text: COM(2023) 31 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 OJ L 199, 31.7.2007, p. 23–29. 4 OJ L 218, 13.8.2008, p. 14–20. 5 OJ L 330, 10.12.2013, p. 39–43. COM(2023) 31 final, p. 3. 7 Article 1 of the Proposal. 8 See Recitals (1)-(8) of the Proposal. 9 COM(2023) 31 final, p. 10. 5

text: See also EDPS Opinion 2/2017 on the proposed common framework for European statistics relating to persons and households, issued on 1 March 2017. 11

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: , OJ L 119, 4.5.2016, p. 1–88. 12

text: Article 5(1)

text: (b) GDPR and

text: Article 4(1)

text: (b) EUDPR. 13 See

text: Article 89 (1)

text: GDPR and

text: Article 13

text: EUDPR.

text: Article 13

text: EUDPR states that: “Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.” 14 Article 9(4) of the Proposal. 6

text: See for example Eurostat, Quality Guidelines for Frames in Social Statistics, version 1.51, 30 September 2019 p. 56 and Statistics Portugal, Census with administrative data, 21 October 2019. 17 Privately held data communication toolkit Eurostat, , Eurostat manuals and guidelines, edition 2022, p. 5. 7

text: Eurostat, Privately held data communication toolkit, Eurostat manuals and guidelines, edition 2022, p. 5. 18 OJ L 201, 31.7.2002, p. 37–47. 19

text: Article 5(1)

text: (c) GDPR and

text: Article 4(1)

text: (c) EUDPR. 8

text: See Commission Delegated

text: Regulation (EU) 2021/2223 of 30 September 2021

text: supplementing

text: Regulation (EU) 2019/817

text: of the European Parliament and of the Council with detailed rules on the operation of the central repository for reporting and statistics OJ L 448, 15.12.2021, p. 7–13. 21 Formal comments of the EDPS on the draft Commission Delegated Regulations supplementing

text: Regulation (EU) 2019/817

text: and

text: Regulation (EU) 2019/818

text: of the European Parliament and of the Council with detailed rules on the operation of the central repository for reporting and statistics, issued on 17 June 2021. 22 COM(2023) 31 final, p.10. 9

text: See section 2 above. 24 COM(2023) 31 final, p.10. 25 Article 23 of the GDPR. 26 See for example: Task Team on Privacy-Enhancing Technologies of the United Nations Committee of Experts on Big Data and Data Science for Official Statistics, The United Nations Guide on privacy -enhancing technologies for official statistics - “The Pet Guide”, 2023. 27

text: Article 39

text: EUDPR. 10

text: See

text: Article 40

text: EUDPR. 29 See also COM(2023) 31 final, p. 10. 30 Article 5(5) of the Proposal. 31 Article 7(5) of the Proposal. 32 Article 13(5) of the Proposal. 11

identifier: EDPS yttrande 08/2023

title: EDPS Opinion on the Proposal for a Regulation on European statistics on population and housing

text: 16 March 2023

text: Opinion 8/2023

text: on the Proposal for a Regulation on European statistics on population and housing

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to This Opinion relates to the Proposal for a Regulation on European statistics on population and housing, amending

text: Regulation (EC) No 862/2007

text: and repealing Regulations

text: (EC) No 763/2008

text: and

text: (EU) No 1260/2013

text: . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 20 January 2023, the European Commission issued a Proposal for on European statistics on population and housing, amending

text: Regulation (EC) No 862/2007

text: and repealing Regulations

text: (EC) No 763/2008

text: and

text: (EU) No 1260/2013

text: The Proposal contains provisions aiming to facilitate access to available data sources that will improve the production processes and general quality of social statistics. In this context, the EDPS considers that the recitals of the Proposal should make specific reference to compliance with the safeguards relating to processing for statistical purposes under Article 89 of the GDPR and Article 13 of the EUDPR. In addition, the Proposal should clarify that in principle only anonymised or pseudonymised data will be used and shared for statistical purposes.

text: High quality statistics are necessary to support the design, implementation and evaluation of Union policies, including fundamental rights policies. The EDPS also recognises that new innovative approaches can bring promises for statistics and research. However, the EDPS has serious concerns regarding the indication that information relating to specific persons might be obtained from any source, including digital traces relating to specific persons. The EDPS therefore considers that the last sentence of Article 2(3) of the Proposal, which refers to the use of any appropriate source or combination of them, including digital traces relating to the person, should be deleted.

text: In addition, the EDPS considers that further clarification is needed regarding the sources and categories of data that will be accessed and used by the Member States and the Commission (Eurostat), in particular as regards administrative data sources and privately held data. Privately held data can be diverse, as it is understood to encompass a vast amount of data held by business, including data gathered through mobile phone records, location data, social media data, but also through the Internet of Things (IoT) and provision of digital services. The EDPS considers that collection of personal data from such sources may not be proportionate to the aims pursued, having regard to the potential risks for the rights and freedoms of data subjects. Insofar as the Proposal seeks to provide a legal basis for the processing of personal data by the Member States or the Commission, it is necessary to provide a clear and comprehensive overview of the categories of personal data that may be processed under the Proposal, taking into account the requirements of necessity and proportionality. Moreover, the sources from which those categories of personal data may be obtained should be clearly set out in the Proposal itself.

text: As regards the collection of statistics from the Large-Scale IT systems (LSITs) in the Area of Freedom, Security and Justice, the EDPS that Article 10 of the Proposal should be amended. In particular, the Proposal should clarify that statistics for LSITs shall be gathered (exclusively) from the central repository for reporting and statistics (CRRS). In case the Commission would like to foresee transitional measures until the CRRS is fully operational, specific transitional measures should be introduced.

text: The EDPS welcomes that the Proposal envisages the testing and use of privacy-enhancing technologies that implement data minimisation by design. The EDPS is aware of the potential of privacy enhancing technologies as enablers of data sharing which is both privacy friendly and socially beneficial and fully supports the use of privacy-enhancing technologies in this context. At the same time, the EDPS recalls that any sharing of personal data must in any event comply with all relevant provisions of the GDPR and EUDPR, including

text: Article 89(1)

text: GDPR and

text: Article 13

text: EUDPR.

text: Finally, concerning the establishment of a secure infrastructure to facilitate such data sharing, the EDPS notes that the Proposal does not specify the roles and responsibilities of the Commission (Eurostat) and the competent national authorities within the meaning of data protection law. While detailed arrangement to ensure compliance with data protection requirements may be specified by way of an implementing act, the EDPS considers that the roles of the various actors involved as controller, joint controller or processor should be clearly specified in the enacting terms of the Proposal.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 20 January 2023, the European Commission (‘Commission’) issued a Proposal for on European statistics on population and housing, amending

text: Regulation (EC) No 862/2007

text: and 4 5 repealing Regulations

text: (EC) No 763/2008

text: and

text: (EU) No 1260/2013

text: (‘the Proposal’).

text: 2. The objective of the Proposal is to facilitate access to available data sources that would improve the production processes and general quality of social statistics. It also contains provisions to strengthen the links to and general consistency of all EU social statistics based on persons and households, as well as provisions aimed at developing a harmonised definition of population based on sound statistical concepts for all outputs. The Proposal also contains provisions to further align population and international migration statistics with statistics on administrative and judicial events related to asylum, legal and irregular migration under Articles

text: and

text: of Regulation (EC) No 862/2007 .

text: 3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 20 January 2023, pursuant to Article 42(1) of the EUDPR. The EDPS welcomes the reference to this consultation in recital 40 of the Proposal.

text: 2. General remarks

text: 4. The EDPS welcomes the objective of the Proposal, namely to establish a common legal framework for the development, production and dissemination of European statistics on population and housing . High quality statistics are necessary to support the design, implementation and evaluation of Union policies, including fundamental rights policies . In the European context, high quality statistics across Member States are essential to support many policy areas and initiatives across the EU .

text: 5. The EDPS recognises that new innovative approaches can bring promises for statistics and research, but will also pose risks and raise challenges, thus requiring legislators to ensure that any potential benefits never come at the expense of individuals’ rights. To provide effective protection for the right of privacy and the right to the protection of personal data, legislators should anticipate the potential risks and challenges that these promising approaches may bring and provide for appropriate safeguards .

text: 6. The EDPS welcomes recitals 30 and 33 of the Proposal, which emphasise that the EUDPR and the GDPR are to apply to the processing of personal data under the Proposal. In this context, the EDPS recalls that personal data must be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes . Further processing of personal data for statistical purposes is considered compatible with the original processing purposes, provided the conditions in Article 89(1) of the GDPR and Article 13 of the EUDPR are satisfied. In particular,

text: Article 13

text: EUDPR and

text: Article 89

text: GDPR stipulate that when personal data are (further) for statistical purposes, those data shall in principle be rendered anonymous (or alternatively pseudonymous), provided that the statistical purpose be fulfilled in this manner . The EDPS considers that the recitals of the Proposal should make specific reference to compliance with the safeguards relating to processing for statistical purposes under Article 89 of the GDPR and Article 13 of the EUDPR. In addition, the Proposal should clarify that in principle only anonymised or pseudonymised data will be used and shared for statistical purposes.

text: 7. While further processing personal for statistical purposes constitutes both a legitimate and compatible purpose, the EDPS considers that several provisions of the Proposal, as currently drafted, risk entailing an excessive interference with the rights to privacy and data protection.

text: 8. For example, the EDPS notes that the statistics compiled under the Proposal shall be based on statistically sound and well-documented methods taking into account international recommendations and best practice such as ‘signs of life’, ‘rate of stay’ and other scientifically-based statistical estimation methods used for compiling usually resident population in the Member States . In line with the definition set out in Article 2(3) of the Proposal, ‘signs of life’ means “any information indicative of the actual presence and usual residence of a person on the territory of interest. They can be obtained from any appropriate source or combination of them, including digital traces that relate to the person” (emphasis added).

text: 9. The EDPS understands that it is necessary to determine whether a person lives in the national territory, which corresponds to the concept of resident population. The EDPS also understands that statistical agencies use the notion of “signs life” to refer to the use of additional sources (other than surveys or censuses) to validate residency, by considering the presence of the individual in the different data sources (e.g., records indicating that the individual works, attends the education system, pays taxes, is registered in the employment office, but also medical records, electricity or water consumption, phone calls, etc.) .

text: 10. While the EDPS understands that sources other than surveys or censuses are useful when generating statistics, the EDPS has serious concerns regarding the indication that information relating to specific persons might be obtained from any source, including digital traces relating to specific persons. Such concerns are magnified in light of recital 19 of the Proposal, which refers to ‘sources related to the Internet of Things (‘IoT’) and the provision of digital services’. Such information could concern special categories of personal data and other sensitive data that would enable to draw intimate inferences on the data subject’s life and the collection of such personal data in relation to specific persons is unlikely to be proportionate to the aims pursued. The EDPS therefore considers that the last sentence of Article 2(3) of the Proposal, which refers to the use of any appropriate source or combination of them, including digital traces relating to the person, should be deleted.

text: 11. The EDPS recalls that any limitation on the right to personal data must be based on a legal basis that is adequately accessible and foreseeable and formulated with sufficient precision to enable individuals to understand its scope. In accordance with the principles of necessity and proportionality , the legal basis must also define the scope and manner of the exercise of their powers by the competent authorities and be accompanied by sufficient safeguards to protect individuals against arbitrary interference.

text: 12. As further specified in section 3 of this Opinion, to the extent the Proposal aims to cover the processing of personal data, an appropriate legal basis and a clear and comprehensive overview of the categories of personal data that may be processed, should be provided in the Proposal.

text: 3. Data sources and methods

text: 13. The EDPS notes that Article 9(1) of the Proposal lists the data sources to be used by the Member States and the Commission (Eurostat) for the purposes of the Regulation. To this end, the EDPS also notes that

text: Article 9(1)

text: refers to concepts not defined in the Proposal, notably “administrative data sources” and “other sources including privately held data”.

text: 14. As regards privately held data, recital 23 of the Proposal highlights that such data can improve the coverage, timeliness and crisis response capacities of European statistics on population and housing or to enable statistical innovation. According to the same recital, such data have the potential to complement existing demography and migration statistics, bring statistical innovation and even serve for production of early estimates. Lastly, it specifies that national statistical institutes, other competent national authorities and the Commission (Eurostat) should have access to and use such data.

text: 15. The EDPS understands that privately held data have the potential to help producers of official statistics to provide more accurate statistics that reflect topics of interest to users at a faster pace. However, he also points out that privately held data can be diverse, as it is understood to encompass a vast amount of data held by business, including data gathered through mobile phone records, location data, social media data , but also through IoT and provision of digital services. Further to offering a rich profile on individuals’ behaviour, such information could concern special categories of personal data and other sensitive data that would enable to draw even more intimate inferences on the data subjects’ life and could thus represent a significant risk for the rights and freedoms of data subjects.

text: 16. The EDPS recalls that the processing of personal data shall be lawful if the data subject (the identified or identifiable natural person to whom personal data relate) has given consent to the processing of his or her personal data for one or more specific purposes or if another appropriate legal basis under

text: Article 6

text: GDPR and/or

text: Article 5

text: EUDPR can be validly applied. In case of processing of special categories of data, regard must also be had to the general prohibition included in

text: Article 9

text: GDPR and

text: Article 10

text: EUDPR. In addition, the EDPS recalls that data concerning the use of electronic communications services, as well as the accessing of information stored in the end-user’s device is subject to specific rules under Directive

text: (‘ePrivacy Directive’).

text: 17. The EDPS considers that the Proposal does not clearly specify the categories of personal data to be accessed and used by the Member States and the Commission (Eurostat). Insofar as the Proposal seeks to provide a legal basis for the processing of personal data by the Member States or the Commission, the EDPS considers that it is necessary to provide a clear and comprehensive overview of the categories of personal data that may be processed under the Proposal. Moreover, the sources from which those categories of data may be obtained should be clearly set out in the Proposal itself.

text: 18. When specifying the categories of data, the EDPS recalls first and foremost comply with the data minimisation principle , which provide that personal data must be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed". As previously indicated, the collection of special categories of personal data or otherwise sensitive data that would enable drawing intimate inferences on the data subject’s life may not be proportionate to the aims pursued.

text: 4. Data sharing

text: 4.1. Collection of statistics from the Large-Scale IT systems (LSITs) in the Area of Freedom, Security and Justice

text: 19. Article 10 of the Proposal states that the Commission may request both "data and metadata" from the databases and interoperability systems, "including (...) statistical data stored in the central repository for reporting and statistics (CRRS)".

text: 20. As regards the soon to be interoperable Large Scale IT Systems (LSITs) in the area of freedom, security and justice, a repository for reporting and statistics (‘CRRS’) is to be established to generate cross-system statistical data and analytical reporting for policy, operational and data quality purposes in accordance with the applicable legal instruments . This CRRS stores anonymised data extracted from the underlying EU information systems, the shared biometric matching service, the common identity repository and the multi-identity detector, in order to provide cross-system statistical reporting for policy, operational and data quality purposes. The EDPS recalls his formal comments, with several recommendations, on the CRRS .

text: 21. The goal underpinning the establishment of the CRRS was to create a single point of retrieval for statistical information, leveraging the new possibilities of interoperability to avoid needing to retrieve statistics from the individual systems. It also plays an important role as a gateway and a filter to transform data which is stored for operational purposes (which is gathered and further processed by operational actors such as border guards and police officers), to statistical data that can be further used for general policymaking. Therefore, allowing parallel retrieval of data from any underlying system should not be pursued for the aim of (further) processing statistics – doing so would clearly undermine also the reason for existence of the CRRS in the first place.

text: 22. With this in mind, the EDPS considers that Article 10 of the Proposal should be amended. If indeed the CRRS is to be used as the single (anonymous) repository, the wording of

text: Article 10

text: should be made more precise. Specifically for the CRRS, additional clarity should be provided by splitting up the paragraph and clarify that for LSITs statistics shall be gathered exclusively from the CRRS. In case the Commission would like to foresee transitional measures until the CRRS is fully operational, it could introduce a paragraph immediately following this to indicate what should happen in the meantime.

text: 4.2. Privacy enhancing technologies

text: 23. Article 13 of the Proposal provides that data shall be shared between the competent national authorities of different Member States, and between these competent national authorities and the Commission (Eurostat) for the purpose of developing and producing European statistics governed by this Regulation and of improving their quality.

text: Article 13(3)

text: (b) of the Proposal provides that the sharing of personal data shall be allowed and may take place on a voluntary basis provided, among others, it is based preferably on privacy enhancing technologies that are specifically designed to implement the principles of the GDPR and EUDPR, with particular regard to purpose limitation, data minimisation, storage limitation, integrity and confidentiality. The Explanatory Memorandum recalls that the GDPR strictly limits data sharing in this context, based on the six data protection principles .

text: 25. Article 13(4) of the Proposal specifies that the Commission (Eurostat) and the Member States shall test and assess by means of pilot studies the fitness of relevant privacy enhancing technologies for data sharing. Furthermore, where the pilot studies identify effective and secure data sharing solutions, the Commission may adopt implementing acts laying down technical specifications for the data sharing and measures for the confidentiality and security of information.

text: 26. The EDPS welcomes recital 30 of the Proposal, which states that, when data sharing entails processing of personal data according to the GDPR and the EUDPR, the principles of purpose limitation, data minimisation, storage limitation and integrity and confidentiality should be fully applied. At the same time, the EDPS recalls that any sharing of personal data must in any event comply with all provisions of the GDPR and EUDPR, including

text: Article 89(1)

text: GDPR and

text: Article 13

text: EUDPR (pursuant to which in principle only anonymised or pseudonymised data will be used and shared for statistical purposes) .

text: 27. The EDPS welcomes that, in order to enable effective data sharing in line with the GDPR and EUDPR, the Proposal envisages the testing and use of privacy-enhancing technologies that implement data minimisation by design . The EDPS is aware of the potential of privacy enhancing technologies as enablers of data sharing which is both privacy friendly and socially beneficial. Privacy-enhancing technologies are linked to the principle of data protection by design and by default , and are therefore relevant to the appropriate technical and organisational measures that should be put in place to mitigate the data protection risks identified in the mandatory assessment by the controller. These measures shall be designed to implement the data protection principles effectively and integrate necessary safeguards into the data processing.

text: 28. For example, techniques such as Private Set Intersection, Secure Multi-Party Computation and Homomorphic can be explored to find linkages and make calculations among data records submitted by multiple parties in a way that data one party contributes remains confidential against the other parties. Or, other techniques such as differential privacy may be assessed to avoid (re-)identification while preserving statistical properties within a certain level of accuracy. The statistical community has already some experience and is experimenting the use of privacy enhancing technologies .

text: 29. The EDPS welcomes that the Proposal sets an obligation for the Commission (Eurostat) to evaluate the results of the pilot and feasibility studies in cooperation with Member States, as well as the obligation to prepare reports on the findings of those studies. He considers that the pilot and feasibility studies can contribute to the mandatory assessment that controllers should perform based on

text: Article 26

text: EUDPR to identify and then implement appropriate technical and organisational measures. The EDPS recalls that the Commission (Eurostat) should evaluate if a mandatory Data Protection Impact Assessment (DPIA) is necessary .

text: 30. It is the EDPS understanding that, in its current form, the Proposal could be understood as allowing for access to data of identified or identifiable individuals provided by Member States and EU databases at large scale, in particular to implement quality requirements as provided for in

text: Article 12

text: . These personal data might include the categories described in the Annex of the Proposal. These categories currently include health data such as “late fetal deaths” and other person's socio-economic characteristics, as well as migration, citizenship and partnership status. These elements should be taken into account in assessing whether the processing activities might entail high risks for individuals and thus a mandatory DPIA.

text: 31. Should the outcome of the pilot and studies not provide assurance on the effectiveness of the technical and organisational measures tested, the EDPS expects that the Commission will continue its assessment until it finds the needed appropriate measures. In case the outcome of a possible DPIA requires it, the Commission shall consult the EDPS prior to the processing .

text: 4.3. Infrastructure to facilitate data sharing

text: 32. The EDPS notes that recital 29 of the Proposal provides that the Commission (Eurostat) should establish a secure infrastructure to facilitate such data sharing while ensuring all necessary safeguards. Furthermore, Article 13(2) of the Proposal provides that “[t]he Commission (Eurostat) shall set up a secure infrastructure to facilitate data sharing (...)” and that “[c]ompetent national authorities for statistics under this Regulation may use this secure data sharing infrastructure (...)”.

text: 33. The EDPS notes that the Proposal does not specify the roles and responsibilities within the meaning of data protection law of the Commission (Eurostat) and the competent national authorities, where personal data is processed. Ensuring clarity of the role of each actor involved in the processing of personal data is important to promote transparency of processing and the effective exercise of data subject rights. While detailed arrangement to ensure compliance with data protection requirements may be specified by way of an implementing act, the EDPS considers that the roles of the various actors involved as controller, joint controller or processor should be clearly specified in the enacting terms of the Proposal.

text: 4.4. Implementing and delegated acts

text: 34. The EDPS notes that according to Article 7 of the Proposal the Commission would be empowered to adopt delegated acts to supplement the Proposal by specifying the data sets and metadata to be provided by Member States on an ad hoc basis, where the collection of additional statistics is deemed necessary for the purpose of addressing additional statistical needs under this Regulation.

text: 35. Furthermore, the Commission would be empowered to adopt the implementing acts that would specify the technical properties of the data sets and metadata to be provided to the Commission (Eurostat) , that would specify the technical properties of the ad hoc data sets and metadata , and that would lay down technical specifications for the data sharing and measures for the confidentiality and security of information .

text: 36. In this regard, the EDPS recalls that, when a proposal for legislation has a possible impact on the protection of personal data, the European Commission has to submit it to the EDPS for consultation.

text: Conclusions

text: In light of the above, the EDPS makes the following recommendations:

text: (1) to include in a recital of the Proposal a reference to compliance with the safeguards relating to processing for statistical purposes under Article 89 of the GDPR and Article 13 of the EUDPR;

text: (2) to clarify in the Proposal that in principle only anonymised or pseudonymised data will be used and shared for statistical purposes;

text: (3) to delete the last sentence of Article 2(3) of the Proposal, which refers to the use of any appropriate source or combination of them, including digital traces relating to the person;

text: (4) insofar as the Proposal seeks to provide a legal basis for the processing of personal data, to provide a clear and comprehensive overview of the categories of personal data that may be processed as well as the sources from which those categories of data may be obtained;

text: (5) to amend Article 10 of the Proposal and clarify that statistics for LSITs shall be gathered exlusviely from the central repository for reporting and statistics (CRRS) established by the relevant instruments instruments. In case the Commission would like to foresee transitional measures until the CRRS is fully operational, specific transitional measures should be introduced;

text: (6) to specify the roles of the Commission and the Member States under data protection law in relation to the secure infrastructure to be established in accordance with Article 13(2) of the Proposal.

text: Brussels, 16 March 2023

text: Wojciech Rafał WIEWIÓROWSKI

text: [e-signed]


text: COM(2023) 777 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 777 final. 4 Regulation

text: of the European Parliament and of the Council of 14 July 2021 on a temporary derogation from certain provisions of Directive

text: as regards the use of technologies by providers of number-independent interpersonal communications services for the processing of personal and other data for the purpose of combating online child sexual abuse, OJ L 274, 30.7.2021, p. 41. Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse, COM/2022/209 final. 6 COM(2023) 777 final, p. 1. 7 EDPS Opinion 07/2020 on the Proposal for temporary derogations from Directive

text: for the purpose of combatting child sexual abuse online, issued on 10 November 2020. 8 EDPB-EDPS Joint Opinion 4/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse, issued on 28 July 2022. 4

text: See e.g. the Joint Handbook of the EP, the Council and the Commission for the presentation and drafting of acts subject to the ordinary legislative procedure, March 2022 edition, page 37. 10 COM(2023) 777 final, p. 1. 11 EDPS Opinion 07/2020 on the Proposal for temporary derogations from Directive

text: for the purpose of combatting child sexual abuse online, para. 26. 12 Ibid, para. 51. 13 Commission staff working document, Impact Assessment Report Accompanying the document Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse, SWD(2022) 209 final. 5

text: Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse, COM/2022/209 final. 15 The event agenda, briefing note, video recording and summary report can be accessed here: https://edps.europa.eu/dataprotection/our-work/publications/events/2023-10-23-edps-seminar-csam-point-no-return_en 16 EDPS Opinion 07/2020 on the Proposal for temporary derogations from Directive

text: for the purpose of combatting child sexual abuse online, para. 18. 17 Report from the Commission to the European Parliament and the Council on the implementation of

text: Regulation (EU) 2021/1232

text: as regards the use of technologies by providers of number-independent interpersonal communications services for the processing of personal and other data for the purpose of combating online child sexual abuse, COM/2023/797 final, p. 6. 18 See in the same vein also the EDPB-EDPS Joint Opinion 4/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse, para. 70. 19 See Article 3(1) of the Interim Regulation. 20 EDPS Opinion 07/2020 on the Proposal for temporary derogations from Directive

text: for the purpose of combatting child sexual abuse online, para. 30 6

text: for the purpose of combatting child sexual abuse online, para. 33. 22 Ibid, para. 34. 23 Ibid, para. 39. 24 Ibid, para. 27. 25 COM/2023/797 final, p. 12. 26 See also EDPS Opinion 07/2020 on the Proposal for temporary derogations from Directive

text: for the purpose of combatting child sexual abuse online, para. 27. 7

text: for the purpose of combatting child sexual abuse online, para. 50. 28 EDPB-EDPS Joint Opinion 4/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse, para 52. 29 SWD(2022) 209 final. 30 EDPB-EDPS Joint Opinion 4/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse, para. 63. 31 SWD(2022) 209 final, Annex 8, p. 281-283. 32 European Parliamentary Research Service, Complementary impact assessment of April 2023, p. 15-18. 33 See Impact Assessment Report, SWD(2022) 209 final, pp. 281-282. 8

text: Ibid, p. 283. 35 EDPB-EDPS Joint Opinion 04/2022 of 28 July 2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse, downloadable at: https://edpb.europa.eu/system/files/2022- 07/edpb_edps_jointopinion_202204_csam_en_0.pdf, paragraph 86. 36 EDPS, Summary Report on the EDPS Seminar on the CSAM proposal: “The Point of No Return?”, p. 4, downloadable at https://edps.europa.eu/data-protection/our-work/publications/events/2023-10-23-edps-seminar-csam-point-no-return_en. In the same vein, see also Statement by the Child Protection Association (Der Kinderschutzbund Bundesverband e.V.) on the Public Hearing of the Digital Affairs Committee on "Chat Control" on Wednesday, March 1, 2023, p. 2: ‘We also fear that when scanning is carried out without any reason, children and young people will be criminalized much more frequently - a trend that is already visible in German crime statistics. This is due to the fact that children and young people themselves often send images that can be classified as pornographic, making them liable to prosecution’. 37 The Cologne Prosecutor-General’s Office, The Cybercrime Centre and Contact Point of North Rhine-Westphalia – ZAC NRW, Statement for the public hearing held by the German Bundestag’s Committee on Digital Affairs on the subject of “chat control” on 1 March 2023, p. 9. 38 Ibid. 39 Ibid. 9

identifier: EDPS yttrande 08/2024

amnesord:
ePrivacy Directive
Rights of the Individual

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 8/2024 on the Proposal for a Regulation amending Regulation (EU) 2021/1232 on a temporary derogation from certain ePrivacy provisions for combating CSAM

serie: yttranden

text: 24 January 2024

type: rubrik

text: Opinion 8/2024

text: on the Proposal for a Regulation amending

text: Regulation (EU) 2021/1232

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council amending

text: Regulation (EU) 2021/1232

text: of the European Parliament and of the Council on a temporary derogation from certain provisions of Directive

text: for the purpose of combating online child sexual abuse . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: Executive Summary

text: Regulation (EU) 2021/1232

text: on a temporary derogation from certain provisions of Directive

text: for the purpose of combating online child sexual abuse. The objective of the Proposal is to introduce a limited time extension to

text: Regulation (EU) 2021/1232

text: (“Interim Regulation”) to enable providers of certain numberindependent interpersonal communications services to use specific technologies for the processing of personal and other data to detect online child sexual abuse on their services, while interinstitutional negotiations on a long-term Regulation continue.

text: The EDPS does not consider the proposed extension of validity of the Interim Regulation a formality. Already in his 2020 Opinion, the EDPS considered that the proposal should not be adopted, even in the form a temporary derogation, until the recommendations included in that Opinion were addressed.

text: The mere fact that providers of electronic communication services apply detection technologies on a voluntary basis does not dispense the co-legislature from its responsibility of establishing a comprehensive legal framework which meets the requirements of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union.

text: The EDPS notes that the concerns and recommendations expressed in his 2020 Opinion have not been fully addressed by the co-legislators when adopting the Interim Regulation. In particular, the Interim Regulation does not contain effective safeguards against general and indiscriminate monitoring of private commuincations. In this regard, the EDPS remains particularly concerned by the relatively high error rates of current detection technologies, especially those for detecting new child sexual abuse materials or child solicitation (‘grooming’). The EDPS also wishes to draw attention to the significant risk that technologies to detect CSAM may flag consensually produced and shared imagery.

text: Given the significant outstanding concerns, the EDPS recommends not to adopt the Proposal until the necessary safeguards are integrated.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 30 November 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council amending

text: Regulation (EU) 2021/1232

text: for the purpose of combating online child sexual abuse (‘the Proposal’).

text: 2. The objective of the Proposal is to introduce a limited time extension to

text: Regulation (EU) 2021/1232

text: (“Interim Regulation”) to enable providers of certain number-independent interpersonal communications services to use specific technologies for the processing of personal and other data to detect online child sexual abuse on their services, while inter- 5 6 institutional negotiations on the proposal for a long-term Regulation continue .

text: 3. On 10 November 2020, the EDPS provided his Opinion on the Proposal for temporary derogations from Directive

text: for the purpose of combatting child sexual abuse online (which later became the Interim Regulation). On 28 July 2022, the EDPS has, together with the European Data Protection Board (EDPB), issued Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse ( the long-term Regulation Proposal). Both Opinions remain relevant in the context of the current Proposal.

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 30 November 2023, pursuant to Article 42(1) of EUDPR. The EDPS notes that no reference to this consultation has been made in a Recital, and recommends inserting such reference in accordance with the established practice .

text: 2. General remarks

text: 5. According to the explanatory memorandum , it is uncertain that the inter-institutional negotiations on the Proposal for a long-term Regulation will conclude for the long-term Regulation to enter into force and to apply before the Interim Regulation is set to expire. The proposed extension, until August 2026, would ensure that child sexual abuse online can be effectively and lawfully combated without interruptions until the long-term regime created by the proposed Regulation is agreed.

text: 6. The EDPS does not consider the proposed extension of validity of the Interim Regulation a formality. Already in his 2020 Opinion, the EDPS considered that the mere fact that providers of electronic communication services would apply the detection technologies on a voluntary basis does not dispense the co-legislature from its responsibility of establishing a comprehensive legal framework which meets the requirements of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. The EDPS also noted that the general, indiscriminate and automated analysis of all text-based communications transmitted through number-independent interpersonal communications services with a view of identifying new potential infringements did not respect the principle of necessity and proportionality. Even if the technology used was limited to the use of “relevant key indicators”, the deployment of such general and indiscriminate analysis would be excessive. The EDPS therefore considered that the proposal should not be adopted, even in the form a temporary derogation, until the recommendations included in that Opinion were addressed.

text: 7. These EDPS takes note that his concerns and recommendations have not been fully addressed by the co-legislators when adopting the Interim Regulation. In particular, the Interim Regulation does not contain safeguards against general and indiscriminate monitoring, and also the question of a valid legal basis under the GDPR remains unsolved. The EDPS underlines that these issues should be taken into account when considering the proposed extension.

text: 8. In addition, the EDPS wishes to draw attention to important developments subsequent to the adoption of the Interim Regulation. For example, the impact assessment accompanying the Proposal for a long-term Regulation , which provided industry information on current technical solutions, has shed additional light on the legal and technical issues that emerge in practice. On 23 October 2023, the EDPS organised a seminar dedicated to the ongoing legislative works on the Proposal for a long-term regulation, which yielded further insights on the unintended consequences of the deployment of CSAM detection technologies . This Opinion also builds on this increased knowledge when assessing the Proposal.

text: 3. Legal basis and necessity and proportionality

text: 9. In his 2020 Opinion, the EDPS recommended clarifying which legal basis of the GDPR would be applicable . The Interim Regulation does not contain such clarification, resulting in different legal application practices among providers, according to the implementation report . The EDPS reiterates his previous recommendation to clarify which legal basis of the GDPR would be applicable to the voluntary processing of content or traffic data for the purpose of detecting child sexual abuse online.

text: 10. The EDPS remains of the opinion that the general, indiscriminate and automated analysis of all text-based communications transmitted through number-independent interpersonal communications services with a view of identifying new potential infringements did not respect the principle of necessity and proportionality. Even if the technology used was limited to the use of “relevant key indicators”, the EDPS considers the deployment of such general and indiscriminate analysis excessive.

text: 11. The EDPS notes that the Interim Regulation, while generally referring to strict necessity and proportionality , in reality does not provide for specific and effective safeguards against general and indiscriminate monitoring.

text: 12. In his 2020 Opinion, the EDPS considered that the Proposal should clarify whether the detection technologies would be applied to all communications exchanged by all users or to a subset of them. In the latter case, according to the Opinion, it would be necessary to clarify the criteria by which the technologies would be applied to a specific subset of communications .

text: 13. The EDPS notes that the Interim Regulation does not explicitly require providers to limit the deployment of detection technologies to a subset of communications, and also does not provide the criteria according to which the providers could do so voluntarily.

text: 14. The EDPS in his 2020 Opinion encouraged the co-legislature to spell out, in the text of the Proposal, which categories of data would amount to “relevant data” in relation to each of the processing purposes . The EDPS notes that the Interim Regulation refers to “content data and related traffic data” in very general terms and does not specify which data categories may be processed for which purpose.

text: 15. The EDPS had further expressed concerns that the reporting of individuals and blocking of the concerned user’s account might not be strictly necessary and proportionate in all instances, for example in the case of unsolicited receipt of CSAM. He also expressed concern that the procedure within the provider was not addressed. These concerns remain equally valid with regard to the Interim Regulation.

text: 4. Transparency and data subject rights

text: 16. With regard to transparency and data subject rights, the EDPS had recommended the introduction of additional measures to ensure transparency and exercise of data subject rights, subject, where strictly necessary, to narrowly defined restrictions (e.g., where necessary to protect the confidentiality of an ongoing investigation). The EDPS notes that the Interim Regulation provides for the information of all users in

text: Article 3(1)

text: (g)(v) and of those affected by removal, suspension or blocking in point (vi).

text: 17. The EDPS also urged the co-legislators to provide further clarity as to when the right to human review would become applicable and which entity would be in charge of carrying out this review . Art. 3(1)(f) of the Interim Regulation does not provide such clarification, however, leading to seemingly different practices by providers . The EDPS recalls that, depending on the circumstances under which human review is required, the use of detection technologies could result in automated decision making within the meaning of

text: Article 22

text: GDPR.

text: 5. Duration of the temporary derogation

text: 18. With regard to duration, the EDPS had expressed the view that a five-year period as initially proposed was too long and did not seem proportional given the absence of (a) a prior demonstration of the proportionality of the envisaged measure and (b) the inclusion of sufficient safeguards within the text of the legislation. He recommended that the validity of any transitional measure should not exceed 2 years.

text: 19. In view of the shortcomings outlined above, the EDPS maintains this position.

text: 6. Further considerations

text: 20. The EDPS recalls that level of intrusion resulting from the deployment of CSAM detection measures may vary depending on the technology used. In all three types of detectable material, known CSAM, new CSAM and grooming, the technologies currently available rely on the automated processing of content data of all affected users. The technologies used to analyse the content are often complex, typically involving the use of AI. As a result, the behaviour of this technology may not be fully comprehensible for the user of the service. Moreover, the technologies currently available, especially those for detecting new CSAM or grooming, are known to have relatively high error rates. Consequently, there is the risk of significant number of innocent people being reported to the law enforcement authorities (directly or through the National Center for Missing and Exploited Children), based on a detection of ‘potential’ CSAM or grooming .

text: 21. As the EDPB and the EDPS have already stated in their Joint Opinion on the long-term Proposal, performance indicators found in the literature, some of which are highlighted in the Impact Assessment Report that accompanied the long-term Proposal, provide very little information on the conditions that were used for their computation and their adequacy with real life conditions, meaning that their real-world performance could be significantly lower than what is expected, leading to less accuracy and a higher percentage of ‘false positives’.

text: 22. The EDPS stresses that while it seems from the Commission Report on the implementation of the Interim Regulation that providers include the corrective element of human review in their calculation of reliability, it is necessary that the technology used in itself is sufficiently reliable. Human review, while protecting against adverse automated decision-making and indispensable, on its own already constitutes an interference. Therefore, it should not be invoked justify the use of detection technologies that are insufficiently reliable.

text: 23. As indicated in the Impact Assessment Report and in the European Parliamentary Research Service’s study the accuracy rate of technologies for detection of text-based grooming is much lower than the accuracy rate of technologies for the detection of known CSAM. The assumption that artificial intelligence systems are available and working for the detection of unknown CSAM and for the detection of solicitation of children, and could be considered as state-of-the-art, is insufficiently supported by evidence. Even seemingly high levels of accuracy (for instance, the accuracy of certain grooming detection tools is 88%), must be considered in light of the envisaged practical use of the detection tools and the severity of the risks that an incorrect assessment of a given material would entail for the relevant data subjects. Therefore, the EDPB and EDPS had considered in their Joint Opinion that, with such a high risk processing, 12% failure rate presents a high risk to data subjects who have been subject to false positives, even when there are safeguards in place to prevent false reports to law enforcement.

text: 24. Lastly, the EDPS would like to place particular emphasis on findings that were presented by experts at the EDPS seminar on CSAM, which highlight the general problem of automated detection: the technology cannot identify the context in which images are shared. Several participants of the EDPS seminar on the long-term CSAM Proposal warned that technologies to detect CSAM would flag consensually produced and shared imagery, as these technologies cannot properly consider the context in which the exchange takes place. As experts pointed out, platform moderators would not be able to filter (legal) consensual material because they too would not know the context of the exchange. As a result, there would be a risk for criminal prosecutions, but even if law enforcement authorities drop the charges, the investigation alone would be disturbing and constitute a violation of children’s rights.

text: 25. In the same vein, a Member State’s Cybercrime Centre and Contact Point has underlined that there is a significant risk that innocent members of the public would be made subject to official investigations. This is said to be particularly true with regard to the AI-based miscategorisation of cases where the visual material itself is detected accurately, but the situation under criminal law is misjudged. To give an example, this includes cases where children below the age of criminal responsibility have posted material themselves, or communications between young people in consensual contexts.

text: 7. Conclusions

text: 26. In light of the above, the EDPS makes the following recommendations: (1) not to adopt the Proposal, until the necessary safeguards and all the outstanding missing elements, as identified in these specific recommendations, are introduced in the legal framework, notably o to clarify which legal basis of the GDPR would be applicable to the voluntary processing of content or traffic data for the purpose of detecting child sexual abuse online, o to provide for specific and effective safeguards against general and indiscriminate monitoring, o to specify which data categories may be processed for which purpose in

text: Article 3(1)

text: (h) of the Interim Regulation, and o to provide further clarity as to when the right to human review would become applicable and which entity would be in charge of carrying out this review. (2) to take fully into account the concerns and the additional risk stemming from measures to detect CSAM in interpersonal communications, identified during the discussions on the Proposal for a long-term CSAM Regulation. Brussels, 24 January 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 10

type: vagledning

utgivare: edps


text: COM(2025) 48 final. 1

text: COM(2025) 48 final.

text: Council Decision (EU) 2023/2408 of 16 October 2023

text: on the position to be taken on behalf of the European Union within the Trade Specialised Committee on Administrative Cooperation in VAT and Recovery of Taxes and Duties established by the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, OJ L, 2023/2408, 31.10.2023. 2

text: OJ L 295, 21.11.2018, p. 39. COM(2025) 33 final. 6

text: on the position to be taken on behalf of the European Union within the Trade Specialised Committee on Administrative Cooperation in VAT and Recovery of Taxes and Duties established by the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, OJ L, 2023/2408, 31.10.2023. 7 EDPS Formal comments on a draft Commission Implementing Decision amending Implementing Decision C(2019)2866 as regards the update of the standard forms and the service level agreement, issued on 15 October 2024. 8 Finally approved as Commission Implementing Decision C(2024)8903. 4

text: Council Regulation (EU) No 904/2010 of 7 October 2010

text: on administrative cooperation and combating fraud in the field of value added tax (recast), OJ L 268, 12.10.2010, p. 1–18. 10 EDPS Formal comments on a draft Commission Implementing Decision amending Implementing Decision C(2019)2866 as regards the update of the standard forms and the service level agreement, issued on 15 October 2024, paragraphs 9-12. 11 This is the case for instance of information regarding the directors, managers, sole entrepreneur of the undertaking subject to VAT obligations. In this regard, see the recent judgment of the Court (first Chamber) of 3 April 2025, L.H. v Ministerstvo zdravotnictví,

text: , ECLI:EU:C:2025:231, paragraphs 30-31. 5

text: Commission Implementing Decision

text: (EU) 2021/1772

text: of 28 June 2021 pursuant to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom (notified under document C(2021)4800) (Text with EEA relevance), C/2021/4800, OJ L 360, 11.10.2021, p. 1-68. As laid down in Article 4 of the Commission Implementing Decision, the Decision “shall expire on 27 June 2025, unless extended in accordance with the procedure referred to in

text: Article 93(2) of Regulation (EU) 2016/679

text: .” On 18 March 2025, the European Commission issued draft implementing decisions amending Commission Implementing Decision

text: (EU) 2021/1772

text: of 28 June 2021 pursuant to the GDPR to extend its validity until 27 December 2025. The Commission has requested an opinion to the European Data Protection Board according to

text: Article 70(1)

text: (s) of the GDPR.

identifier: EDPS yttrande 08/2025

amnesord:
Finance & Economy
Tax cooperation

title: Opinion 8/2025 on the Proposal for a Council Decision on Administrative Cooperation in VAT and Recovery of Taxes and Duties between the EU and the Euratom, of the one part, and the UK of the other part

text: on the Proposal for a Council Decision on the position to be taken within the Trade Specialised Committee on Administrative Cooperation in VAT and Recovery of Taxes and Duties between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for Proposal for a Council Decision on the position to be taken on behalf of the European Union within the Trade Specialised Committee on Administrative Cooperation in VAT and Recovery of Taxes and Duties established by the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, pursuant to Article 218 TFEU. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: The Proposal would lead to modifications to the standard forms to be used for administrative cooperation in VAT and recovery of taxes and duties. Specifically, new labels and sections would be added to the forms to bring them in line with the Exchange of Forms (EoF) system referred to in Annex II to Commission Implementing Decision C(2019)2866, which was amended by Commission Implementing Decision C(2024)8903. These modifications would enable the European Union and the United Kingdom to benefit from the range of information currently used by the Member States for administrative cooperation and the recovery of claims in the European Union. In order to enable these modifications, the Proposal is accompanied by an Annex replacing Annex I to Decision No 4/2023 with the text in the Annex to the Proposal.

text: Considered that the modifications to the standards forms, necessary due to the alignment with the modified Commission Implementing Decision C(2019)2866, do not raise data protection issues having regard to the well-established administrative cooperation between the European Union and the United Kingdom on VAT, the EDPS does not have specific comments or recommendations on the Proposal.

text: Since the implementation of the, already established, administrative cooperation in VAT and recovery of taxes and duties between the European Union and the United Kingdom entails transfers of personal data falling under Chapter V of the GDPR, the EDPS recalls that the United Kingdom has been recognised as ensuring an adequate level of protection by a decision of the Commission under Article 45 of the GDPR.

text: Contents

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 6 March 2025, the European Commission issued the Proposal for a Council Decision on the position to be taken within the Trade Specialised Committee on Administrative Cooperation in VAT and Recovery of Taxes and Duties between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part (‘the Proposal’).

text: 2. The objective of the Proposal is to modify the standard forms to be used for administrative cooperation in VAT and recovery of taxes and duties between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part.

text: 3. The proposed modifications concern the introduction of new labels and sections in the standard forms in order to bring them in line with the Exchange of Forms (EoF) system referred to in Annex II to Commission Implementing Decision C(2019)2866, which was amended by Commission Implementing Decision C(2024)8903. The proposed modifications are necessary to establish an improved framework enabling both parties to benefit from the extensive range of tools currently used by the Member States for administrative cooperation and the recovery of claims. In order to enable these modifications, the Proposal is accompanied by the Annex replacing Annex I to Decision No 4/2023 with the text in the Annex to the Proposal.

text: 4. The EDPS has issued formal comments on the draft Commission Implementing Decision amending the Commission Implementing Decision C(2019)2866.

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 6 February 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in the sixth citation of the Proposal.

text: 2. General remarks

text: 6. The administrative cooperation between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, is based on the Protocol on administrative cooperation and combating fraud in the field of value added tax and on mutual assistance for the recovery of claims relating to taxes and duties (‘the VAT Protocol’), as laid down in Article PVAT.39(2) of the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part (‘the Agreement’).

text: 7. Specifically, Article PVAT.39(2)(d) of the Agreement refers to the standard forms to be used for communication in administrative cooperation between the UK and the Member States. The proposal concerns the update of these electronic forms, which should be in line with the Exchange of Forms (EoF) system referred to in Annex II to Commission Implementing Decision C(2019)2866, as last amended by Commission Implementing Decision C(2024)8903.

text: 8. In its formal comments on the draft Commission Implementing Decision amending the Commission Implementing Decision C(2019)2866, the EDPS noted that the draft Implementing Decision modifies the content of the standard forms, adding new data fields to maintain the relevance and usability of the standard forms by tax authorities for the purposes of

text: Council Regulation (EU) No 904/2010

text: . These new fields are: information regarding the directors, managers, sole entrepreneur; information regarding associates, partners, beneficial owners, agents or other people involved; the identification of the name of the bank account holder and of the number of the account from which and/or to which the payment for transport was made. The EDPS considered that these additional data fields do not raise concerns from the data protection point of view . The same consideration therefore applies to the modifications to the standard forms envisaged by the Proposal.

text: 9. The EDPS takes note that the envisaged update to the standards forms, entailing the processing of personal data , is necessary due to the alignment with the modified Commission Implementing Decision C(2019)2866, and would be implemented in the context of the well-established and structured administrative cooperation between the European Union and the United Kingdom on VAT and recovery of taxes and duties.

text: 10. Moreover, since the implementation of the already established administrative cooperation in VAT and recovery of taxes and duties between the European Union and the United Kingdom entails transfers of personal data falling under Chapter V of the GDPR, such transfers would be covered by the decision of the Commission recognising the UK as offering an adequate level of protection under Article 45 of the GDPR .

text: 3. Conclusions

text: 11. In light of the above, the EDPS considers that the Proposal does not raise data protection issues. Therefore, the EDPS does not have specific comments or recommendations on the Proposal. Brussels, 28 April 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 6