Opinion 2/2026 on the Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision

on the Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Directive of the European Parliament and of the Council amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision.

This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725.

This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 20 November 2025, the European Commission adopted the Proposal for a Directive of the European Parliament and of the Council amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision.

The objective of the Proposal is to strengthen the capacity of occupational pension funds to deliver adequate retirement income, to act as stable long-term investors supporting sustainable growth, and to contribute to the resilience and deepening of the Union’s capital markets. The EDPS welcomes the objectives of the Proposal, particularly the objective of enhancing transparency and facilitating member and beneficiaries’ awareness of their entitlements.

Data about members and beneficiaries of pension schemes qualifies as personal data within the meaning of EU data protection law. Records on pension rights may also contain special categories of data within the meaning of Article 9(1) of the GDPR, in particular data concerning health. Therefore, it is important to clearly indicate which categories of personal data will be collected and shared and to ensure that appropriate safeguards are in place.

The Proposal establishes that, where pension tracking systems are established at the national level, institutions for occupational retirement provision (IORPs), insurance undertakings and insurance intermediaries would be required to share information with such pension tracking systems. The EDPS recommends defining clear rules for the functioning of pension tracking systems, including in what concerns the processing of personal data. The EDPS recommends empowering the Commission to determine via delegated regulation the types of personal data that should be shared by IORPs, insurance undertakings and insurance intermediaries with the entities managing pension tracking systems. In the same vein, the EDPS recommends to further clarify the categories of personal data that IORPs are expected to collect from members and beneficiaries of pensions schemes to determine their risk tolerance in the context of assessing the long-term risk of pensions schemes.

Lastly, the EDPS recommends empowering the Commission to lay down in a delegated or implementing act the procedures to be followed by IORPs when carrying out checks and reporting on the qualifications, knowledge, experience, good repute and integrity of the persons who effectively run the IORP, their management, administrative, supervisory and internal audit functions. The categories of personal data that should be processed in that context should be specified.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 20 November 2025, the European Commission adopted the Proposal for a Directive of the European Parliament and of the Council amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision (‘the Proposal’).

2. The Proposal aims to contribute to the creation of a European Savings and Investments Union by mobilising private savings for productive investment and ensuring that the benefits of such investment are channelled back to citizens in the form of higher and reliable retirement incomes. The Commission considers that private and occupational pensions can support EU citizens in securing their retirement and to facilitate the channelling of savings into the wider economy .

3. The objective of the Proposal is to strengthen the capacity of occupational pension funds to deliver adequate retirement income, to act as stable long-term investors supporting sustainable growth, and to contribute to the resilience and deepening of the Union’s capital markets .

4. The Proposal is part of a broader pension package that includes the review of Regulation (EU) 2019/1238 , on which the EDPS is delivering a separate Opinion.

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 20 November 2025, pursuant to Article 42(1) of EUDPR. The EDPS positively 4 notes that he was already previously informally consulted pursuant to recital 60 of EUDPR. The EDPS recommends making a reference to the present consultation under Article 42(1) of EUDPR and to the Opinion of the EDPS in a Recital of the Proposal.

2. General remarks

6. The EDPS welcomes the objectives of the Proposal, particularly the objective of enhancing transparency and facilitating member and beneficiaries’ awareness of their entitlements. Data about members and beneficiaries of pension schemes relates to natural persons and, therefore, qualifies as personal data within the meaning of Article 4(1) of Regulation (EU) 2016/679 (‘the GDPR’) and Article 3(1) EUDPR.

7. Pension rights may include retirement benefits that are “in the form of payments on death, disability, or cessation of employment or in the form of support payments or services in case of sickness, indigence or death” . IORPs operating occupational pension schemes may also cover biometric risks, i.e. risks related to death, disability and longevity . Records on pension rights can therefore include special categories of personal data within the meaning of Article 9(1) of the GDPR, in particular data concerning health. Therefore, it is important to clearly indicate which categories of personal data will be collected and shared and to ensure that appropriate safeguards are in place.

8. The EDPS notes that the GDPR would apply when personal data are processed in the context of the Proposal. There may also be situations where EU bodies covered by the Proposal, such as the European Insurance and Occupational Pensions Authority (‘EIOPA’), would be subject to the EUDPR (e.g., when EIOPA would assist a national competent authority in carrying out an on-site inspection).

9. The EDPS therefore welcomes that Article 1(60) of the Proposal refers to the application of the GDPR and of the EUDPR in the context of Directive (EU) 2016/2341. The EDPS recommends including a similar provision in Article 2 of the Proposal to amend Article 37 of Directive (EU) 2016/97, which currently refers to the application of repealed Directive 95/46/EC and of repealed Regulation (EC) No 45/2001. In the same vein, the EDPS recommends adding a reference to the applicability of the EUDPR in Recital 50 of the Proposal. 5

3. Pension tracking systems

10. Article 1(37) of the Proposal provides that “Member States shall ensure that IORPs transmit to pension tracking systems, where such systems have been established, all information necessary to provide members and beneficiaries with a comprehensive, reliable and up-to-date overview of their occupational and personal pension entitlements, insofar as those entitlements are administered by the IORP.” Such information (which qualifies as personal data of members and beneficiaries) would be transmitted in “standardised, machine-readable and interoperable format enabling pension tracking systems to aggregate data on accrued rights, accumulated capital and projected benefits in a coherent and comparable manner.” A similar provision is Article 2(3) of the Proposal, in relation to data sharing by insurance undertakings and insurance intermediaries with pension tracking systems under Directive (EU) 2016/97.

11. The EDPS notes that the Proposal would define a “pension tracking system”, under both Directives (EU) 2016/2341 and 2016/97 as “a digital tool, typically a secure web portal or mobile application, that provides individuals with an overview of their individual accrued pension entitlements, and projections of future benefits, across the pension schemes of which the individual is a member or beneficiary” .

12. The EDPS recommends defining clear rules for the functioning of pension tracking systems, including in what concerns the processing of personal data. In this regard, the EDPS recommends that the regulatory technical standards defining the format and structure of the information to be transmitted to pension tracking systems - to be adopted via delegated regulation by the European Commission - also define the categories of personal data to be shared by IORPs. The EDPS recommends similarly empowering the Commission to specify such elements also under Directive (EU) 2016/97 for the sharing of information by insurance undertakings and insurance intermediaries with pension tracking systems.

4. Appropriate structure and implementation of pension schemes

13. Article 1(45) would add a new Chapter 4 to Title IV of Directive (EU) 2016/2341. Among various business conduct rules for IORPs, Article 1(45) of the Proposal would require Member States to ensure that, where members bear investment risk, IORPs assess the longterm risk from the perspective of members and beneficiaries, including the determination of the risk tolerance of members and beneficiaries bearing risks .

14. Based on recital (28) of the Proposal, the EDPS understands that the determination of risk tolerance would take into account the capacity and appetite for risk of members and beneficiaries. No indication is provided, however, as to how such an assessment should be 6 made. To enhance legal certainty and foreseeability, the EDPS recommends further clarifying which categories of personal data IORPs are expected to collect from members and beneficiaries to determine their risk tolerance in this context.

5. Requirements for fit and proper management of IORPs

15. The Proposal would provide a requirement for IORPs to ensure that the qualifications, knowledge and experience of persons who effectively run the IORP, their management, administrative, supervisory and internal audit functions are adequate to enable them to ensure a sound and prudent management of the IORP and to carry out their duties. Moreover, such persons would need to be of good repute and integrity .

16. The EDPS recommends including an empowering provision in the draft Proposal to enable the Commission to lay down in a delegated or implementing act the procedures to be followed by IORPs when carrying out such checks and reporting to competent authorities, as well as to specify the categories of personal data that should be processed in that context.

6. Conclusions

17. In light of the above, the EDPS makes the following recommendations: (2) to amend Article 37 of Directive (EU) 2016/97 by making a reference to the application of the GDPR and of the EUDPR to the processing of personal data entailed by the application of the Directive; (3) to add a reference to the application of the EUDPR in Recital 50 of the Proposal; (4) to provide rules for the functioning of pension tracking systems, including in what concerns the processing of personal data of members and beneficiaries by the entities managing the systems; (5) to empower the Commission to define via delegated regulation the types of personal data to be shared by IORPs, insurance undertakings and insurance intermediaries with pension tracking systems; (6) to specify the categories of personal data that IORPs are expected to collect from members and beneficiaries to determine their risk tolerance under Article 1(45) of the Proposal; and 7 (7) to empower the Commission to lay down in a delegated or implementing act the procedures to be followed by IORPs when carrying out checks on the qualifications, knowledge, experience, good repute and integrity of the persons mentioned in Article 1(24) of the Proposal and when reporting to competent authorities, as well as to specify the categories of personal data that should be processed in that context. Brussels, 9 January 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8