EDPS Opinion 1/2025 on the Proposal for a Regulation on a public interface connected to the Internal Market Information System

8 January 2025

Opinion 1/2025

on the Proposal for a Regulation on a public interface connected to the Internal Market Information System for the declaration of the posting of workers and amending Regulation (EU) No 1024/2012

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on a public interface connected to the Internal Market Information System for the declaration of posting of workers and amending Regulation (EU) No 1024/2012 . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 14 November 2024, the Commission consulted the EDPS on the Proposal for a Regulation of the European Parliament and of the Council on a public interface connected to the Internal Market Information System for the declaration of posting of workers and amending Regulation (EU) No 1024/2012 (‘the Proposal’).

The objective of the Proposal is to establish a multilingual electronic public interface (‘the interface’) to be used for transmission of declarations of posting of workers. The interface would be connected to the Internal Market Information System (‘IMI’), established under Regulation (EU) No 1024/2012, and would facilitate the process of declaration of posting of workers in accordance with Directive 2014/67/EU (‘the posting of workers Directive’).

The EDPS welcomes that the Proposal clarifies the roles of the Commission, the service providers and the national competent authorities in relation to the processing of personal data. The EDPS further welcomes that the Proposal specifies the information to be included in the standard form to be used for the declaration of the posting of workers, as well as the data retention period applicable to the information that would be submitted via the interface.

The EDPS recommends clearly specifying the terms ‘identity’ and ‘contact details’, referred to in Article 5(3), point (a), (b) and (e) of the Proposal, in the standard form referred to in Article 4(1) and established via the implementing act referred to in Article 4(2) of the Proposal. The EDPS also recommends adding a reference to the service recipient in Article 5(3) of the Proposal, should any processing of personal data be envisaged.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 14 November 2024, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on a public interface connected to the Internal Market Information System for the declaration of posting of workers and amending Regulation (EU) No 1024/2012 (‘the Proposal’).

2. The objective of the Proposal is to establish a multilingual electronic public interface (‘the interface’) connected to the Internal Market Information System (‘IMI’), established under 4 5 Regulation (EU) No 1024/2012 , for the declaration of posting of workers . The interface would facilitate the process of declaration of posting of workers in accordance with Directive 2014/67/EU (‘the posting of workers Directive’) and support administrative cooperation between national competent authorities .

3. The Proposal is accompanied by a Commission Staff Working document describing in particular the envisaged public interface, the IT architecture, the standard form to be used by service providers in the context of the declaration of posted workers .

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 14 November 2024, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 21 of the Proposal. However, the EDPS notes that the issuance date of the Opinion is incorrectly stated and recommends its correction. The EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of the EUDPR.

2. General remarks

5. To allow controls at the workplace by the national competent authorities of the host Member State, certain information would need to be provided in the declaration of posting of workers via the public interface established by the Proposal. Sharing this information would entail the processing of certain well-defined and limited categories of personal data. For instance, the standard form, to be transmitted via the interface as specified in the Proposal, must contain, among others, information related to the posted worker as well as the contact person to liaise with the competent authorities .

6. Against this background, the EDPS welcomes the reference to both the EUDPR and the 11 12 GDPR in the recitals of the Proposal . In addition, the EDPS welcomes the inclusion of a specific provision concerning the processing and retention of personal data .

3. Roles and responsibilities

(a) ensuring the security and availability of the public interface;

(b) processing the identification and contact details of the person submitting the declaration of posting of workers .

(a) the identity and contact details of the service provider;

(b) the identity of a posted worker;

(c) an electronic notification address, such as a mail address, of a posted worker to inform the posted worker that a declaration has been submitted for that worker;

(d) the address of the workplace of the posted worker;

(e) the identity and contact details of the contact person of the service provider .

9. The Proposal also provides that where a competent authority of a Member State receives posting declarations additionally through the public interface in its national back-end system, the competent national authority is to be considered as controller within the meaning of Article 4(7) GDPR in respect of the processing of personal data contained in these posting declarations .

10. The EDPS welcomes the inclusion of these provisions in the Proposal, clarifying which entities act as a controller in relation to which processing of personal data.

4. Standard form

11. The EDPS notes that the Commission will establish the standard form, referred to in Article 4(1) of the Proposal, by way of implementing acts . The EDPS recalls that it should be consulted, among others, on implementing acts having an impact on the protection of personal data (as it would be the case for the implementing act referred to in Article 4(1) of the Proposal) pursuant to Article 42(1) EUDPR.

12. The EDPS considers that the terms ‘identity’ and ‘contact details’, referred to in Article 5(3), point (a), (b) and (e) of the Proposal, should be clearly defined in the standard form referred to in Article 4(1) and established via the implementing act referred to in Article 4(2) of the Proposal.

13. The EDPS highlights a potential inconsistency between Article 4(1) and Article 5 of the Proposal. In particular, Article 4(1)(e) specifies that the standard form must include information related to ‘the service recipient’. In contrast, Article 5 of the Proposal does not make explicit reference to the service recipient. Should any processing of personal data regarding the service recipient (e.g., a contact person) be envisaged, the EDPS recommends adding a reference to the service recipient in Article 5(3) of the Proposal.

5. Retention period

14. Article 5(5) of the Proposal provides that “[t]he public interface shall ensure the automatic deletion of the information related to a posting which has been submitted through that public interface 36 months after the end date of the posting period”. The EDPS welcomes the inclusion of a provision defining the maximum retention period for personal data related to a posting submitted through the public interface, as well as the justification of why this retention period would be necessary .

15. The Proposal also stipulates that the public interface shall allow for the deletion of all personal data stored in there and in the service providers’ accounts when those data are no longer needed for the purposes for which they are collected and processed . In addition, the public interface shall allow for the sending of a reminder to the service provider to review and delete, when necessary, any personal data in accordance with Article 5(6) of the Proposal .

6. Conclusions

16. In light of the above, the EDPS makes the following recommendations: (1) to clearly specify the terms ‘identity’ and ‘contact details’, referred to in Article 5(3), point (a), (b) and (e) of the Proposal, in the standard form referred to in Article 4(1) and established via the implementing act referred to in Article 4(2) of the Proposal. Brussels, 8 January 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI