalling the user’s

text: preferences ‘shall be binding on, and enforceable against, any other party’.

text: We would also support additional clarifications that if a user provides consent, this shall update the pre-existing privacy settings. This update, however, should be limited for the processing requested by the user for this particular service. (For example, a user may agree to be tracked on a particular news website by a specific ad network. However, this should not permit the same ad network to track the user on a different website, unless the user has also specifically consented to be tracked when visiting that other website.)

text: We would strongly welcome amendments that would strengthen

text: Article 10

text: and would require privacy protective settings by default. Accordingly, we recommend that software placed on the market permitting electronic communications shall ‘by default, offer privacy protective

text: settings to prevent anyone other than the user from storing information on the terminal equipment of the user and from processing information already stored on that equipment.’

text: We would also welcome amendments (see LIBE 639, 640) for the requirements of data protection by default to apply not only to software but also to hardware providers. This would provide a stronger and more direct incentive for providers of Internet of Things (IoT) devices to consider data protection by default and by design.

text: Finally, we consider it crucial that users should have an easy way to give or withdraw their

text: consent at a granular level, for specific purposes and with regard to specific service

text: providers at any time during or after installation of the software. This should include easy ways to update their privacy settings (e.g. add or remove one or several specific organisations to their individual, customised white-lists and/or black-lists saved in their privacy settings), without having to go through a range of settings and options each time they navigate to a different website.

text: In practice, this could mean that individuals visiting a website and encountering a new request for consent could update their privacy settings directly by clicking one of the options offered on the website and their choice will then be stored in their privacy settings. If the individual wishes to withdraw his or her consent, this should also be done in a similar, easy manner.

text: The last sentence of recital 24 of the Proposal already hints at such a possibility, providing that ‘web browsers are encouraged to provide easy ways for end-users to change their privacy settings at any time during use and to allow the user to make exceptions for or to whitelist certain websites or to specify for which websites (third) party cookies are always or never allowed’. We recommend that this recital and ‘encouragement’ be turned into a substantive provision and a legal requirement. Further, this legal requirement should be applicable not only to web-browsers, but also to any providers coming under the scope of

text: Article 10

text: . Accordingly, we recommend that

text: Article 10

text: include a requirement that

text: ‘hardware and software placed on the market permitting electronic communications shall provide easy ways for users to change their privacy settings at any time during use’.

text: 7. Restrictions on the rights should be limited in scope (

text: Article 11

text: The EDPS supported in his Opinion the approach of the Proposal pursuant to which only selected grounds listed in Article 23(1) of the GDPR can be accepted as grounds for restricting the scope of certain rights and obligations set out in the ePrivacy Regulation. Respect of confidentiality of communications as enshrined in Article 7 of the Charter is essential for the exercise of other fundamental rights and it has thus a distinct role to play. This role is recognised in the constitutional traditions of many Member States which provide for a separate right protecting the confidentiality of communications. Some of these constitutional traditions limit the possibility to restrict this right for the purpose of combatting serious crimes only. We therefore support amendments towards a less intrusive degree of interference which limit the categories of public interest to those specified in

text: Article 23(1)

text: (a) to (d) of the GDPR. It follows from the CJEU case law that an interference with the rights enshrined in Article

text: and

text: shall be strictly necessary. The condition of strict necessity is a horizontal one, irrespective of the sector at issue, such as commercial or law enforcement . We support amendments that refer to the ‘strict necessity’ of a measure limiting the rights provided for in Article 5 of the ePrivacy Regulation. We also support, in accordance with the Opinion, amendments which require that Union or Member State laws which restrict the rights should at least contain a set of provisions that help ensure legal certainty and a minimum set of safeguards. In fact, this requirement implements settled case law on the conditions for a lawful limitation of fundamental rights . For instance, a law that does not provide for the purpose of processing or for the categories of data will not resist judicial scrutiny, as it lacks foreseeability, undermines legal certainty and the necessity of the legislative measure cannot be demonstrated, either. Consequently, reference to

text: Article 23(2)

text: GDPR is all the more required where the law provides for a restriction of the right to confidentiality as provided for in Article 5 of the ePrivacy Regulation. Given the need to provide for clear and precise rules capable of passing the necessity test, amendments which refer to ‘serious crime’ should further define the degree of seriousness, as such definition cannot be left entirely to the Member States. Finally, we support the greatest possible transparency of access requests. To this end, and in accordance with the Opinion, we support amendments introducing periodic reporting obligations of the providers vis-à-vis the supervisory authorities (in addition to the obligation, already foreseen in the Proposal, to provide information upon request by the supervisory authorities). We also support amendments imposing an obligation on the providers to publish information on access requests.

text: 8. Weakening of confidentiality and integrity of communications should be prohibited (

text: Article 17

text: Restrictions on the rights under

text: Article 11

text: may include technical measures to gain access to communications data. The EDPS supported in his Opinion the right of the users to use encryption and the prohibition of any measures reversing encryption. We therefore support amendments prohibiting the overall weakening of confidentiality and integrity of electronic

text: communications both at the level of the service itself and the user’s terminal equipment (for instance, by mandating to build-in backdoors). Based on the foregoing, we would welcome amendments based on LIBE 776-780.

text: 9. Supervision powers should be granted to the Data Protection Authorities (

text: Article 18

text: In his Opinion, the EDPS supported the Proposal, which entrusted data protection authorities (‘DPAs’) with the supervision of the ePrivacy Regulation. We continue to support this approach, as it ensures legal certainty and consistent application of the data protection framework, for example, with regard to interpreting key concepts such as ‘consent’. It also avoids possible duplication of roles amongst DPAs and other authorities, including overlapping of competence, for example if an authority other than the DPA would be competent for confidentiality of communications which entails the processing of personal data. We also oppose amendments that provide for the representation of all national competent authorities (not only DPAs) at the European Data Protection (‘EDPB’). These amendments would significantly change the institutional setup as set forth in the GDPR and would bring additional - and possibly unmanageable - complexity. The current rules provide that members of the EDPB are only DPAs and in case of more than one DPAs the Member States have to designate a joint representative. On the other hand, we support amendments re-enforcing cooperation of National Regulatory Authorities with the DPAs. These amendments calling for a reciprocal cooperation obligation complement the Commission Proposal, which already included a unilateral obligation for DPAs to cooperate with National Regulatory Authorities. Finally, effective supervision can only be delivered when adequate resources are effectively provided. According to the GDPR, the EDPS is responsible to provide the Secretariat to the EDPB, including staff. We would therefore suggest including a provision requiring the Member States and the EU budgetary authority to ensure adequate resources for national DPAs and the EDPS, respectively.

text: 10. Protection against unsolicited communications should be comprehensive (

text: Article 16

text: We welcome amendments replacing the word ‘or’ between paragraphs 16(3)(a) and (b) by ‘and’. In effect, these amendments will make sure that the presentation of the identity of a line on which the natural or legal person placing the call can be contacted (

text: Article 16(3)

text: (a)) and the use a specific code/prefix to identify it as a marketing call (

text: Article 16(3)

text: (b)) will not remain alternatives, as provided in the Proposal, rather, they will be both mandatory.

text: We also welcome amendments adding the word ‘sending’ in addition to ‘presenting’, which updates the current wording in line with technological changes.

text: We welcome amendments providing that semi-automated telephone calls (i.e. those using automated systems to eventually connect an individual to the called person) be treated the same way as fully automated systems, and thus, would require prior (opt-in) consent. In this case, national or European do not call registries could be considered for (purely) voice-to-voice calls (not including semi-automated calls).

text: We also support amendments providing that ‘the masking of the identity and the use of false identities, false return addresses or numbers while sending unsolicited communications is prohibited’. This prohibition should apply whatever the purpose of unsolicited communication (e.g. a phishing attempt may be just as or even more unlawful than unsolicited marketing communications).

text: Finally, as explained in the Opinion, we would also welcome amendments broadening and clarifying the definition and scope of ‘direct marketing communications’, as well as providing protection against all forms of ‘unsolicited communications’.

text: Brussels, 5 October 2017


text: OJ L 119, 4.5.2016, p. 1. OJ L 8, 12.1.2001, p. 1. COM(2018)239 final, 2018/0113 (COD). COM(2018)241 final, 2018/0114 (COD). Explanatory Memorandum to the Proposal, pages 4 and 5.

text: Regulation (EU) No 910/2014

text: of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive

text: (OJ L 257, 28.8.2014, p. 73). This Regulation establishes common standards for mutual recognition of electronic identification means for the purposes of cross-border authentication for online service provided by a public sector body in a Member State. See the EDPS Opinion 2013/C 28/04 on the Commission proposal for a regulation of the European Parliament and of the Council on trust and confidence in electronic transactions in the internal market (Electronic Trust Services Regulation) https://edps.europa.eu/sites/edp/files/publication/12-09- 27_electronic_trust_services_en_0.pdf and its executive summary (OJ C 28, 30.1.2013, p. 6).

text: Directive (EU) 2017/1132

text: of the European Parliament and of the Council of 14 June 2017 relating to certain aspects of company law (OJ L 169, 30.6.2017, p. 46). It repeals Council Directives

text: and

text: and Directives

text: and

text: of the European Parliament and of the Council. OJ L 156, 16.6.2012, p. 1. OJ L 144, 10.6.2015, p 1. eDelivery prescribes technical specifications that can be used in any Policy Domain of the EU (Justice, Procurement, Consumer Protection, etc.) to enable secure and reliable exchange of documents and data (structured, non-structured and/or binary), both across borders and sectors. As a result, organisations that have developed their IT systems independently from each other can start to securely communicate with one another once they have connected to a eDelivery node. See the Commission website: https://ec.europa.eu/cefdigital/wiki/display/CEFDIGITAL/2017/06/19/BRIS+Now+Live+on+the+European+e- Justice+Portal https://ec.europa.eu/cefdigital/wiki/display/CEFDIGITAL/What+is+eDelivery+-+Overview Commission Staff Working Document - Impact assessment- SWD(2018) 141 final, 1.4.1 Driver: What causes the problem?, page 13 and following. Proposal for a Regulation of the European Parliament and of the Council on establishing a single digital gateway to provide information, procedures, assistance and problem solving services and amending

text: Regulation (EU) No 1024/2012

text: , COM(2017)256 final, 2017/0086 (COD). See the EDPS Opinion 8/2017 issued on the Single Digital Gateway Proposal and the ‘once-only’ principle: https://edps.europa.eu/sites/edp/files/publication/17-08-01_sdg_opinion_en.pdf Explanatory Memorandum to the Proposal, page 6. See Recital 14 of the GDPR. See Judgment of the Court of 16 July 2015,

text: Case C-612/13

text: P, Client Earth v Commission, ECLI:EU:C:2015:489, para. 30. See Judgment of the Court of 9 November 2010, in joined Cases

text: and

text: , Volker und Markus Schecke GbR and Hartmut Eifert v Land Hessen, ECLI:EU:C:2010:662, in particular para 53 and 54. See page 94, paragraph 1.17.8 Impact on data protection, of the Commission Staff Working Document - Impact assessment- SWD(2018) 141 final. See the Judgment of the Court of 9 March 2017,

text: Case C-398/15

text: , Manni, ECLI:EU:C:2017:197, para 60. EDPS Opinion 2011/C 220/01 on the Proposal for a Directive of the European Parliament and of the Council amending Directives

text: and

text: as regards the interconnection of central, commercial and companies registers (OJ C 220, 26.7.2011, p. 1). See the Commission Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (COM(2017) 8 final), currently in the final stages of the legislative process. See the above-mentioned EDPS Opinion 2011/C 220/01, section 3.5. See page 5 of the Proposal. See article 1(5) of the Proposal introducing

text: Article 13

text: h “Disqualified directors”, paragraph 2. For the purpose of this Article, directors shall include the persons, who either as a body constituted pursuant to law or as members of any such body: (i) are authorised to represent the company in dealings with third parties and in legal proceedings; it shall be apparent from the disclosure whether the persons authorised to represent the company

text: may do so alone or are required to act jointly; (ii) take part in the administration, supervision or control of the company (see

text: Article 14

text: (d) of Directive 2017/1132). See proposed

text: Article 13

text: h “Disqualified directors”, paragraph 1, combined with proposed

text: Article 13

text: f(2) and (4), point d. The Reflection Group on the Future of EU Company Law was established in December 2010 by the European Commission to provide a report for a conference to be held in Brussels on 16 and 17 May 2011. See the Report of the Reflection Group on the Future of EU Company Law Brussels, 5 April 2011, page 34, available at http://ec.europa.eu/internal_market/company/docs/modern/reflectiongroup_report_en.pdf Commission Staff Working Document - Impact assessment- SWD(2018) 141 final. See

text: Article 5(1)

text: (c) of the GDPR. OJ L 167, 6.6.2014, p. 57. Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (COM(2017) 8 final).

text: Article 29

text: Working Party Opinion 1/2010 on the concepts of “controller” and “processor” adopted on 16 February 2010,

text: WP 169

text: . See the existing data protection notice available at https://e-justice.europa.eu/content_legal_notice-365en.do?clang=en#n02

identifier: EDPS yttrande 06/2018

publisher: Europeiska datatillsynsmannen

sprak: en

title: Digital tools and processed in company law

serie: yttranden

text: Opinion 6/2018

type: rubrik

text: EDPS Opinion on the proposal amending Directive 2017/1132 as regards the use of digital tools and processes in company law

text: 26 July 2018 1 | P a g e

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 41(2) of Regulation 45/2001 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to privacy, are respected by the Community institutions and bodies’, and ‘…for advising Community institutions and bodies and data subjects on all matters concerning the processing of personal data’. Under Article 28(2) of Regulation 45/2001, the Commission is required, ‘when adopting a legislative Proposal relating to the protection of individuals’ rights and freedoms with regard to the processing of personal data...’, to consult the EDPS.

text: He was appointed in December 2014 together with the Assistant Supervisor with the specific remit of being constructive and proactive. The EDPS published in March 2015 a five-year strategy setting out how he intends to implement this remit, and to be accountable for doing so.

text: This Opinion responses to a formal consultation by the European Commission and the European Parliament pursuant to Article 28(2) of Regulation 45/2001 and provides comments and recommendations on how to better safeguard the right to privacy and the protection of personal data in the proposed Directive amending Directive 2017/1132 as regards the use of digital tools and processes in company law (COM(2018)239 final-2018/0113 (COD)).

text: 2 | P a g e

text: Executive Summary

text: The Opinion is issued in response to a consultation by the European Commission, as well as upon a specific request of the European Parliament.

text: The Proposal for a Directive amending Directive 2017/1132 as regards the use of digital tools and processes in company law aims at complementing the current EU framework by

text: of such rules in the Member States. Moreover, it aims at ensuring that Member States enable companies to benefit from the use of electronic identification and at providing for an

text: additional exchange of data between the national business registers concerning the

text: disqualification of directors. It also ensures a free of charge access of a list of documents and information in all Member States and introduces the once-only principle in the area of company law so that companies should not have to provide the same information twice to different authorities. Finally, it introduces the possibility for the Commission to establish an optional access point for EU institutions to the platform.

text: The EDPS welcomes the Proposal and shares the Commission’s views that the use of digital tools may provide for more equal opportunities for companies while recalling the need to take into account the fact that increased access to personal data must be accompanied with effective measures to prevent unlawful or unfair processing of these data. That is why the Opinion focuses on specific recommendations with two objectives: to guarantee legal certainty and to raise awareness as to risks resulting from the accessibility of personal data that would be made widely available on the internet in digital form in multiple languages via an easily accessible European platform/access point.

text: The EDPS recommends to take the opportunity of the revision of the Business Registers Interconnection System provisions to carefully consider the recommendations provided in his Opinion on the Proposal for a Directive of the European Parliament and of the Council amending Directives

text: and

text: as regards the interconnection of central, commercial and companies registers. Moreover he recommends to take into account the specific recommendations which were given in the Opinion on the proposal for a Regulation establishing a Single Digital Gateway and the ‘once-only’ principle, in order to ensure legal certainty in the personal data processing.

text: The EDPS further suggests adding a reference to the new Regulation that will soon replace Regulation 45/2001. He also recommends to make sure that the Proposal specifies the framework for data-flows and administrative cooperation procedures using the electronic network, in order to ensure that data is processed through a solid legal basis and that adequate data protection safeguards are provided for, in particular in relation to the personal data concerning the disqualification of directors.

text: Finally, the EDPS recommends to add a reference to the Decision of the European

text: Commission, of 5 June 2014, on the protection of personal data in the European e-Justice

text: Portal, which states the tasks and responsibilities of the Commission in the data processing in the context of the E-justice portal. Moreover he calls for a clarification of the respective

text: division of tasks and responsibilities of each party involved in the data processing in the

text: context of controllership and joint controllership.

text: 3 | P a g e

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular

text: Article 16

text: thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles

text: and

text: thereof, Having regard to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) , Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular Articles

text: and

text: (d) thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION AND BACKGROUND

text: 1. On 25 April 2018, the European Commission (‛Commission’) adopted the proposal for a Directive of the European Parliament (‛Parliament’) and of the Council amending

text: Directive (EU) 2017/1132

text: as regards the use of digital tools and processes in company law (‘Proposal’), together with the proposal for a Directive of the European Parliament and of the Council amending

text: Directive (EU) 2017/1132

text: as regards cross-border conversions, mergers and divisions . As the latter provides for harmonised rules in the area of crossborder conversions, mergers and divisions of companies, the Opinion focuses on the Proposal.

text: 2. This Opinion is in response to a consultation by the Commission and a separate request from the Parliament to the European Data Protection Supervisor (‛EDPS’), as an independent supervisory authority, to provide an Opinion on the Proposal. The EDPS is grateful to have been consulted as required by Article 28(2) of Regulation 45/2001 and that a reference to the Opinion is included in the preamble of the Proposal. 1.1. Objectives of the Proposal

text: 3. The Proposal is based on

text: Article 50(1)

text: and points (b), (c), (f) and (g) of Article 50(2) of the Treaty on the functioning of the European Union. It aims at:  complementing the current EU framework by addressing the lack of rules for online company registration, filing and publication of the registered information on companies and branches in electronic form or the divergence of such rules in the 5 | P a g e Member States, which, according to the Commission, create unncessary costs and burdens to entrepreneurs ;  ensuring that Member States would enable companies to benefit from the use of electronic identification and trust services through the eIDAS Regulation ;  providing for an additional exchange of data between the national business registers concerning the disqualification of directors;  expanding the access to disclosed documents and information on companies, to companies other than the limited liability companies listed in Annex II to the Directive 2017/1132 ;  ensuring the free of charge access of a list of documents and information in all Member States;  introducing the once-only principle in the area of company law so that companies should not have to provide the same information twice to different authorities;  introducing the possibility for the Commission to establish an optional access point for EU institutions to the platform. 1.2. Context of the proposal

text: 4. Directive 2017/1132, which is to be amended by the Proposal, has codified several Directives in the field of company law , including Directive 2012/17/UE of the European Parliament and of the Council of 13 June 2012 amending

text: Council Directive 89/666/EEC

text: and Directives

text: and

text: of the European Parliament and of the Council as regards the interconnection of central, commercial and companies registers . Directive 2012/17 has established the Business Registers Interconnection System (‛BRIS’), which has been further detailed under the Commission Implementing

text: Regulation (EU) 2015/884 of 8 June 2015

text: establishing technical specifications and procedures required for the system . The BRIS has been in place since 8 June 2017. According to the Commission’s website, 31 countries participate (the EU Member States plus European Economic Area countries). The BRIS connects the national business registers to a ‛European Central Platform’ and provides for a single point of access via the European e-Justice Portal, through which citizens, businesses and public administrations can search for information on companies and their branches opened in other Member States. CEF eDelivery (one of the building blocks of the European Commission’s Connecting Europe Facility) allows Member State business register systems to exchange messages securely via the CEF eDelivery. Users of BRIS can also benefit from the login system as the E-justice Portal uses CEF-eDelivery.

text: 5. Nonetheless, according to the impact assessment accompanying the Proposal, the EU still offers a very inconsistent landscape when it comes to the availability of online tools for companies in their contact with public authorities in the area of company law. Member States provide for e-government services at variable degrees. Currently, EU company law includes certain elements of digitalisation such as the obligation for Member States to make available online information about limited liability companies. However these requirements 6 | P a g e are limited and lack precision, leading to a very diverse implementation at national level. In addition, certain digital processes are not covered at all by EU law and today only 17 Member States provide for a procedure ensuring the fully online registration of companies. The situation is similar for the online registration of branches . 1.3. Synergies with other initiatives

text: 6. In the explanatory memorandum of the Proposal, it is noted that the provision of more specific, substantial rules on the procedures for establishing and registering limited liability companies and branches would complement the Commission’s proposal for a Regulation on the establishment of a Single Digital Gateway , which covers the general registration of business activity via onlines means except for the constitution of limited liability company. The introduction of the ‘once-only principle’ in the area of company law, according to which companies should not have to provide the same information twice to different authorities, is also in line with the e-Government Action Plan 2016-2020, supporting EU wide efforts to reduce the administrative burdens on citizens and businesses .

text: 2 COMMENTS AND RECOMMENDATIONS

text: 7. The EDPS shares the Commission’s views that the use of digital tools may help providing more equal opportunities for companies. Therefore we support the objectives of the Proposal. Our comments are to be evaluated in light of this constructive approach. 2.1. Accessibility of personal data

text: 8. First, the EDPS recalls that personal data is defined under the GDPR as any information relating to an identified or identifiable natural person (‘data subject’). Thus the GDPR does not cover the processing of data concerning legal persons and in particular undertakings established as legal persons (including the name and the form of the legal person and he contact details of the legal person) . However, we would like to underline that “the fact that information [is] provided as part of a professional activity does not mean that it cannot be characterised as a set of personal data” and that “[...] legal persons can claim the protection of Articles 7 and 8 of the Charter in relation to such identification only in so far as the official title of the legal person identifies one or more natural persons [emphasis added]. That is the case with the applicant in the main proceedings in

text: Case C-92/09

text: . The official title of the partnership in question directly identifies natural persons who are its partners. [emphasis added]” . In this regard, the EDPS welcomes the assessment made in the impact assessment to the Proposal according to which there will at least be some exchange of personal data, e.g. information about the person founding a company or its director in online registration, filing and also in necessary documents for cross-border operations (mergers, divisions, conversions) and that personal data would be accessible via business registers. 7 | P a g e

text: 9. On the disclosure of personal data contained in the registers, the impact assessment to the Proposal indicates that “[...] the recent jurisprudence of the ECJ makes it clear that the disclosure of the data in registers is essential, since the only safeguards limited liability companies offer to third parties are their assets, which constitutes an increased economic risk for the latter. The Court held that it appears justified that natural persons who choose to participate in trade through such a company are required to disclose the data relating to their identity and functions within that company, especially since they are aware of that requirement when they decide to engage in such activity” . In this regard, the EDPS recalls that in the same judgment, the Court also stated that “[...] it cannot be excluded, however, that there may be specific situations in which the overriding and legitimate reasons relating to the specific case of the person concerned justify exceptionally that access to personal data entered in the register is limited, upon expiry of a sufficiently long period after the dissolution of the company in question, to third parties who can demonstrate a specific interest in their consultation.[emphasis added]” .

text: 10. The EDPS emphasizes that increased access to personal data must be accompanied with effective measures to prevent unlawful or unfair processing of these data. This is especially so for personal data made widely available on the internet in digital form in multiple languages and via an easily accessible European platform/access point. In his Opinion on the Proposal for a Directive of the European Parliament and of the Council amending Directives

text: and

text: as regards the interconnection of central, commercial and companies registers, the EDPS already underlined the necesssity to carefully assessed what personal information should be made via the Common European platform/access point, and what additional data protection safeguards - including technical measures to restrict search or download capabilities and data mining - should apply . The EDPS notes that the recommendations which we provided in the Opinion have not been fully taken on board. Therefore, we recommend to take the opportunity of the revision of the legal framework related to BRIS to carefully consider the recommendations provided in the EDPS Opinion of 2011. 2.2. Legal certainty

text: 11. In his Opinion 8/2017 on the Single Digital Gateway Proposal and the ‘once-only’ principle, the EDPS drew the attention of the legislators on the questions which the ‘once-only’ principle, depending on the way in which it is defined and implemented, may raise in relation to protection of personal data. These questions concern in particular the legal basis requirement for processing (Article 6 of the General Data Protection Regulation (‛GDPR’)), the purpose limitation principle (

text: Article 5(1)

text: (b) of the GDPR), the data minimisation principle and other principles (Articles 5 and 25 of the GDPR). In that regard and in order to ensure legal certainty, we recommended that, whenever possible: 8 | P a g e  further processing of personal data based on the once-only principle be specified in a legislative instrument, which provide appropriate safeguards to ensure compliance with data protection law, including the principle of purpose limitation and ensuring data subjects’ rights;  the legislative instrument introducing application of the principle of ‘once-only’ should be clear on whether any government data sharing is subject to freely given, specific, informed and unambiguous consent of the individuals concerned or whether the law creates an obligation or a permission for data sharing;  the law clearly specifies the legal basis for processing of personal data (typically in the main body of the legal instrument or in a recital where sufficient and appropriate). The EDPS is of the view that these recommendations should be taken into account when introducing the once-only principle into EU company law. 2.3. Reference to data protection law

text: 12. The EDPS welcomes the references to the data protection law in the Proposal. In particular, we appreciate that these references are set forth not only in the preamble (Recitals 15 and 29 of the Proposal) but also in the main body of the Proposal (Article 1 (17) of the Proposal amending Article 161 of the Directive 2017/1132). However, we note that reference is made only to the GDPR. Therefore, we recommend to add a reference to the new Regulation that will soon replace Regulation 45/2001 . 2.4. Framework for data flows, legal basis and exchange of sensitive data

text: 13. The EDPS would like to recall that it is essential that the Proposal specifies the framework for data-flows and administrative cooperation procedures that may take place using the electronic network . This is particularly important in order to ensure that (i) any data exchange is made on a solid legal basis, and that (ii) adequate data protection safeguards are provided for. Indeed, according to the EDPS, any data exchange or other data processing activity using the electronic network (e.g. public disclosure of personal data via the common platform/access point) should be based on a binding EU act adopted on a solid legal basis. This should be clearly laid down in the proposed Directive. In this respect, if there is a potential need for data processing in an Internal Market area not covered by a specific Union act, the EDPS calls for further reflection on the modalities of a legal framework which would allow, perhaps in combination with general Treaty provisions, specific provisions in the proposed Directive, and further delegated acts, to provide an adequate legal basis from the data protection perspective. It should also be specified in the proposed Directive whether the business registers may use the electronic network and the common access point to exchange or publicly disclose personal data not foreseen in a Union act but permitted or required under national law.

text: 14. In this respect, the EDPS notes that according to the explanatory memorandum of the Proposal , the Proposal establishes rules on disqualified directors as safeguards against 9 | P a g e fraud and abuse, to address concerns highlighted by some stakeholders in the public consultation. These rules are twofold: on the one hand, the Proposal aims at requiring Member States to ensure that their registers are able to provide through BRIS information on disqualified directors. The information, that “shall be provided for the purpose of registration”, includes, in addition of whether of not the person is disqualified, “what period any disqualification is in force”. Member States may also provide the grounds of disqualification . On the other hand, the Proposal aims at allowing a new data exchange between the national business registers, i.e. where the rules laid down by Members States for the online registration of companies provide for procedures to verify the appointment of directors taking into account the disqualification of directors by competent authorities of other Member States, the register where the company is to be registered, may, through BRIS, request the “confirmation from the registers of other Member States as to whether or not the person who is to be appointed as director of the company is currently disqualified from acting as director in those other Member States” .

text: 15. In this regard, the EDPS would like to recall the recommendations made by the Reflection Group on the Future of EU Company Law in its Report in 2011 . While recognising the importance of making disqualifications known throughout the Union to avoid that unacceptable behaviour is continued by use of cross-border mobility, the Group underlined that “substantial problems not just concerning technology, but also and more seriously concerning privacy, data protection and fundamental rights must be solved first.” In particular, the Group pointed out that the decisions about disqualification of company directors or the grounds for such disqualification are not publicly available in all Member States and that where a disqualification is limited in time, the public notice of disqualification must be removed. The Group therefore advised “[...] the Commission to conduct a comparative study to provide an overall system that secures the proper balance between the public’s need for transparency and considerations of personal privacy, data protection and fundamental right” . The EDPS regrets that the Impact Assesment accompagnying the Proposal does not contain any such study and that no explanation is given as to the balance to be ensured in this matter .

text: 16. As previously recalled, any system used for the exchange of personal data between competent national authorities need to have a proper legal basis in EU law, that is to say in the Directive 2017/1132 to be amended. The EDPS is of the view that the mere reference to the GDPR under Recital 15 in relation to the processing of data relating to disqualification of director is therefore not sufficient.

text: 17. Also, the EDPS underlines that the exchange of information about disqualification of directors is likely to involve the exchange of data relating to criminal convictions and offences, considered as sensitive data. In particular, in accordance with Article 10 of the GDPR, it is provided that proceesing personal data relating to criminal convictions and offences shall be carried out only under the control of official authority or when the 10 | P a g e processing is authorised by Union or Member States law providing for appropriate safeguards for the rights and freedoms of data subjects.

text: 18. Regarding the amount of information that will be shared, the EDPS would like to highlight that if the information of whether or not the person is diqualified and the duration of the disqualification “shall be provided for the purpose of registration”, there seems to be no such purpose for sharing the grounds of the disqualification. We would like to recall that not all Member States disclose the grounds of disqualification and that, even if it seems that the Proposal establishes such exchange of data as an option left to Member States - as the wording “may” indicates - the data minimisation principle should nevertheless be taken into account . 2.5. Controllership and joint controllership

text: 19. The EDPS notes that the Proposal does not include amendments so as to refer clearly to the decision of the Commission of 5 June 2014 on the protection of personal data in the European e-Justice Portal and which states the tasks and responsibilities of the Commission in the data processing in the context of the E-justice portal . The EDPS recommends to add a reference to that Decision.

text: 20. Regarding the exchange of information between Member States and assuming that personal data will be processed in this context, the EDPS considers that the Proposal is a good opportunity to amend the Directive 2017/1132 in order to reflect the clear division of tasks and responsibilities of each party involved in the data processing in the context of the BRIS. We acknowledge that it may not be feasible to specifically designate in the Directive every single processing operation and allocate responsibility for each of them to the Commission or to other parties involved in the data processing. However, at least some guidance should be given in the Directive itself.

text: 21. In this context, it is worth mentioning that the Proposal for a Regulation that will replace Regulation 45/2001 (currently in the final stages of the legislative process) defines in

text: Article 3(2)

text: (b) the notion of the controller and in

text: Article 28

text: clarifies the responsibilities of joint controllers. Where thus two or more entities “jointly determine the purposes and means of processing” they are considered joint controllers. It appears that the concept of “joint controllers” could apply as regards the division of tasks and responsibilities between the Commission and the Member States. This article requires the joint controllers to determine in a transparent manner their respective responsibilities for compliance with their data protection obligations.

text: 22. In this respect, the EDPS recalls that it is essential to answer two questions: who is the “controller” (i.e. decides on the purposes and means of the processing) and who merely processes personal data on behalf of a “controller”, and is thus the processor? The primary reason why the clear and unambiguous identification of the controller is so crucial is that it determines who shall be responsible for compliance with data protection rules. The 11 | P a g e

text: Article 29

text: Working Party adopted an opinion (Opinion 1/2010) that states: “[...] if it is not sufficiently clear what is required from whom - e.g. no one is responsible or a multitude of possible controllers - there is an obvious risk that too little, if anything, will happen and that the legal provisions will remain ineffective” .

text: 23. Clarity is especially needed in situations where multiple actors are involved in a cooperative relationship. This is often the case with EU information systems used for public purposes where the purpose of processing is defined in EU law.

text: 24. Furthermore, the

text: Article 29

text: Working Party in the abovementioned Opinion has provided guidance on the notions of controller, joint controllers and processor. Accordingly, the concept of controller not only is an autonomous notion of EU data protection law, but is also functional, in the sense that it is intended to allocate responsibilities on the basis of the factual influence rather than on a basis of a formal analysis. In particular, in the present case, it seems that the Commission contributes to the determination of the purposes and especially of the means of processing of personal data.

text: 25. Therefore, the EDPS recommends that the proposal clarifies the respective division of tasks and responsibilities of each party involved in the data processing. The essence of this division shall also be made available to data subjects (see Article 28(2) of the new Regulation), for instance through an explanation in the data protection notice .

text: 3 CONCLUSION

text: Therefore, the EDPS recommends:  to take the opportunity of the revision of the Directive 2017/1132 related to BRIS to carefully consider the recommendations provided in his previous Opinion of 2011;  to take into account the specific recommendations which were given in his previous Opinion on the proposal for a Regulation on the establishment of a Single Digital Gateway and the ‘once-only’ principle;  to add a reference to the new Regulation that will soon replace Regulation 45/2001;  to make sure that the Proposal specifies the framework for data-flows and administrative cooperation procedures using the electronic network, in order to ensure that (i) any data exchange or other data processing activity using the electronic network (e.g. public disclosure of personal data via the common platform/access point) is made on a solid legal basis, and that (ii) adequate data protection safeguards are provided for, in particular in relation to the personal data concerning the disqualification of directors.  to add a reference to the Decision of the European Commission, of 5 June 2014, on the protection of personal data in the European e-Justice Portal, which states the tasks and responsibilities of the Commission in the data processing in the context of the E-justice portal;

text: 12 | P a g e

text: to clarify the respective division of tasks and responsibilities of each party involved in the data processing in the context of controllership and joint controllership. Brussels, 26 July 2018

text: (signed)

text: Giovanni Buttarelli

text: 13 | P a g e

text: Notes

text: 14 | P a g e

text: 15 | P a g e

type: vagledning

utgivare: edps