Privacy by Design

Opinion 5/2018

EDPS Opinion on the proposal for a recast of the Public Sector Information (PSI) re-use Directive

(Directive of the European Parliament and of the Council on the re-use of public sector information)

10 July 2018 1 | P a g e

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 41(2) of Regulation 45/2001 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to privacy, are respected by the Community institutions and bodies’, and ‘…for advising Community institutions and bodies and data subjects on all matters concerning the processing of personal data’. Under Article 28(2) of Regulation 45/2001, the Commission is required, ‘when adopting a legislative Proposal relating to the protection of individuals’ rights and freedoms with regard to the processing of personal data...’, to consult the EDPS.

He was appointed in December 2014 together with the Assistant Supervisor with the specific remit of being constructive and proactive. The EDPS published in March 2015 a five-year strategy setting out how he intends to implement this remit, and to be accountable for doing so.

This Opinion is based on Article 41(2) of Regulation 45/2001/EC and provides for recommendations on how to better safeguard the right to privacy and the protection of personal data in the proposed recast of Directive of the European Parliament and the Council on the re-use of public sector information.

2 | P a g e

Executive Summary

The Public Sector Information (PSI) Directive aims to facilitate the re-use of public sector information throughout the European Union by harmonising the basic conditions that make PSI available to re-users, to enhance the development of Community products and services based on PSI and to avoid distortions in competition.

The new provisions include the extension of the scope of the Directive to documents held by public undertakings active in the areas on procurement such as entities operating in the water, energy, transport and postal services sectors. Moreover, it applies to documents held by public undertakings acting as public services operators, as long as such documents are produced as part of the services in the general interest. In addition, the Proposal’s scope will also be extended to specific research data such as results of scientific fact-finding processes.

The Opinion focuses on specific recommendations in order to better clarify the relation and coherence of the PSI Directive with the GDPR exceptions and on the reference to applicable data protection law. Additionally it provides for further recommendations on anonymisation and its relation to costs and data protection, also focusing on a data protection impact assessment, while taking into account an ‘acceptable re-use policy’.

The EDPS with this Opinion on PSI re-use builds on the work already done on the ‘Good

Big Data’ (the ‘EU values-based data sharing’), and notably on EDPS opinions and

formal comments previously issued, consistently with our practice on supervision cases. Moreover, we point out to the issues that need harmonization at EU level to allow the recast of the PSI Directive to rip the expected benefits.

the relationship and coherence of the PSI with the GDPR by putting forward a drafting

suggestion.

Moreover, the EDPS suggests to re-introduce the specific provision currently contained in Article 1(4) of the Directive 2013/37/EU in the main provisions of the Directive and to clealry state in the Proposal that the definition of ‘personal data’ according to Article 4(1)

of the GDPR applies. The EDPS also recommends to add the reference to the

The EDPS also recommends to support the use of anonymisation by making a reference to ‘anonymous information’ in the legal text and extending the scope of the entities entitled to include anonmysation costs within the costs that can be charged to reusers.

As a last recommendation, the EDPS suggests to provide for data protection impact assessments, for specific sectors dealing with sensitive data, such as the health sector, on which the licensor should base its decision and consequently take into account the conditions for re-use.

3 | P a g e

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty of the Functioning of the European Union, and in particular Article 16 thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof, Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) , Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular Article 41(2) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction and background

1. On 25 April 2018, the Commission adopted a Proposal for a Directive amending Directive 2013/37/EU (following a review of Directive 2003/98/EC) on the re-use of public sector information (PSI) (the ‘Proposal’). The Proposal is part of the ‘2018 Data Package’, which also includes other important documents: (i) a Commission Communication entitled “Towards a common European data space” (the ‘Communication’); (ii) Guidance on sharing private sector data, in the form of a Staff Working Document (‘Guidance’); and (iii) an evaluation of the PSI Directive.

2. The objective of the Proposal is to update and amend the existing text of Directive 2013/37/EU and Directive 2003/98/EC on re-use of public sector information (the PSI Directive).

3. The review of the Directive is one of the three ‘measures’ proposed by the Commission towards a common data space in the EU (see the ‘umbrella’ Communication from the Commission COM (2018) 232, hence ‘the Communication’), together with the Guidance on sharing private sector data [...] and the update of the Recommendation on access to and preservation of scientific information [...].

4. In proposing to amend the PSI Directive, the European Commission aims to facilitate the re-use of public sector information such as legal, traffic, meteorological, economic and financial data throughout the European Union by harmonising the basic conditions that make PSI available to re-users, to enhance the development of Community products and services based on PSI and to avoid distortions in competition.

5. In particular, the Proposal’s overall objective is to be in line with the Digital Single Market Strategy’s objectives. The Proposal aims to enhance the effect of the Directive by strengthening specific provisions and modifying them accordingly in order to 5 | P a g e increase the amount of public sector data available for re-use. Specifically, the initiative also aims to strengthen Small and Medium Enterprises’ position in the data market by granting fairer competition and an easier access to markets, together with the enhancement of cross-border innovation.

6. Relevant new provisions to the Directive include the extension of its scope to documents held by public undertakings active in the areas on procurement by entities operating in the water, energy, transport and postal services sectors. Moreover, it applies to documents held by public undertakings acting as public services operators, as long as such documents are produced as part of the services in the general interest. The proposal’s scope will also be extended to specific research data such as results of scientific fact-finding processes (i.e. experiments and surveys). The Proposal in practice “(...) lays down a horizontal framework providing minimum harmonisation of reuse conditions across domains and sectors.”

7. The EDPS positively notes that according to the European Commission the recast of the PSI Directive aims to foster the reuse of public sector information, as pointed out in the Communication, by “reducing market entry barriers, in particular for small and medium-sized enterprises; minimising the risk of excessive first-mover advantage, which benefits large companies and thereby limits the number of users of the data in question; increasing business opportunities by encouraging the publication of dynamic data and the uptake of application programming interfaces (APIs).”

8. The PSI directive is part of the EU vision on the fostering of “Good Big Data”. Public sector information is a key source of “the raw material” of the Big Data of the Digital Single Market. The smart use of data, including its processing via Artificial Intelligence, can have a transformative effect on all sectors of the economy.

9. Already in September 2016, the EDPS, with the Opinion on coherent enforcement of fundamental rights in the age of big data , has put forward a strategy for shaping an EU cyberspace based on EU values, pointing out to issues such as concentration of market and informational power; and a weak market for Privacy Enhancing Technologies (‘PETs’) as measures for minimising personal data processing without losing the functionality of a product or a service (as inspired by the principle of privacy by design and by default).

10. Moreover, the EDPS would like to recall the data protection-relevance of the ‘key principles’ that, according to the European Commission, should be respected in the context of data re-use, namely (i) minimised data lock-in and ensure undistorted competition; (ii) transparency and societal participation on the purpose of the reuse vis-à-vis the citizens/data subjects as well as transparency and clear purpose definition between the licensor and the licensees; (iii) data protection impact assessment and appropriate data protection safeguards for reuse (according to a ‘do no harm’- under the data protection viewpoint- principle).

11. While the EDPS has been informally consulted by the European Commission, it has not been formally consulted as required by Article 28 (2) of Regulation (EC) No 45/2001. The Opinion is therefore based on Article 41(2) of the same Regulation. The EDPS recommends that a reference to this Opinion be included in the preamble of the adopted instrument. 6 | P a g e

12. As a preliminary remark, the EDPS welcomes the provision under Article 1(2)(g) of the Proposal which excludes the re-use of documents on grounds of data protection. The EDPS particularly appreciates the fact that the draft Proposal underlines that not all data which is accessible under relevant access regimes will also be automatically available for re-use. Such an interpretation had already been given by the Article 29 Working Party in its Opinion , which the EDPS fully supports.

13. In particular, under Article 1(2)(g), the Proposal provides for an exception from the scope of the PSI Directive on grounds of data protection, by stating that the Directive would not apply to “ documents access to which is excluded or restricted by virtue of the access regimes on the grounds of protection of personal data, and parts of documents accessible by virtue of those regimes which contain personal data the reuse of which has been defined by law as being incompatible with the law concerning the protection of individuals with regard to the processing of personal data”.

14. While the EDPS appreciates the intention behind this wording, we also take note that it might not be sufficiently clear and lead to challenges in interpreting the law. In particular, we consider that the legal text could be simplified and rephrased by distinguishing the two types of documents at stake and by simplifying the reference to the incompatibility with data protection law.

15. The EDPS recalls the wording set out in Article 4(1)(b) of Regulation EC No 1049/2001 providing that the European institutions shall refuse access to a document where such disclosure “would undermine the protection of privacy and integrity of the individual, in particular in accordance with [Union] legislation regarding the protection of personal data”. In line with such wording, the Article could be rephrased so to create better legal certainty and consistency. provide for specific wording on the difference between ‘documents’ and ‘parts of documents’ to which the PSI Directive would not be applicable on data protection grounds. This would better clarify the relationship and coherence of the PSI Directive with the GDPR. Moreover, it could specifically and more consistently refer to ‘regimes which contain personal data the re-use of which’ could undermine the fundamental right to privacy and the protection of personal data.

17. As a minor recommendation, the EDPS suggests to add a reference to the Proposal, to further enhance the link between the re-use of public sector information and the protection of personal data. 7 | P a g e

3. Reference to applicable data protection law

18. The EDPS welcomes the reference to data protection law provided for in Recital 47 of the Proposal. In particular, we take note that the same recital provides for reference, both with regards to data protection legislation and data anonymisation.

19. However, we also note that the Proposal does not mention data protection Union law in any of the main substantive provisions of the legislative draft. While Article 1(4) of the current Directive 2013/37/EU contains a well-informed statement on the application of data protection law to the re-use of public sector information, the Proposal provides for a deletion of the same article.

20. Although the EDPS appreciates the intention of inserting specific reference to data protection Union law in recital 47 of the current Proposal, we believe that the wording contained in Article 1(4) of Directive 2013/37/EU should not disappear from the substantive provisions of the Directive. Indeed, maintaining a clear provision on the applicability of Union legislation on data protection would enhance legal certainty and contribute to the consistency of the overall regulatory framework.

21. More specifically, a provision should be re-introduced in the Proposal to underline that the Directive would “leave intact and in no way affect the level of protection of individual with regard to the processing of personal data under the provisions of Union and national law” and that it would not “alter any obligations and rights set out in” the data protection legislation currently in force, thus providing for better legal certainty and guaranteeing that fundamental rights are not undermined.

22. Therefore, considering that the provision currently in place grants legal certainty and consistency with the data protection legal framework, the EDPS recommends to re- 2013/37/EU in the substantive part of the Proposal (including the necessary update of references to the legal instruments currently in force).

4. Anonymisation of personal data

23. In its previous Opinion on the 2013 PSI Directive the EDPS had recommended to provide for an exception in order to allow public sector bodies to charge re-users the reasonable expenses they incur in to pre-process, aggregate and/or anonymise the personal data offered for re-use, in situations where the use of such techniques would be justified in light of the increased risks deriving from offering such data for re-use. In fact, in certain cases, the anonymisation of exisiting documents held by public sector bodies, can be a complex, time-consuming and expensive tasks shich require expertise that might not always be available.

24. The EDPS welcomes that his informal comments have been taken into account regarding anonymisation. Recitals 32 and 33 of the Proposal, together with Article 6, paragraphs (1), (3) and (4) provide for specific reference to anonymisation costs and to a clear distinction between ‘anonymisation of personal data’ and ‘anonymisation of commercially confidential information’. 8 | P a g e

25. However, the EDPS also notes that the provisions set out in Article 6(1) and (2) of the Proposal seem to limit the possibility to charge such costs to only some of the organisations falling under the scope of the PSI Directive, particularly to (i) public sector bodies that are required to generate revenue to cover a substantial part of their costs in relation to the performance of their public task, (ii) libraries, museums and archives and (iii) public undertakings. The EDPS considers that this possibility should be available to all organisations falling within the scope of the PSI Directive. Therefore, the EDPS would suggest to allow every organisation falling within the scope of the Proposal to charge costs of anonymising the information.

26. Given the importance of anonymisation as a means of finding a balance between the interests in making public sector information re-use possible and the various obligations under data protection legislation, the EDPS notes that the draft Proposal could contain a reference to ‘anonymous information’ as defined in Recital 26 of the GDPR, “(...) namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable”. Therefore, the EDPS suggests to include a reference to ‘anonymous information’ in the Proposal, in order to better clarify its meaning and application.

27. The EDPS finally underlines that the re-use of anonymised public source information (extended by the recast Proposal of the PSI Directive to the providers of public services) is a way to foster the use of big data in a pro-competitive perspective while also meeting the data protection requirements.

28. As a reference to the last point, the EDPS would also like to point out some best practices with reference to the re-use of anonymised data in the public sector. In particular, the European Medicines Agency (EMA) has developed extensive guidance for industry to facilitate compliance with this policy. Moreover, we also refer to the European Statistical System (ESS) which provides its statistics free of charge as a public good of high quality irrespective of subsequent commercial or non-commercial use. The ESS subscribes to an open, free access and re-use policy for its publicly released statistics in line with the PSI Directive.

5. Blurring distinction between personal and non-personal data

29. The EDPS notes that Article 2(5) of the current Directive 2013/37/EU providing for a definition of ‘personal data’ has been deleted from the current draft Proposal. However, given the subject and the scope of the PSI Directive together with the growing number of situations where making a clear distinction between personal and non-personal data, the EDPS recommends to clearly state in the Proposal that the

30. Moreover, when referring to personal data, the EDPS would like to recall his recently published comments regarding the Proposal for a Regulation on the free flow of nonpersonal data . As referred to in the published document, “[w]ithin the context of a rapidly growing data-intensive society, users or the machines they own produce more and more data every day and where the possibility to single out a person on the basis 9 | P a g e of very few data points is becoming easier (...).” It is therefore essential to highlight the particular challenges that might arise when trying to differentiate the two types of data.

31. Consequently, the EDPS would like to draw attention to the fact that while much of the data already today and increasingly in the future is generated and processed by machines, such data are often likely to fall within the scope of the definition of personal data. In this view, the EDPS calls upon the European legislator when drafting new PSI legislation having an impact on personal data to keep in mind that in any case, the data subjects’ fundamental rights to privacy and data protection must be fully ensured.

6. Data Protection Impact Assessment

32. Since ensuring the free flow of personal data is one of the objectives of EU data protection law, the EDPS considers that -rather than (trying to) define a kind of ‘facilitated highway’ for ‘non personal’ data- the legislator should better address stakeholder concerns related to the necessary protection of personal data, especially in sensitive sectors such as the health sector, when they take the decision on the reuse of PSI.

33. For this reason, we make recommendations (some of them are expressed as wording suggestions to be integrated in the legal text of the PSI directive) on: (i) the data protection impact assessment on which, especially for some “sensitive sectors” (health sector, but also transport or energy grids), should be based the decision by the licensor on the reuse (for example, clarifying the risks of re-identification of anonymised data and the safeguards against those risks); (ii) taking into account the DPIA, the conditions for data re-use (the “acceptable reuse policy”).

34. Therefore, the EDPS recommends licensors to perform data protection impact assessments, in particular for specific sectors routinely dealing with special categories of personal data, such as the health sector, or other “sensitive” data, when taking the decisions on the scope and conditions for the re-use.

7. Conclusion

Therefore the EDPS recommends:

 to modify Article 1(2)(g) of the Proposal and to provide for specific wording on the difference between ‘documents’ and ‘parts of documents’ to which the PSI Directive would not be applicable on data protection grounds.

 to add a reference to the Supervisory Autority set up by Article 51 of the GDPR under Article 4(4) of the Proposal, in order to further enhance the link between the re-use of public sector information and the protection of personal data.

10 | P a g e

 to re-introduce the specific provision on applicable data protection law currently

Proposal (including the necessary update of references to the legal instruments currently in force).  to further point out to the use of anonymisation in the context of the reuse of public sector information by including a reference to ‘anonymous information’ in the legal text and extending the scope of the entities entitled to include anonmysation

costs within the costs that can be charged to reusers.

 to clearly state in the Proposal that the definition of “personal data” according

 to provide for data protection impact assessments, for specific sectors dealing with sensitive data, such as the health sector, on which the licensor should base its decision and consequently take into account the conditions for re-use.  As a last comment, in putting forward these recommendations, the EDPS stresses the data protection-relevance of the following ‘key principles’, that according to the Commission should be respected in the context of data re-use, namely:

(i) Minimised data lock-in and ensure undistorted competition;

(ii)Transparency and societal participation on the purpose of the reuse vis-à-vis the citizens/data subjects as well as transparency and clear purpose definition between the licensor and the licensees;

(iii) Data protection impact assessment and appropriate data protection safeguards for reuse (according to a ‘do no harm’ -under the data protection viewpointprinciple).

11 | P a g e

Brussels, Giovanni BUTTARELLI 12 | P a g e

Notes

13 | P a g e