Guidance for co-legislators on key elements of legislative Proposals

07 May 2025

Guidance for co-legislators on key elements of legislative proposals

0

EXECUTIVE SUMMARY

1

1. Introduction

1. A proposed legislative or other measure that implies the processing of personal data must comply with primary EU law, and in particular with Articles 7 (respect for private and family life ) and Article 8 (protection of personal data) of the Charter of Fundamental Rights of the European Union (“Charter”).

2. Personal data may only be processed, by the State or any other actor, if the standards set out in paragraphs 2 and 3 of Article 8 of the Charter are met, i.e. (i) the processing is fair and lawful, for specified purposes; (ii) transparency is ensured by giving the individuals rights to access and rectification; and (iii) control by an independent authority is ensured.

3. Both Articles 7 and 8 of the Charter must be read in conjunction with Article 52(1) of the Charter , which allows limitations to fundamental rights, provided that such limitations: (i) be provided for by law; (ii) respect the “essence” of the right(s); (iii) genuinely meet objectives of general interest recognised by the EU or the need to protect the rights and freedoms of others; and

4. The Court of Justice of the European Union (CJEU) has held, in the vast majority of cases dealing with legislative acts, that the processing of personal data limited both the right to the protection of personal data and the right for respect of private life as guaranteed by the Article 7 and 8 of the Charter . The CJEU has also held that for the establishment of a limitation “it does not matter whether the information in question relating to private life is 3 sensitive or whether the persons concerned have been inconvenienced in any way” . In this regard, it is important to recall that the concept of personal data has a wide scope, encompassing any information relating to an identified or identifiable individual .

5. The requirements of Article 8 of the Charter are further reflected in various instruments of EU data protection law, in particular those adopted pursuant to Article 16 of the Treaty of the Functioning of the European Union (“TFEU”), including Regulation 2016/679 (“GDPR”), Regulation 2018/1725 (“EUDPR”), Directive (EU) 2016/680 (“LED”) and Directive 2002/58/EC (“ePrivacy Directive”). Compliance with Article 8 of the Charter should be assessed by specific reference to the system of safeguards laid down in those instruments . These are rules of general application which therefore constitute the benchmark for the legislator, and any derogations from those rules should in general be avoided or, at the very least, appropriately justified.

6. Processing of personal data that is deemed necessary for the fulfillment of a legal obligation and/or for the performance of a task carried out in the public interest or in the exercise of official authority entrusted to the controller must have a legal basis in Union or Member State law .

7. A legislative or other act that entails processing of personal data must first and foremost be clear and precise and its application must be foreseeable to persons subject to it . The CJEU has made clear that EU legislation involving interference with the fundamental rights guaranteed by Articles 7 and 8 of the Charter must lay down clear and precise rules 4 governing the scope and application of a measure and imposing minimum safeguards, so that the persons whose personal data are concerned have sufficient guarantees enabling their data to be effectively protected against the risk of abuse and against any unlawful access to and use of those data .

8. The following sections of this guidance provide an overview of the main elements to consider with regards to a legislative or other measure that implies the processing of personal data. Each of these elements should be carefully considered by the co-legislators in the light of the conditions for lawful limitation of the rights pursuant to Article 52 of the Charter, notably the requirement for clear and precise rules and that the necessity and proportionality can be properly assessed on the basis of clear and precise rules.

9. It is important to keep in mind that the guidance provided in the following sections is indicative of the approach taken by the EDPS in the majority of cases, having regard to his advisory practice to date. For this reason, the guidance should not be applied in a formalistic manner, but rather used as a tool to help ensure that a legislative measure meets the conditions of Article 52 of the Charter. In any event, a case-by-case assessment remains necessary and different approaches may be called for in light of the specific subject matter or nature of the proposal, having regard also to the seriousness of the interference that a particular legislative measures would entail.

10. When addressing the main data protection elements of a legislative proposal, care should be taken not to simply repeat provisions that are already reflected in the applicable data protection legislation (e.g., by simply repeating that “personal data shall be limited to what is necessary in relation to the purposes for which they are processed”). The fact that certain instruments of EU data protection law are applicable (e.g., the GDPR, the EUDPR, the LED or the ePrivacy Directive) can and should be appropriately recalled by way of a recital. Instead, the safeguards included in the legislative proposal help operationalise the relevant data protection requirements (e.g., by specifying precisely which categories of personal data are necessary to achieve the purposes of the processing as defined by the proposal).

11. Finally, when applying this guidance in practice, it is important to take into account whether the act is: (1) a basic legislative act (a Regulation or a Directive) (“basic act”) or (2) an implementing or delegated act (Commission Implementing Decision, Commission Implementing Regulation, Commission Delegated Regulation, ... ) (“implementing or delegated act”) ; or (3) a recommendation or proposal to the Council pursuant to Article 218 of the TFEU (i.e. agreements between the Union and third countries or international organisations). 5

2. Assessing the seriousness of interference

12. Proposals that give rise to a serious interference with the fundamental rights to data protection and privacy should be distinguished from others. Where the interference is serious, there is an even greater need for clear and precise rules governing the scope and application of the measure as well as accompanying safeguards. In other words: the greater the interference entailed by the proposed act, the most robust and detailed the rules and the safeguards should be.

13. Assessing the seriousness of the interference is also an integral part of the proportionality assessment. Such an assessment involves measuring the seriousness of the interference with the fundamental rights to respect for private life and to the protection of personal data which that processing involves and then determining whether the importance of the objective of general interest pursued by the processing is proportionate to the seriousness of the interference .

14. The CJEU has advanced several criteria to determine the seriousness of an interference with the right to the protection of personal data and the right for respect of private life. In particular, it has considered the following elements as relevant when qualifying an interference as (particularly) serious or significant: • Nature of the personal data at issue, in particular of any processing of special categories 18 19 of data or data which is otherwise sensitive ; • Nature of, and specific methods for, the processing of the data at issue, in particular of the number of persons having access to those data and the methods of accessing them ; • The ability to draw precise conclusions concerning the private lives of the individuals concerned (profiling) ; • The lack of awareness of the data processing on the part of the person concerned ; • The large-scale nature of the processing of personal data ; 6 • The ability to monitor individuals’ behaviour (likely to generate feeling of constant surveillance) ; • Public accessibility of the information ; • Likely adverse effect on other fundamental rights ; • Automated processing of data involving pre-established models and criteria .

15. The examples above are not exhaustive and a case by case assessment remains relevant. As a rule of thumb, the criteria developed by the WP29/EDPB to determine whether the processing is “likely to result to high risk” can (also) help to assess the seriousness of the interference (e.g. processing of special categories of data or data of a highly personal nature, matching or combining of datasets, etc.) . In most cases, processing meeting two or more criteria should be considered as likely amounting to a serious interference.

16. It should be noted that the concept of “seriousness of an interference” is different from the notion of “impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data”, as referred to in Article 42 of the EUDPR. The mere existence of an impact on the right to the protection of personal data does not necessarily imply the existence of a serious interference with such a right, which should be assessed in light of the specific characteristics of the proposed legislative measure .

3. Objective and purpose

17. The objective(s) and purpose(s) of the processing that would result from a legislative proposal should be specified, explicit and legitimate . To make sure this is the case, the following questions should be considered: • Is the objective of the proposed measure sufficiently clear? 7 • Is the purpose of the processing explicitly and specifically described in the enacting terms (operative text) of the proposal?

18. Purpose specification lies at the core of EU data protection framework. A clear identification of purpose is not only required by Article 8(2) of the Charter, it is a necessary precondition to determine whether data processing complies with the law. Purpose specification sets limits on the purposes for which controllers may use the personal data collected and also helps to establish the necessary data protection safeguards .

19. In order to fulfil its role, the purpose of the collection must be identified with sufficient precision: it must be detailed enough to (1) determine what kind of processing would (or would not) result from the legislative measure and (2) enable an assessment of whether the envisaged processing is necessary to achieve the objectives pursued . The degree of detail in which a purpose should be specified requires a case-by-case assessment. In some clear cases, simple language will be sufficient to provide appropriate specification, while in other cases more detail may be required . Generally speaking: the greater the interference entailed by the proposed act, the more robust and detailed the rules and the safeguards should be.

20. To be considered “explicit”, the purpose of the processing should be clearly specified in the basic act, by either: • explicitly indicating the purpose of the processing as such ; or • resulting unambiguously from the explicit wording of the proposal, provided that the wording does not leave any possible doubt regarding the purpose(s) for which the personal data may be processed .

21. The purposes of the processing should be established in the enacting terms (operative text) of the proposal of the basic act. It is not sufficient that the purpose of the processing is only explicitly indicated in (or results unambiguously from) the Explanatory Memorandum or recitals accompanying the enacting terms of the proposal.

22. An implementing or delegated act should not introduce processing operations for a purpose which is not sufficiently supported by the basic act . Where an implementing or delegated act concerns the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, the implementing or delegated act may provide greater specificity to the purpose of the processing (and should do so if the provisions of 8 the basic act do not articulate the purpose(s) of the processing with sufficient precision). An implementing or delegated act should not, however, introduce an entirely new or unrelated purpose. Example: EDPS Opinion 1/2019 on two legislative proposals relating to combating VAT fraud The Commission’s proposals on the fight against VAT fraud in the context of “ecommerce” included recitals specifying the purpose of the processing operations envisaged by them. However, EDPS recommended specifying the purpose in the operative text of the Proposals to avoid any risk of function-creep and the use of information for other purposes, such as controlling purchase habits of the consumers.

4. Roles and responsibilities

4.1. Roles

23. Both the GDPR and the EUDPR distinguish among different types of actors involved in the processing of personal data: controller, processor and joint controllers . These concepts provide the very basis upon which responsibility for compliance with EU data protection law is allocated. • A “controller” is any entity which, alone or jointly with others, determines the purposes and means of the processing of personal data . • Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers . • A “processor” is defined as a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller .

24. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law . Although not explicitly confirmed by the GDPR, the LED or 9 the EUDPR, the EDPS considers that similar considerations apply in case of joint controllers and/or processors.

25. Ensuring clarity of the role of each actor involved in the processing of personal data is important to promote transparency of processing and the effective exercise of data subject rights. Moreover it is key to enable a determination of who will be responsible for what (see further section 4.2 below). Determining the role of controller from the outset also helps to avoid any possible problems of interpretation in assessing that role .

26. The EDPS recommends assigning the role of controller already in the basic act if possible . The same applies for any joint controllers or processors who may be involved in the processing (where applicable).

27. When a proposal establishes a legal obligation or a task in the public interest that requires processing of personal data involving multiple actors (e.g., a proposal requiring exchange of personal data between national public authorities an EU bodies, a provision that requires setting up a common repository at EU level, etc.), the proposal should as a rule identify the roles of the entities that will be involved in the processing. The designation of an entity as controller, joint controller or processor should take place in the enacting terms (operative text) of the proposal rather than in the recitals accompanying the enacting terms of the proposal. Example: EDPS Formal comments on the Proposal for a Regulation of the European Parliament and of the Council establishing a collaboration platform to support the functioning of Joint Investigation Teams and amending Regulation (EU) 2018/1726. The Proposal for a Regulation establishing a collaboration platform to support the functioning of Joint Investigation Teams specified that the competent national and Union authorities shall be considered as “controllers” with regard to the processing of personal data in the platform. To avoid ambiguity, the EDPS recommended to clarify whether the identified controllers should be considered as “joint controllers” and, if so, to provide for the arrangement envisaged by Article 21 of the LED. While detailed arrangements to ensure compliance with data protection requirements may be further defined by way of an implementing act if necessary, the EDPS considered that the Proposal should in any case unambiguously identify the roles of each entity involved as controller, joint controller or processor respectively.

4.2. Responsibilities

28. The GDPR, the LED and the EUDPR each require controllers, joint controllers and/or processors to clearly establish their respective obligations. When a proposal establishes a legal obligation or a task in the public interest that entails processing of personal data 10 involving joint controllers and/or processors, it may be appropriate to specify the respective obligations of the entities involved, possibly by way of a delegated or implementing act. a) Joint controllers

29. Joint controllers are obliged to determine the respective responsibilities for compliance with their data protection obligations by means of an arrangement between them, in particular as regards the exercising of the rights of the data subject and their respective duties.

30. The arrangement between joint controllers may take the form of an implementing or delegated act, but may of course also be included in the basic act (e.g. in the form of an Annex). While detailed arrangements to ensure compliance with data protection requirements may be further defined by way of an implementing or delegated act, it may be appropriate to also include certain elements and safeguards in the basic act itself, taking into account the nature of the interference. Example: EDPS Formal comments on a Proposal for a Regulation of the European Parliament and of the Council establishing the European Union Single Window Environment for Customs and amending Regulation (EU) No 952/2013 The Proposal for a Regulation establishing the European Union Single Window Environment for Customs and amending Regulation (EU) No 952/2013 specified that the Commission was a joint controller within the meaning of Article 28(1) of the EUDPR and customs authorities and partner competent authorities were joint controllers within the meaning of Article 26(1) of the GDPR. The EDPS welcomed that Article 7(3) of the Proposal provided for a minimum list of responsibilities by the joint controllers to ensure that the joint processing is compliant and that implementing acts would provide for a joint controllership arrangement.

31. Additional recommendations concerning the elements to be addressed by the joint controller arrangement (e.g. handling of requests and informing data subjects, management of security incidents...) can be found in the applicable EDPS and EDPB guidelines .

32. If the basic act itself does not provide for a comprehensive arrangement, an empowering provision (i.e. a provision of the basic act empowering the European Commission to adopt implementing or delegated acts) may be useful . b) Processor(s)

33. Where the processing is to be carried out on behalf of a controller, it shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject matter and duration 11 of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller .

34. The GDPR, the LED, the EUDPR specify additional elements that must be incorporated in the legal act between the controller and processor .

35. The legal act that is binding on the processor with regard to the controller may take the form of an implementing or delegated act, but may of course be part of the basic act (e.g. in the form of an Annex). If the basic act itself does not yet address all the required elements as stipulated in the GDPR, the LED or the EUDPR, and if the processing on behalf of the controller should still be regulated in a legal act as opposed to a contract, an empowering provision may be useful .

5. Necessity and proportionality

36. A limitation of the exercise of a fundamental right guaranteed by the Charter must, in addition to being “provided by law”, also satisfy the requirements of necessity and proportionality. The criteria provided under Article 52(1) of the Charter and Article 8(2) European Convention on Human Rights (“ECHR”) for a lawful limitation on the right to the respect for private life are similar in this regard .

37. First, it must be established that the measure is intended to meet objectives of general interest recognised by the European Union, within the meaning of Article 52(1) of the Charter. If that is the case, it should first be determined whether the envisaged measure is appropriate, i.e. is capable of attaining the objective pursued. Very often, this is not a difficult test to pass .

38. Second, the measure should be necessary to achieve these objectives. The necessity test involves determining whether the objective of general interest pursued cannot reasonably be achieved just as effectively by other means less restrictive of the fundamental rights of data subjects . In this regard, it should be noted that case law of the CJEU applies 12 a strict necessity test for any limitations on the exercise of the rights to personal data protection and respect for private life with regard to the processing of personal data .

39. Once it is established that the envisaged measure may be considered as “necessary”, the next step is to assess its proportionality in the strict sense. Assessing proportionality in the strict sense involves assessing the seriousness of the interference with the fundamental rights to respect for private life and to the protection of personal data and determining whether the importance of the objective of general interest pursued by the processing is proportionate to the seriousness of the interference. An objective of general interest may not be pursued without having regard to the fact that it must be reconciled with the fundamental rights affected by the measure, by properly balancing the objective of general interest against the rights at issue .

40. In order to assess the seriousness of that interference, account must be taken, inter alia, of the nature of the personal data at issue, in particular of any sensitivity of those data, and of the nature of, and specific methods for, the processing of the data at issue, in particular of the number of persons having access to those data and the methods of accessing them .

41. Once the seriousness of the inference has been determined, it should be assessed whether a fair balance has been struck between the importance of the objectives of general interest pursued and the individuals’ fundamental rights to privacy and data protection. Taking into account safeguards that reduce the risks to the rights and freedoms of individuals forms an integral part of this assessment.

42. It should be noted that the case law of the CJEU often integrates considerations of clarity and foreseeability (“quality of law”) when assessing the necessity and proportionality of legislation.

43. For example, in order to satisfy the requirement of proportionality, the CJEU considers that “the legislation must lay down clear and precise rules governing the scope and application of the measure in question and imposing minimum safeguards, so that the persons whose personal data is affected have sufficient guarantees that data will be effectively protected against the risk of abuse. That legislation must be legally binding and, in particular, must indicate in what circumstances and under which conditions a measure providing for the processing of such data may be adopted, thereby ensuring that the interference is limited to what is strictly necessary” .

44. As further clarified by the CJEU, the need for such safeguards is all the greater where personal data is subjected to automated processing and where the protection of the particular category of personal data that is sensitive data is at stake . 13

45. Given the crucial importance of necessity and strict proportionality to data protection, the EDPS published relevant guidance: “Assessing the necessity of measures that limit the fundamental right to the protection of personal data: a toolkit” and Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data. See also the EDPS quick-guide to necessity and proportionality.

46. The replies to the following questions can additionally help to guide the assessment of necessity and proportionality: • Are the rules governing the scope and application of the measure sufficiently clear and precise? Is there sufficient legal clarity and certainty about the scope and extent of the interference (e.g., in terms of definitions, processing activities, actors involved etc.)? • Is it explicitly specified what categories of data will be collected or exchanged, by whom, and for how long? • Is the data processing envisaged by the measure adequate, relevant and not excessive in relation to the purposes for which they are collected or further processed? • Could any other, less intrusive measure achieve the desired outcome with less interference with the fundamental right at stake ? • Are there any specific concerns related to processing of special categories of personal data (e.g. biometric data or data concerning health) or personal data which is otherwise sensitive (e.g. traffic and location data, financial data, etc.) or the categories of data subjects concerned (e.g. vulnerable persons)? • Are there any specific concerns related to the use of automated decision-making, profiling, or new technologies like Artificial Intelligence ? • Where a measure aims at protecting other public interests or fundamental rights, how are those interests or rights balanced with privacy and data protection ? Which safeguards are in place to reduce the risks to the rights and freedoms individuals? 14 Example: EDPS Opinion 4/2022 on the Proposal for a Regulation on automated data exchange for police cooperation (“Prüm II”) The European Commission adopted a Proposal for a Regulation on automated data exchange for police cooperation (“Prüm II”), amending Council Decisions 2008/615/JHA and 2008/616/JHA and Regulations (EU) 2018/1726, 2019/817 and 2019/818 of the European Parliament and of the Council (the so-called “Prüm Decisions”). The EDPS noted that the proposed new Prüm framework does not clearly lay down essential elements of the exchange of data, such as the types of crimes, which may justify a query, and is not sufficiently clear about the scope of data subjects affected by the automatic exchange of data, e.g. whether the databases, subject to a query, contain data only of suspects and/or convicted persons, or also data of other data subjects, such as victims or witnesses. The EDPS considered in particular that the automated searching of DNA profiles and facial images should be possible only in the context of individual investigations into serious crimes, instead of any criminal offence, as provided for in the Proposal. Furthermore, the EDPS considered it necessary to introduce in the Proposal common requirements and conditions concerning the data in the national databases that are made accessible for automated searches, taking due account of the obligation under Article 6 of the LED to make a distinction between different categories of data subjects (i.e. convicted criminals, suspects, victims, etc.). The EDPS also considered that the necessity of the proposed automated searching and exchange of police records data was not sufficiently demonstrated. If such a measure is nevertheless adopted, even on voluntary basis, then additional strong safeguards would be required to comply with the principle of proportionality. In particular, given the data quality challenges, the future Regulation should, inter alia, explicitly define the types and/or the seriousness of crimes that may justify an automated query in the national police records.

47. Without being exhaustive, the following subsections will highlight specific points of attention that should be considered when assessing whether a proposed measure complies with the requirements of necessity and proportionality, in particular as regards: (i) the categories of personal data concerned; (ii) the categories and the number of data subjects concerned; (iii) the duration of storage; (iv) disclosure of personal data to public authorities or third parties; and (v) restrictions the rights of data subjects. 15

5.1. (Categories of) personal data

48. The EDPS considers that the basic act should, as a general rule, specify the (categories of) personal data in a comprehensive manner, especially if the proposal is likely to entail a serious interference with the rights to data protection and privacy . In some cases, the specification of the personal data to be processed stems from an explicit legal obligation .

49. When a proposal specifies (the categories of) personal data involved, it should be ensured that the specified categories of data are necessary and proportionate to the objective pursued.

50. Where a proposal envisages processing of special categories of personal data or personal data relating to criminal convictions and offences, it should additionally be ensured that the conditions of Article 9-10 of the GDPR, Article 10-11 of the EUDPR and/or Article 10 of the LED are met.

51. Where the proposal specifies the categories of personal data involved, these categories should in principle be described in an exhaustive manner: • Open-ended formulations (e.g., “any other relevant data”, “at least”, ...) should be avoided; • Only more detailed data fields (sub-categories of data) falling under the already defined categories of data should be added through the adoption of implementing or delegated acts (the introduction of entirely new data categories by way of implementing act should be avoided, especially if the processing would constitute a serious interference with the rights and freedoms of individuals). 16 Example: EDPS Opinion 3/2022 on the Proposal for amending the Directive on the framework for the deployment of Intelligent Transport Systems in the field of road transport The Proposal to amend the ITS Directive would empower the Commission to adopt specifications laying down the categories of traffic, travel or road data that are personal data. In his opinion, the EDPS considered that the categories of personal data as well as the purposes for the processing of personal data in the context of the deployment of ITS services should be specified directly in the Proposal. The EDPS recognised that given the diversity of ITS and the variety of potential use cases, it could not be possible to fully detail each possible data category . However, only more detailed data fields (subcategories of data) falling under the already defined categories of data should be added through the adoption of delegated acts. Moreover, the EDPS underlined that the purposes for which the categories of personal data may be processed should be clearly set out in the Proposal itself.

5.2. Categories of data subjects

52. Where the proposal entails a serious interference with the rights to data protection and privacy, the categories of data subjects should be specified in the basic act or appear unambiguously from the text.

53. In any event, it should be verified that the categories of data subjects affected appear as necessary and proportionate to the objective pursued. Example: EDPS Formal comments on a Proposal for a Commission Implementing Decision amending Implementing Decision (EU) 2017/253 as regards alerts triggered by serious cross-border threats to health and for the contact tracing of passengers identified through Passenger Locator Forms. The comments concerned the draft Commission Implementing Decision amending Implementing Decision (EU) 2017/253 as regards alerts triggered by serious crossborder threats to health and for the contact tracing of passengers identified through Passenger Locator Forms (PLF). While Recital 16 of the draft Implementing Decision referred to the processing of personal data of “cross-border passengers”, Recital 17 stated that the processing of personal data would concern “infected passengers”. From the draft Implementing Decision, the EDPS understood that all cross-border passengers’ data would be processed and transmitted within the PLF exchange platform. Thus, the EDPS recommended explicitly clarifying in the aforementioned recitals whether the categories of data subjects would be limited to infected passengers only or might also concern other cross-border passengers for the purpose of SARS-CoV- 2 contact tracing. 17

5.3. Storage duration

54. According to the storage limitation principle, the GDPR, the EUDPR and the LED provide for personal data to be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed”.

55. In accordance with the CJEU case law , the determination of a storage duration must be based on objective criteria. Different storage duration should be set for the different categories of data stored “on the basis of their possible usefulness for the purposes of the objective pursued or according to the persons concerned” .

56. Despite the objective nature of the determination of storage duration periods, in practice the legislator enjoys a certain margin of appreciation in defining an appropriate retention period, because no mathematical formula can determine with absolute precision the duration of storage which is necessary to achieve a given objective. Thus, the defined period must be reasonably defined, having regard to the purposes of the processing. The period of time should be closely put in relation to the purpose pursued and must be justified so as to ensure that the storage is limited to what is strictly necessary for the purposes pursued, and in practice it should be as short as possible. Sufficient evidence should be produced to that effect, for example by including the necessary justification in the impact assessment accompanying the proposal.

57. When assessing the relevance of the storage, attention should be drawn on whether the data stored could become outdated and irrelevant to serve the purposes (such as health data stored for public health purposes). Where the level of quality of the stored data cannot be ensured during the same length of time, it is recommended to evaluate if a shorter data storage duration would be more suitable.

58. The envisaged storage duration should be specified unambiguously. The mere reference to the deletion of data when “no longer required” is not sufficient to ensure consistency and legal certainty. A storage duration may be specified: o by indicating the exact number of months/years for which the data shall be retained (e.g., “for five years”); 18 o by indicating the maximum number of months/years for which the data may be retained, provided that it does not prejudice the application of the general principle of storage limitation (e.g., “no longer than necessary for the purpose of XYZ and in any event no longer than five years”); o alternatively, in particular in the context of the LED, indicating the time period (months/years) for conducting a periodic review of the need for further storage of the personal data.

59. Where the proposal entails a serious interference with the rights to data protection and privacy, the storage duration of the personal data should be specified in the basic act. While the criteria allowing the determination of the storage duration shall be laid down in the basic act, the concrete duration may be further defined by implementing or delegated acts, on the basis of these objective criteria. Example: EDPS Formal comments on a Proposal for a Regulation establishing a European single access point (ESAP) providing centralised access to publicly available information of relevance to financial services, capital markets and sustainability The Proposal determined that information referred to in Article 1(1) thereof remained available to the European single access point (ESAP) for at least 10 years, unless it was stated otherwise in the relevant legal act that required the information to be made public. In terms of personal data, it should not be retained and made available for longer than 5 years, unless stated otherwise in the relevant legal act. Finally, the Proposal specified that the collection bodies shall take appropriate technical and organisational measures to ensure that the information is not retained or made available for longer than provided for in Article 5(1)(f). The EDPS welcomed the introduction of a clear maximum duration for the storage of personal data by the collection bodies. He regretted, however, that neither the Proposal nor the explanatory memorandum provided objective reasons for justifying the established duration. In order to avoid interpreting the Proposal as defining by default “the period necessary” under certain existing acts as 5 years and thus potentially leading to an extension of the maximum storage periods beyond the period necessary, the EDPS recommended specifying that the collection bodies must ensure that personal data submitted to them “shall not be retained and made available for longer than necessary and in any event not for longer than 5 years, unless stated otherwise in the legal acts referred to in Article 1(1), point (a)” of the Proposal.

5.4. Disclosure of personal data to public authorities or third parties

60. The GDPR, the EUDPR and the LED require personal data to be collected for specified purposes and not further processed in a manner that is incompatible with those purposes (purpose limitation). If a proposal foresees access of the competent national authorities 19 to the data processed, such access constitutes a further interference with the fundamental right to respect for private life.

61. Each time a proposal entails the sharing of data with public authorities or third parties, it should be clearly specified . Any legislative measure authorising the exchange, communication or access to personal data by third parties should clearly designate the third parties who may have such access or to whom the data may be communicated, as well as the purpose for which the data shall be disclosed.

62. The public authorities or third parties to whom the personal data shall be disclosed must be specified in the basic act. An implementing or delegated act may not introduce a new disclosure of personal data to a public authority or third party which is not sufficiently supported by the basic act .

63. The legislative act should lay down objective criteria in order to define the circumstances and conditions under which the competent national authorities are to be granted access to the data at issue and by which to determine the limits of data sharing with the public authorities and their subsequent use. It should also specify the substantive and procedural conditions relating to such sharing and subsequent use. In particular, the legislation providing for access by competent authorities should: • impose minimum safeguards, so that the persons whose personal data is affected have sufficient guarantees that data will be effectively protected against the risk of abuse. • be legally binding under domestic law and, • in particular, must indicate in what circumstances and under which conditions a measure providing for the processing of such data may be adopted, thereby ensuring that the interference is limited to what is strictly necessary . 20 Example: EDPS Opinion 1/2021 on the Proposal for a Digital Services Act Article 21 of the Proposal for a Digital Services Act required online platforms to promptly inform the law enforcement or judicial authorities as they become aware of any information giving rise to a suspicion that a serious criminal offence involving a threat to the life or safety of persons has taken place, is taking place or is likely to take place. In his opinion, the EDPS welcomed the delineation of the criminal offences which may give rise to a reporting obligation, i.e. “serious criminal offences involving a threat to the life or safety of persons”. However, the EDPS recommended further specifying, by listing in an Annex, any other criminal offences (other than child sexual abuse mentioned in Recital 48) that meet this threshold and may give rise to a notification obligation, as well as clearly defining what “relevant information” is in order to ensure legal certainty for all parties involved, including the platforms themselves.

5.5. Disclosure of personal data involving international transfers

64. Where a proposal indicates that there may be international transfers of personal data to third countries, due regard should also be given to the conditions for transfers pursuant of Chapter V of the GDPR, Chapter V and Article 94 of the EUDPR and Chapter V of the LED.

65. Furthermore, it should be born in mind that most of the legal acts establishing Union largescale IT systems in the field of Title V of the TFEU (Area of Freedom, Security and Justice) lay down a prohibition of the transfer of the data stored in them to third countries or international organisations, with some clearly defined exceptions .

5.6. Restrictions on data subject rights

66. Where the proposed legislative act entails restrictions on data subject rights, such restriction must comply with the criteria above laid down in Article 52(1) of the Charter. In addition: • Restrictions by European Union Institutions and bodies (“EUIs”) are regulated under Article 25 of the EUDPR: any restriction has to be either based on a legal act adopted on the basis of the Treaties or, in the absence of such legal basis, in matters relating to the operation of EUIs, on the internal rules of the EUIs.

67. Any restrictions under the GDPR and the LED must be provided for by law, which implies, in particular, that the legal basis which permits the interference with those rights must itself define the scope of the limitation on the exercise of the right concerned. It shall be clear, precise and its application foreseeable to the persons whose personal data is affected. 21 This means that the latter shall be able to identify the circumstances and conditions of such restrictions .

68. For more information on restrictions under Article 25 of the EUDPR and Article 23 of the GDPR, see EDPS Guidance on Article 25 of Regulation 2018/1725 and EDPB Guidelines 10/2020 on restrictions under Article 23 of the GDPR.

6. Basic acts vs implementing or delegated acts

69. When assessing a proposal that would entail the processing of personal data, it is very important to bear in mind whether the proposed act is a basic act or an implementing or delegated act .

70. A significant number of consultations under Article 42(1) of the EUDPR concern draft implementing or delegated acts (Articles 290 and 291 of the TFEU). Many of these acts are technical in nature and are often interrelated (e.g. several implementing and/or delegated acts may define specific aspects and functionalities of the same large-scale IT system).

71. In that regard it should also be born in mind that delegated acts may delegate to the Commission the power to adopt non-legislative acts of general application to supplement or amend certain non-essential elements of the legislative act (e.g. to further specify or amend the categories of data). On the other hand, implementing acts can only implement in more detail the elements already listed in the legally binding Union acts.

72. Article 290 of the TFEU specifies that the “essential elements” of an area shall be reserved for the legislative act (i.e. the basic act). The CJEU has further clarified that “essential elements” of basic legislation are those which, in order to be adopted, require political choices falling within the responsibilities of the EU legislature . For example, the adoption of rules requiring conflicting interests at issue to be weighed up on the basis of a number of assessments, may not be conferred on the Commission . When it exercises delegated or implementing powers, the Commission must fully respect the essential elements of the enabling act .

73. In accordance with the GDPR, the legal basis for the processing does not necessarily require a legislative act adopted by a parliament . Nevertheless, the EDPS considers that decisions 22 on essential principles and modalities that impact fundamental rights should be taken at the level of the basic act so as to ensure that such decisions are taken within a full legislative procedure, which ensures more democratic control and includes the appropriate checks and balances . Decisions that have a major impact on the privacy and data protection of individuals should be decided by the European Parliament and Council, particularly for proposals that may entail a serious interference with data protection and privacy rights.

74. If the proposal concerns a basic act which does not entail a serious interference with the right to data protection, the EDPS considers that it is possible to delegate the determination of certain modalities of the processing to the Commission (for more details see the table under section 8) . If the proposal does not provide for any implementing or delegated act, however, the requisite safeguards will in any event need to be included in the basic act or an empowering provision should be added.

75. In any event, if an empowering provision is provided for, it should clearly define the scope of the delegation as regards data protection elements (e.g. in terms of categories of data, storage periods, etc.) that would be delegated pursuant to the proposed basic act. This will help to ensure clarity regarding the mandate conferred, as well as provide further assurance that those elements will be addressed at the level of Union law.

76. Since only very technical (practical) details should be left to be decided under the administrative autonomy of the EU body involved in the processing of personal data (e.g. by the Management Board of a decentralised Agency), explicit empowerment to administrative bodies to lay down provisions that regulate the interference with fundamental rights should be avoided, as this matter should be reserved to the legislator and, at most, to the Commission .

77. When dealing with a proposal for a delegated or implementing act, it is also important to assess its legal basis and scope. In that regard, the following questions should be considered: • What would be the legal basis of the implementing or delegated act? • Would the draft implementing or delegated act be within the scope laid down in the basic act?

78. In addition, it is recommended to check whether there has been an EDPS Opinion on the basic act providing for the legislative delegation for the adoption of the implementing or 23 delegated act, or previous EDPS formal comments on related matters, e.g. formal comments on other implementing or delegated acts envisaged by the same basic act.

7. Interferences further specified at national level

79. Under the principle of subsidiarity, in areas which do not fall within its exclusive competence, the Union shall act only if and in so far as the objectives of the proposed action cannot be sufficiently achieved by the Member States, either at central level or at regional and local level, but can rather, by reason of the scale or effects of the proposed action, be better achieved at Union level.

80. Especially when it comes to a basic act, it is important to consider whether Member States will further specify the interference or the details of its regime under their national law. Where this is the case, the details in the proposed act may be more limited than in case where the interference is governed exclusively (or primarily) by rules promulgated at EU level. Example: EDPS Formal Comments on the Proposal for a Directive of the European Parliament and of the Council on combating violence against women and domestic violence The Proposal for a Directive of the European Parliament and of the Council on combating violence against women and domestic violence aimed at establishing minimum rules concerning the definition of criminal offences and penalties in the areas of sexual exploitation of women, and children and computer crime. While the Proposal envisaged collection of personal data that may be deemed particularly sensitive, the processing of data would mainly be taking place in the framework of the relevant criminal procedures and the rules on data protection transposed at national level from the LED.

81. Conversely, there may also be instances where a proposal envisages that Member States shall further specify the interference or the details of its regime under national law, whereas it would be more appropriate to include additional elements directly in the proposal itself. Example: Opinion 2/2023 on the Proposals for Directives on standards for equality bodies in the field of equal treatment Two proposals for Directives on standards for equality bodies in the field of equal treatment envisaged that the choice of the legal basis for the processing of personal data by equality bodies should be left to the national transposition of the future directives. The EDPS recommended enhancing legal certainty for the equality bodies by considering Article 18 of the Proposals as the legal basis for the data processing and to make an explicit link to Article 9 of the GDPR with regard to special categories of personal data. He also recommended clarifying the scope of Article 18(1) of the Proposals to cover not only the collection but also the subsequent processing of personal data by equality bodies, as necessary, by exhaustively listing all special categories of personal data within the meaning of the GDPR that may be processed on the basis of the Proposals as well as clarifying the suitable and specific measures to safeguard the fundamental rights and the interests of the data subject required in Article 9(2)(g) of the GDPR. 24

82. In cases where the proposal would give rise to a significant interference, it is particularly important to already incorporate relevant safeguards at EU level . In such cases, the degree of discretion left to Member States to define certain elements should not be such as to have an impact on the assessment of the necessity and the proportionality of the envisaged measure .

8. Checklist prior to the adoption of legislative acts or delegated or implementing acts

a) Elements to be found in the legal act where it does not constitute a serious interference with the rights to data protection and privacy of data subjects

(Essential) elements of In the EU basic act In the implementing or the processing delegated acts

Objective(s) and purpose(s) Yes [but the purpose(s) Additional specifications are may stem from the general possible provided that they comply economy of the act, if there with the purposes identified in the is no ambiguity] basic act (even if implicitly but surely).

Identification of the Yes [whenever possible/ Yes (if not already in the basic act controller(s) appropriate] and unless it would clearly exceed the delegation of powers)

(Categories of) processed Yes OR empowering Yes (if not already in the basic act personal data provision and unless it would clearly exceed the delegation of powers) Not mandatory, unless explicitly provided for under secondary EU law

25

Categories of data subjects Yes OR empowering Yes (if not already in the basic act provision and unless it would clearly exceed the delegation of powers)

b) Elements to be found in the legal act where it constitutes a serious interference with the rights to data protection and privacy of data subjects

(Essential) elements of In the EU basic act In the implementing or the processing delegated acts

Objective(s) and purpose(s) Yes [but the purpose(s) No may stem from the general economy of the act, if there is no ambiguity]

Identification of the Yes [whenever Yes (if not already in the basic act controller(s) possible/appropriate] and unless it would clearly exceed the delegation of powers)

(Categories of) processed Yes Depending on the intrusiveness of personal data the measures, the Commission may receive the power to specify further the processed data.

Categories of data subjects Yes [but the categories of No data subjects can be deduced from other provisions of the act, provided that there is no ambiguity]

Max duration of the data Yes The Commission may be storage or, at least, criteria authorised to (further) determine for determining such the storage duration based on duration criteria defined by the legislators and to reduce the storage duration of data.

26