EDPS Opinion on the Proposal for a Directive of the European Parliament and of the Council harmonising certain aspects of insolvency law

6 February 2023

Opinion 5/2023

on the Proposal for a Directive harmonising certain aspects of insolvency law

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’. Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’. This Opinion relates to the Proposal for a Directive of the European Parliament and of the Council harmonising certain aspects of insolvency law (COM(2022) 702 final). This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 7 December 2022 the European Commission issued a Proposal for a Directive of the European Parliament and of the Council harmonising certain aspects of insolvency law. The objective of the Proposal is to lay down rules enhancing the convergence in selected aspects of the laws of the Member States concerning business non-bank insolvency procedures.

The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 13 December 2022, pursuant to Article 42(1) of EUDPR. It focuses on the provisions which may have an impact on the fundamental right to data protection.

The EDPS welcomes the safeguards provided for the access by designated courts of the Member States to information contained in national centralised bank account registries.

However, he makes the following recommendations:

First, concerning the access by insolvency practitioners to national asset registers, the EDPS recommends specifying the purpose of such access not only in the preamble but also in the enacting terms of the future directive.

Second, the EDPS recommends introducing at EU level the necessary safeguards for the new access by insolvency practitioners, established by the Proposal, to personal data contained in beneficial ownership registers and national asset registers.

In addition, concerning the interconnection of the auction platforms, the EDPS recommends clarifying that the legal basis for such interconnection would be the future Directive and not Commission implementing acts.

The EDPS further recommends ensuring that the Commission implementing acts, to be adopted for setting up this interconnection, are in place when the future Directive and the Member States laws transposing it are applicable.

Finally, concerning the electronic communications, the EDPS recommends clarifying, as the case may be, whether the future Regulation on the digitalisation of judicial cooperation and access to justice in cross-border civil, commercial and criminal matters would be relied upon for the electronic communications provided for in the Proposal.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 7 December 2022 the European Commission issued a Proposal for a Directive of the European Parliament and of the Council harmonising certain aspects of insolvency law (‘the Proposal’) .

2. The objective of the Proposal is to lay down rules enhancing the convergence in selected aspects of the laws of the Member States concerning business non-bank insolvency procedures . According to the impact assessment report, consultations with stakeholders revealed difficulties related to asset tracing , especially where the asset is situated in another Member State than the one where the proceedings have been opened. The effectiveness of asset tracing is of key importance in the maximisation of the value of the insolvency estate as debtors have an incentive to remove assets from the insolvency estate. The means available for insolvency practitioners to trace and freeze assets belonging to the estate in another Member State are insufficient or inadequate which often results in the dissipation of those assets by the time action is taken. Essential information for the purpose of asset tracing are included in national registers, but these registers are either not accessible and/or not comprehensible by the insolvency practitioners (due to language barriers). In addition, each Member State has its own rules and entrusts the insolvency practitioners with different powers in respect of asset tracing. Missing or cumbersome possibilities of asset tracing impair the capacity of courts, insolvency practitioners or other parties with a legitimate interests to determine and locate the assets, examine the revenue generated by often fraudulent activity, and follow its trail .

3. Title III of the Proposal on tracing assets belonging to the insolvency estate provides for: • the access by specifically designated competent national courts to the national centralised bank account registry established pursuant to Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (‘Anti-Money Laundering Directive’) , and in particular to the bank account information listed in Article 32a(3) thereof . The access would be granted upon request of the insolvency practitioner appointed in on-going insolvency proceedings, where necessary for the purposes of identifying and tracing assets belonging to the insolvency estate of the debtor in that proceedings, including those subject to avoidance actions. The future Directive would impose on the Member States an obligation to ensure that such designated courts have the power to access information available in another Member State, through the bank account registers single access point that would be put in place by the new Anti-Money Laundering Directive when adopted (Articles 13 to 16); • indirect access by insolvency practitioners to this information by requesting the designated courts in the Member State to access and run searches (recital 16); • direct access by insolvency practitioners to beneficial ownership information (Article 17); • direct access by insolvency practitioners to national asset registers, where available (Article 18).

4. In addition, the Proposal (Article 40) would require Member States to ensure that in simplified winding-up proceedings for insolvent micro-enterprises, all communications between the competent authority, and, where relevant, the insolvency practitioner, on the one hand, and the parties to such proceedings, on the other hand, can be performed by electronic means, in accordance with Article 28 of Directive (EU) 2019/1023 of the European Parliament and of the Council of 20 June 2019 on preventive restructuring frameworks, on discharge of debt and disqualifications, and on measures to increase the efficiency of procedures concerning restructuring, insolvency and discharge of debt and amending Directive (EU) 2017/1132 (Directive on restructuring and insolvency) .

5. Finally, the Proposal would provide for the establishment and maintenance by Member States of one or several electronic auction platforms for the sale of assets of the insolvency estate in simplified winding-up proceedings (Article 50) and for their interconnection to be set up by the Commission by means of implementing acts (Article 51).

6. This initiative, announced in September 2020, is part of the Commission’s priority to advance the Capital Markets Union , a key project to further financial and economic integration in the European Union .

7. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 13 December 2022, pursuant to Article 42(1) EUDPR. The EDPS welcomes the reference to this consultation in recital 63 of the Proposal. In this regard, the EDPS also positively notes that he was previously informally consulted pursuant to recital 60 EUDPR.

2. General remarks

8. The EDPS welcomes recitals 18, 61 and 62 which specify that any personal data obtained under the proposed Directive should only be processed in accordance with the applicable data protection rules by designated courts and insolvency practitioners where it is necessary and proportionate for the purposes of identifying and tracing assets belonging to the insolvency estate of the debtor in on-going insolvency proceedings, that the Proposal respects fundamental rights and in particular data protection and privacy, and that Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the ‛GDPR’) applies to the processing of personal data for the purposes of the proposed Directive.

9. The EDPS notes that the Commission proposes to expand access, by designated courts and insolvency practitioners , to central national bank account registries or electronic data retrieval systems established under Directive (EU) 2015/849, through the bank account registers single access point that would be put in place by the new Anti-Money Laundering Directive when adopted, and to beneficial ownership registers established under Directive (EU) 2015/849, where necessary and proportionate for the purposes of identifying and tracing assets belonging to the insolvency estate of the debtor in ongoing insolvency proceedings .

10. Pursuant to the purpose limitation principle set out in Article 5(1)(b) GDPR, personal data must not be further processed in a manner that is incompatible with the purposes for which it was collected. The EDPS notes that the specific purposes for which data would be processed under the Proposal would be different from the purposes of preventing, detecting and effectively combating money laundering and terrorist financing for which these registers where established under Directive (EU) 2015/849 and possibly from the purposes of all or some of the national asset registers established under national law. He notes however that the purpose of the access established under the Proposal would be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controllers in accordance with Article 6(1)(e). It would hence be compatible with the purpose for which the registers were established, in accordance with Article 6(4) GDPR, given that, together with the safeguards (see below) provided by the Proposal, the Proposal would constitute a necessary and proportionate measure in a democratic society to safeguard an important objective of general public interest of the Union referred to in Article 23(1)(e) GDPR (see however below for the access to beneficial ownership registers and national asset registers).

11. The EDPS welcomes the safeguards set out in Articles 13 to 16, which would apply to the access and search by the designated courts of bank account information. Indeed, under these provisions, only courts designated among the courts that are competent to hear cases related to procedures in restructuring, insolvency or discharge of debt would have the power to access directly bank account information. In addition, such power is provided only where necessary for the purposes of identifying and tracing assets belonging to the insolvency estate of the debtor in an ongoing proceedings and upon request by the insolvency practitioner appointed in these proceedings.

12. Also the personal data accessed under these provisions are limited to those exhaustively 18 19 listed in Article 32a(3) of Directive (EU) 2015/849 as the Proposal specifically excludes for access the additional information that Member States may include in the registries pursuant to Article 32a(4) of Directive (EU) 2015/849.

13. The Proposal furthermore sets out the conditions for such access and its monitoring i.e. that it shall be performed on a case-by-case basis, by the staff specifically appointed and authorised within the designated courts. It sets out an obligation for Member States to ensure high professional standards of the staff (confidentiality, integrity, and appropriate skills) and high standard technical and organisational security measures.

14. The Proposal finally establishes an obligation on Member States to ensure that logs are kept for each time a designated court accesses and searches the information and specifies what these logs must include, in particular the name of the designated court and the unique identifier of the staff member who made the query. The logs must be checked by the authorities operating the centralised bank account registries. The monitoring must include verifying the admissibility of a request and the lawfulness of personal data processing and whether the integrity and confidentiality of personal data is ensured. The logs must be protected by appropriate measures and be erased five years after their creation, unless they are required for monitoring procedures that are ongoing.

15. These safeguards are particularly important given the sensitivity of the information concerned to ensure the implementation of the principles of purpose limitation, data minimisation and integrity and confidentiality set out in Article 5 GDPR.

16. The EDPS also positively notes that Article 17(2) on the access by insolvency practitioners to beneficial ownership information exhaustively lists the information that may be accessed to and clearly limits such access to cases where it is necessary for identifying and tracing assets belonging to the insolvency estate of the debtor in ongoing insolvency proceedings .

17. Similarly to the other accesses provided for under the Proposal, the EDPS recommends clarifying in the enacting terms (Article 18), not only in a recital (recital 18), that access by insolvency practitioners to national asset registers is allowed only where necessary for the purposes of identifying and tracing assets belonging to the insolvency estate of the debtor in an on-going insolvency proceeding.

18. The EDPS would like to finally underline that the Proposal would introduce a limitation on the right to data protection by extending access to personal data contained in the beneficial ownership registers and national asset registers for a different purpose (see above). It is therefore of utmost importance that the relevant safeguards are provided for also at EU level. In this regard, he notes that the safeguards are provided for in much more detail for the access to bank account registries, and recommends the co-legislators to consider the additional safeguards to introduce at EU level as regard access to beneficial ownership registers and national asset registers so as to ensure a necessary and proportionate measure.

3. Interconnection of electronic auction systems

19. The EDPS notes that under Article 51 of the Proposal the Commission must establish a system for the interconnection of the national electronic auction systems set up in the Proposal by means of implementing acts. While welcoming Article 53 clarifying the role of the Commission as a controller, the EDPS recommends clarifying, that the Proposal would establish a legal basis for the interconnection of the national electronic auction systems, e.g. by stating in the enacting terms that the national electronic auction systems must be interconnected (in addition to providing for the concrete setting up of this interconnection system by implementing acts).

20. The EDPS also draws attention to the fact that, as it stands, Article 51 does not ensure that such implementing acts would be in place at the time when the national laws of Member States transposing the proposed Directive would apply. Indeed this provision sets an obligation to adopt the implementing act within one year after the transposition deadline of the proposed Directive defined in Article 71. Since the implementing acts would specify, among others, the applicable data protection safeguards (Article 51(2)(j)), the EDPS recommends modifying this provision so as to ensure that the implementing acts setting up the interconnection of the national electronic auction systems are adopted at the time national laws transposing the directive apply.

4. Electronic communications

21. Finally, the Proposal provides for the use of electronic communications, including crossborder (Article 40). The EDPS would like to draw attention to the Proposal, currently under negotiation, for a Regulation of the European Parliament and of the Council on the digitalisation of judicial cooperation and access to justice in cross-border civil, commercial and criminal matters, and amending certain acts in the field of judicial cooperation . Pursuant to its Article 1, that Proposed Regulation aims at establishing a legal framework for electronic communication between competent authorities in judicial cooperation procedures in civil, commercial and criminal matters and for electronic communication between natural or legal persons and competent authorities in judicial procedures in civil and commercial and criminal matters and it would be applicable to insolvency proceedings falling within the scope of Regulation (EU) 2015/848 of the European Parliament and of the Council of 20 May 2015 on insolvency proceedings (recast) (see Annex 1) . The EDPS recommends clarifying, as the case may be, whether this proposed Regulation would apply in the context of the electronic communications provided for under the Proposal.

5. Conclusions

22. In light of the above, the EDPS makes the following recommendations: (1) to clarify in the enacting terms of the future Directive that access by insolvency practitioners to national asset registers is allowed only where necessary for the purposes of identifying and tracing assets belonging to the insolvency estate of the debtor in an on-going insolvency proceeding; (2) to introduce at EU level the necessary safeguards for the new access by insolvency practitioners, established by the Proposal, to personal data contained in beneficial ownership registers and national asset registers; (3) to clarify that the future Directive would establish the interconnection of the national electronic auction systems; (4) to ensure that the implementing acts to be adopted by the Commission for the setting up of the interconnection of the electronic auction systems would be in place at the time national laws transposing the directive apply so that the data protection safeguards to be specified through these implementing acts are also in place; (5) to clarify, as the case may be, whether the future Regulation on the digitalisation of judicial cooperation and access to justice in cross-border civil, commercial and criminal matters would be relied upon for the electronic communications provided for in the Proposal. Brussels, 6 February 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 10