Service of documents and taking of evidence in civil or commercial matters

13 September 2019 1 | P a g e

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’. Under Article 57(1)(g) of Regulation 2018/1725, the EDPS shall ‘advise on his or her own initiative or on request, all Union institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data’.

He was appointed in December 2014 together with the Assistant Supervisor with the specific remit of being constructive and proactive. The EDPS published in March 2015 a five-year strategy setting out how he intends to implement this remit, and to be accountable for doing so.

This Opinion provides advice on two Commission proposals for the revision of the Regulations on the service of documents and the taking of evidence in civil or commercial matters, in particular with regard to the use of an IT system for their purposes.

2 | P a g e

Executive Summary

On 31 May 2018, the European Commission issued two proposals for a Regulation of the European parliament and the Council amending Council Regulation (EC) No 1206/2001 of 28 May 2001 on cooperation between the courts of the Member States in the taking of evidence in civil or commercial matters, on the one hand and a Regulation amending Regulation (EC) No 1393/2007 of the European Parliament and of the Council on the service in the Member States of judicial and extrajudicial documents in civil or commercial matters, on the other hand. The proposals mainly aim at improving the smooth functioning of judicial cooperation in these areas, by inter alia providing for transmission of documents and taking of evidence requests through a decentralised IT system.

The EDPS acknowledges that exchanges of personal data are necessary elements of the creation of an area of Freedom, Security and Justice. Therefore he welcomes the overall objectives of the proposals to improve the efficiency of judicial cooperation in civil or commercial matters in relation to the taking of evidence and the service of documents, in particular through digitalisation and the use of IT technology. He shares the view that the proposed legislation could have a real impact on the everyday lives of EU citizens.

This Opinion makes three main recommendations in order to constructively assist the legislators in achieving this very important objective while ensuring compliance with the Charter and the GDPR:

- providing a clear legal basis for the IT system which would be used for the transmission of documents, requests and communications for the purposes of these Regulations. In particular, in case the IT system would entail the involvement of an EU institution, body, agency or office, this legal basis should in principle be provided in an EU legislative act. Also, even in case the processing of personal data would take place in the framework of an existing IT system, the EDPS recommends providing for the use of such system in the legislative act itself. However, the existing system envisaged to be used should itself be duly established on the basis of a legal act adopted at EU level, which is currently not the case of e-CODEX. Should the EU legislator choose the e-CODEX solution, the lack of a legal instrument at EU level establishing and regulating the system should be remedied without delay.

- including in the legislative acts themselves a high level description of the IT system aspects, such as data protection responsibilities or relevant applicable safeguards, to be further defined in implementing acts. In particular, to the extent the Commission or another EU institution, body, agency or office would be implicated in the operation of the new system, the legal act should ideally define its responsibilities as a (joint) controller or a processor.

- conducting an impact assessment on data protection when preparing the implementing acts.

Further detailed recommendations are provided by the EDPS in this Opinion.

The EDPS remains at the disposal of the institutions for further advice during the legislative process and at the implementing phase of the Regulations once adopted.

3 | P a g e

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof, Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) , Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC , in particular Articles 42(1), 57(1)(g) and 58(3)(c) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction and background

1. On 31 May 2018, the Commission adopted two proposals for a Regulation of the European parliament and the Council that would amend:  Council Regulation (EC) No 1206/2001 of 28 May 2001 on cooperation between the courts of the Member States in the taking of evidence in civil or commercial matters (hereinafter the “taking of evidence Regulation”);  Regulation (EC) No 1393/2007 of the European Parliament and of the Council on the service in the Member States of judicial and extrajudicial documents in civil or commercial matters (hereinafter the “service of documents Regulation”).

2. The taking of evidence Regulation, which has applied since 2004, provides for two ways of taking of evidence between Member States: taking of evidence through the requested court and the direct taking of evidence by the requesting court.

3. The service of documents Regulation, which has applied since 2008, provides for different ways of transmitting documents from one Member State to another, for purposes of service in the latter, through transmitting and receiving agencies or through transmission by consular or diplomatic channels. It also sets uniform legal conditions for serving a document by post directly across borders and provides for a direct service through the competent person of the Member State addressed where permitted under the law of that Member State. It includes certain minimum standards on the protection of the rights of defence. The application of the Regulation “is not restricted to proceedings before civil tribunals, because its scope covers also ‘extrajudicial’ documents, the service of which may arise in various out-of-court proceedings (e.g. in succession cases before a public notary, or in family law cases before a public authority), or even in the absence of any underlying judicial proceedings” . 5 | P a g e

4. The proposals are included in the Commission’s 2018 work programme under REFIT initiatives in the area of justice and fundamental rights based on mutual trust . The proposals are accompanied by an impact assessment .

5. Both proposals provide for the transmission of documents, requests and communications through a mandatory decentralised IT system composed of national IT systems interconnected by a communication infrastructure enabling the secure and reliable crossborder exchange of information between the national IT systems. They also provide for the application of Regulation (EU) No 910/2014 on electronic identification and trust services for electronic transactions in the internal market .

6. On 13 February 2019, the European Parliament adopted its legislative resolutions on both proposals at first reading , inter alia agreeing on the establishment of a decentralised IT system, providing that such system be based on e-CODEX and that the implementation of such system be ensured via delegated acts.

7. On 6 June 2019, a policy debate took place in Council. The presidency concluded that “the Council confirmed the need to modernise our processes when it comes to judicial cooperation in civil and commercial matters. The presidency noted the preference expressed for a decentralised and secured IT system. It added that ministers could accept mandatory use of the system only with certain conditions, including a longer transition period and with a backend reference system to be provided by the Commission. A list of necessary exceptions will also have to be considered. Finally, the presidency noted that e- CODEX could be the software solution to be used for that purpose. Further work will have to be conducted at technical level” .

8. On 23 April 2019, the Commission has submitted a request for consultation to the European Data Protection Supervisor (hereinafter the “EDPS”) in order to assess the conformity of both proposals with the General Data Protection Regulation (hereinafter the “GDPR”). The EDPS welcomes the consultation by the Commission.

2. Recommendations

2.1. Legal basis

9. The EDPS acknowledges that exchanges of personal data are indispensable for the creation of an area of Freedom, Security and Justice. Therefore he welcomes the overall objectives of the proposals to improve the efficiency of judicial cooperation in civil or commercial matters in relation to the taking of evidence and the service of documents, in particular through digitalisation and the use of IT technology. He shares the view that such legislation may have a real impact on the everyday lives of EU citizens.

10. The EDPS recalls that any establishment of a new IT system processing personal data as well as its essential elements require a legal basis . He stresses in particular that where such IT system entails the involvement of an EU institution, body, agency or office, this legal basis should in principle be provided in an EU legislative act.

11. Also, even in case the processing of personal data would take place in the framework of an existing IT system, the EDPS recommends providing for the use of such system in the 6 | P a g e legislative act itself. However, the existing system envisaged to be used should itself be duly established on the basis of a legal act adopted at EU level, which is currently not the case of e-CODEX. Should the EU legislator choose the e-CODEX solution, the lack of a legal instrument at EU level establishing and regulating the system should be remedied without delay. 2.2. Legislative acts

12. The EDPS recommends including in the legislative acts a high level description of the IT system aspects to be further defined in implementing acts. These elements, based on an assessment of the risks for the fundamental rights of the individuals, should cover at least data protection responsibilities (i.e. the roles of controller, joint controller, processor, as appropriate) as well as relevant applicable safeguards, including those to ensure the security of the personal data processed. Respect for data protection is not only a legal obligation but also a key element for success of the envisaged system, e.g. ensuring quality of data exchanges. 2.2.1. Principles of data protection by design and by default

13. The explanatory memorandum of both proposals underlines that “[i]mportant external factors with regard to the protection of personal data in the context of the proposed policy package are: – the General Data Protection Regulation (GDPR), applied as of May 2018, which should increase awareness and prompt action to ensure the security and integrity of databases, and swift reactions to breaches of privacy in the judiciary; (...)” . As the GDPR is applicable to the processing of personal data for the purposes of judicial cooperation in civil or commercial matters under both Regulations, the EDPS recommends applying its principles already at the stage of setting up the IT system, in particular the principles of data protection by design and by default set out in Article 25 of the GDPR.

14. In this regard, the EDPS welcomes the identification of a high-level architecture of the system in the legislative acts themselves and the obligation of a reliable exchange of information as well as the need to use trust services as defined in Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC . He recalls that the choice of the IT system architecture minimising the impact on data protection should be made based on an assessment of the risks for the individuals whose data are processed, rather than on what architecture minimises possible responsibilities of the Member States or EU institutions. Unless there is a specific need for centrally based functionalities, a decentralised architecture might indeed, in general, avoid single points of failure and support the data minimisation principle.

15. The explanatory memorandum of both proposals underlines that the other important external factor to take into account is the “persistent threats to cybersecurity in the public sector. Attempted attacks on public IT infrastructure are expected to proliferate and to affect the judiciary in the Member States; their impact may be exacerbated by the growing interconnectedness of IT systems (nationally and at EU level)” . It is utterly important that the data processed in this IT system are protected against any possible attackers and security incidents. In particular, with regard to the taking of evidence proposal, the EDPS recommends being more specific on the required appropriate safeguards to ensure 7 | P a g e the security of the videoconference . These safeguards should be further detailed in the implementing act (see section 2.3. below). 2.2.2. Definition of responsibilities

16. The EDPS underlines that the choice of a decentralised architecture automatically entails that the Member States are responsible for the civil or commercial records databases and the processing of personal data within these databases. More specifically, the authorities of the Member States are the controllers of the record databases that they are responsible for. As such, they are responsible for the content of the databases and for the integrity of the information that is exchanged. It is essential to ensure that responsibilities with regard to compliance with data protection rules are clearly defined and allocated.

17. Whereas the proposals aim at establishing a high level architecture for the planned IT system, it does not define governance and high level roles and responsibilities of the Member States and of the Commission (if any). These roles and responsibilities are however essential for assigning the controller role and relevant obligations under the applicable data protection law. To the extent the Commission or another EU institution, body, agency or office would be implicated in the operation of the new system, the legal act should ideally define its responsibilities as a (joint) controller or a processor. The EDPS therefore strongly recommends defining governance and high level roles and responsibilities of the Member States and of the Commission or any other EU institution, body, agency or office (if any) in the legislative act. In case there would be a role for the Commission or any other EU institution, body, agency or office in the processing of these data, Regulation No 2018/1725 would be applicable to such processing.

18. In case of joint controllership, obligations of Article 26 of the GDPR or Article 28 of Regulation No 2018/1725 would apply and the relationship among joint controllers and the content of the mandatory arrangements among them should be defined in the implementing acts. 2.3. Implementing acts

19. The EDPS notes that only the service of documents proposal foresees the adoption of an implementing act for the establishment of the decentralised IT system . He therefore recommends providing for such implementing act in both proposals.

20. Such implementing acts should lay down important elements of the system in more detail. They should also help ensure compliance with data protection requirements by further specifying necessary safeguards to be implemented in the IT system. Consequently, the EDPS recommends providing in the legislative acts for the implementing act to cover also the new provisions on electronic service and on direct taking of evidence by videoconference .

21. As the impact assessments accompanying the proposals do not contain any in depth analysis of the impact of these proposals on data protection, the EDPS strongly recommends the Commission to conduct an impact assessment when preparing the implementing acts. This is without prejudice to obligations of controllers under the GDPR and, as the case may be, Regulation No 2018/1725, to in particular conduct a Data Protection Impact Assessment 8 | P a g e as provided for under Article 35 of the GDPR or Article 39 of Regulation No 2018/1725, should the conditions be fulfilled .

22. Furthermore, from the explanatory memorandum of both proposals , the EDPS understands that the future IT system might be the same for both of them and that its access would be limited to specific users: for the taking of evidence proposal, the number of users would be limited to the courts , central authorities and competent authorities within the meaning of the Regulation, as communicated by the Member States while for the service of documents proposal, the number of users would be limited to transmitting and receiving agencies and central bodies designated by the Member States. The EDPS recommends that safeguards ensuring an access to a limited number of authorised users be specified in the implementing acts.

23. Finally, the proposals would introduce a new Article 23a to the service of documents Regulation and a new Article 22a to the taking of evidence Regulation according to which Member States shall provide the Commission with the data and other evidence necessary for the monitoring programme that the Commission shall establish by two years after the date of application of the Regulations. The EDPS understands that these monitoring programmes would entail the collection of statistical data and recommends that the statistical elements to be collected be defined in further detail as far as possible in the implementing acts.

3. Conclusions

24. The EDPS welcomes the overall objectives of the proposals to improve the efficiency of judicial cooperation, in particular through digitalisation and the use of IT technology, in relation to the taking of evidence and the service of documents in civil or commercial matters. Therefore, this Opinion aims at providing constructive and objective advice to the EU institutions.

25. The EDPS welcomes the identification of a high-level architecture of the system in the legislative act itself and the obligation of a reliable exchange of information as well as the need to use trust services as defined in Regulation (EU) No 910/2014.

26. There are three major recommendations the EDPS makes to ensure compliance with the Charter and the GDPR:  providing a clear legal basis for the IT system which would be used for the transmission of documents, requests and communications for the purposes of these Regulations. In particular, in case the IT system would entail the involvement of an EU institution, body, agency or office, this legal basis should in principle be provided in an EU legislative act. Also, even in case the processing of personal data would take place in the framework of an existing IT system, the EDPS recommends providing for the use of such system in the legislative act itself. However, the existing system envisaged to be used should itself be duly established on the basis of a legal act adopted at EU level, which is currently not the case of e-CODEX. Should the EU legislator choose the e- CODEX solution, the lack of a legal instrument at EU level establishing and regulating the system should be remedied without delay. 9 | P a g e  including in the legislative acts themselves a high level description of the IT system aspects, such as data protection responsibilities or relevant applicable safeguards, to be further defined in implementing acts. In particular, to the extent the Commission or another EU institution, body, agency or office would be implicated in the operation of the system, the legal act should ideally define its responsibilities as a (joint) controller or a processor.  conducting an impact assessment on data protection when preparing the implementing acts.

27. The EDPS also recommends:  providing in both legislative acts for an implementing act to further detail the IT system and that the implementing acts cover the new provisions on electronic service and on direct taking of evidence by videoconference so as to include specific safeguards also on these processing operations.  in case of joint controllership, defining in the implementing acts the relationship among joint controllers and the content of the mandatory arrangements among them.  specifying in the implementing acts safeguards ensuring an access to a limited number of authorised users.  defining in further detail as far as possible the statistical elements to be collected in the implementing acts.

28. Finally, the EDPS remains at the disposal of the Commission, the Council and the European Parliament to provide advice at further stages of this process. The recommendations made in this Opinion are without prejudice to any additional comments that the EDPS could make as further issues may arise. He recalls that, in accordance with Article 42(1) of Regulation No 2018/1725, the Commission has the obligation to consult the EDPS when preparing implementing or delegated acts having an impact on the protection of individual’s rights and freedoms with regard to the processing of personal data. The EDPS expects therefore to be consulted later on the provisions of the draft implementing or delegated acts in this respect. Brussels, 13 September 2019 Wojciech Rafał WIEWIÓROWSKI 10 | P a g e

Notes

11 | P a g e

12 | P a g e