EDPS Opinion 1/2024 on the Proposal for a Regulation establishing an EU Talent Pool.

9 January 2024

Opinion 1/2024

on the Proposal for a Regulation establishing an EU Talent Pool

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council establishing an EU Talent Pool . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 16 November 2023, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council establishing an EU Talent Pool (‘the Proposal’). The objective of the Proposal is to facilitate international recruitment and provide opportunities for third country nationals to work in EU-wide shortage occupations by establishing an EU Talent Pool.

The EU Talent Pool would take the form of a Union-wide platform that brings together and supports the matching of profiles of registered jobseekers from third countries residing outside the Union and job vacancies of employers established in the participating Member States. The Proposal is expected to help addressing the existing labour shortages in the Union and also to contribute to reducing of the irregular migration pressure on the Union by promoting legal pathways for potential economic migrants to the EU.

While recognising that the Proposal pursues objectives of public interest and already provides for useful safeguards, the EDPS considers that further attention should be given to the categories of personal data that would be processed in the EU Talent Pool and the roles and responsibilities of the different actors involved, including with regard to the obligation to provide information to data subjects.

The Opinion provides several specific recommendations, in particular regarding the need to define in more granular and exhaustive manner the categories of data that can be processed by the EU Talent Pool Secretariat and by the EU Talent Pool National Contact Points, based on their specific roles; to lay down the prohibition to process special categories of personal data in the EU Talent Pool in the enacting terms of the Proposal; and to further specify the responsibilities of the actors involved in the processing operations within the EU Talent Pool IT platform, in particular in view of the obligation under Article 6(4) to provide information to the registered jobseekers from third countries and the EU employers.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 16 November 2023, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council establishing an EU Talent Pool (‘the Proposal’).

2. The objective of the Proposal is to facilitate international recruitment and provide opportunities for third country nationals to work in EU-wide shortage occupations by establishing an EU Talent Pool. The EU Talent Pool would take the form of a Union-wide platform that brings together and supports the matching of profiles of registered jobseekers from third countries residing outside the Union and job vacancies of employers established in the participating Member States .

3. The Proposal aims to attract talent and skills from outside the EU and, by so doing, to contribute to addressing existing and future labour and skills shortages, including those linked to the green and digital transition. The Proposal also aims to promote potential economic migrants to come to the EU through legal channels, which would contribute to reducing irregular migration pressure.

4. This initiative was formally announced in the Communication of the European Commission on ‘Attracting Skills and Talent’ of April 2022 . The Pact on Migration and Asylum has also explicitly recognised the need to further explore the development of an EU Talent Pool .

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 16 November 2023, pursuant to Article 42(1) of EUDPR. In this regard, the EDPS recommends adding in a separate recital, as per standard practice, that ‘the European Data Protection Supervisor was consulted in accordance with Article 42 of Regulation (EU) 2018/1725 of the European Parliament and of the Council and delivered an opinion on ... [EDPS Opinion date]’. The EDPS positively notes that he was already previously informally consulted pursuant to Recital 60 of EUDPR.

2. General remarks

6. The EDPS notes that the establishment of an EU Talent Pool and the related processing of personal data aim at achieving specific objectives of public interest. In particular, the collection and matching of profiles of registered jobseekers from third countries and job vacancies of EU employers is expected to help addressing the existing labour shortages in the Union.

7. In the same spirit, the EDPS notes the additional goal of the Proposal to contribute to reducing of the irregular migration pressure on the Union by promoting legal pathways for potential economic migrants to the EU.

8. At the same time, the EDPS observes that the threshold for access to the EU Talent Pool IT platform would be quite low, as technically anyone could register as a potential jobseeker from third countries or Union employer. Against this background, the EDPS considers that particular attention should be paid to the categories of personal data processed as well as to the roles and responsibilities of the different actors involved, including with regard to the information provided to the data subjects.

3. Categories of personal data

9. The EDPS recalls that, in line with the data minimisation principle laid down in Article 5(1)(c) of the GDPR and Article 4(1)(c) of the EUDPR, the collection of personal data should be limited to what is necessary to fulfil the purposes for which they are processed.

10. The EDPS positively notes that Article 6(3) of the Proposal lists the categories of personal data that can be included in the profiles of registered jobseekers and job vacancies of employers. At the same time, as regards the personal data of employers (or persons authorised to act on their behalf), the EDPS considers that Article 6(3) could be even more precise. In particular, he recommends specifying in the last sentence of Article 6(3) that “the contact details” are those of the employer that published the vacancy in question which may, where necessary, include the name and surname of the persons responsible for the vacancy.

11. The EDPS positively notes that Article 6(1) and (2) of the Proposal specifically circumscribe the purposes for which personal data can be processed by the EU Talent Pool Secretariat and the EU Talent Pool National Contact Points, respectively, and further limit the processing “only to the extent necessary for the performance of [their] tasks”.

12. At the same time, the EDPS notes that, in accordance with Article 8 and 10 of the Proposal, the EU Talent Pool Secretariat and the EU Talent Pool National Contact Points would carry out different tasks - those of the former being mainly of administrative nature, and those of the latter more closely related to the core functions of the initiative. Therefore, to ensure legal certainty, the EDPS recommends defining in more granular and exhaustive manner 5 the categories of data that can be processed by each of them, based on their specific roles. This further precision could be provided for either in the Proposal itself, or in the implementing acts, which the Commission is empowered to adopt pursuant to Article 6(9) of the Proposal.

13. The EDPS welcomes the clarification in Recital 13 that the processing of personal data “[...] should not require processing any personal data referred to in Article 9 of Regulation (EU) 2016/679 and Article 10 of Regulation (EU) 2018/1725.” However, the EDPS notes that this prohibition is provided only in a non-binding recital and does not have a corresponding legal provision in the enacting terms of the Proposal. The EDPS therefore recommends, in the interest of legal certainty, to state explicitly in the enacting terms of the Proposal that the EU Talent Pool shall not process special categories of personal data.

14. Finally, as regards the empowerment of the Commission in Article 6(9) of the Proposal to adopt implementing acts with further rules on, among others, the personal data to be processed and included in the job vacancies and jobseekers’ profiles formats and the conditions for accessing personal data, the EDPS underlines that these implementing acts should only specify, if necessary, certain more detailed data fields (sub-categories of data), which fall under the already defined categories of data in Article 6(3) of the Proposal. This comment is without prejudice to the future EDPS consultation on the envisaged implementing acts pursuant to Article 42(1) EUDPR.

4. Roles and responsibilities

15. The EDPS recalls that the concepts of controller, joint controller and processor play a crucial role in the application of data protection law, since they determine who is responsible for compliance with different data protection rules, and how data subjects can exercise their rights in practice. The EDPS welcomes that the Proposal designates roles and responsibilities of the EU Talent Pool Secretariat and of the EU Talent Pool National Contact Points , which appropriately reflect the tasks attributed to themunder Article 8(2) and Article 10(2) of the Proposal, respectively.

16. In this respect, to facilitate the exercise of data subjects’ rights, the EDPS recommends further specifying, either in the Proposal itself, or in the implementing acts envisaged in Article 6(9) of the Proposal, the respective responsibilities of the actors involved in the processing operations within the EU Talent Pool IT platform, in particular in view of the obligation under Article 6(4) to “[...] inform registered jobseekers from third countries and employers participating in the EU Talent Pool about the processing of their personal data and their rights as data subjects as well as about their rights under paragraphs 6 and 7”.

5. Conclusions

17. In light of the above, the EDPS makes the following recommendations: (1) to define , either in the Proposal itself, or in the implementing acts envisaged in Article 6(9) of the Proposal, the specific categories of data that can be processed by the EU Talent Pool Secretariat and by the EU Talent Pool National Contact Points, respectively, based on their specific roles; (2) to lay down the prohibition to process special categories of personal data in the enacting terms of the Proposal, in addition to Recital 13 of the Proposal; (3) to further specify, either in the Proposal itself, or in the implementing acts envisaged in Article 6(9) of the Proposal, the respective responsibilities of the actors involved in the processing operations within the EU Talent Pool IT platform, in particular in view of clarifying the obligation under Article 6(4) to inform data subjects about the processing of their personal data and their rights as data subjects as well as about their rights under paragraphs 6 and 7 of Article 6 of the Proposal. Brussels, 9 January 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7