EDPS Opinion 5/2024 on the Proposal for a Regulation on passengers rights in the context of multimodal journeys

24 January 2024

Opinion 5/2024

on the Proposal for a Regulation on passengers rights in the context of multimodal journeys

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’. This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on passengers rights in the context of multimodal journeys . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 29 November 2023, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on passenger rights in the context of multimodal journeys (‘the Proposal’).

The aim of the Proposal is to ensure that passengers enjoy a similar level of protection when switching between different modes of transport. Specifically, the Proposal aims to ensure: nondiscrimination between passengers with regard to transport conditions and the provision of tickets; minimum and accurate information to be provided to passengers in an accessible format and in a timely manner; passengers’ rights in the context of a missed connection between different transport modes; non-discrimination against, and assistance for, persons with disabilities and persons with reduced mobility; the definition and monitoring of service quality standards; the handling of complaints.

The EDPS welcomes the attention paid to the data protection aspects of the Proposal, notably having regard to the transmission of the contact details of the passenger to the carrier in case the passenger booked the ticket via an intermediary. To be consistent with the provisions of the Proposal for a Regulation amending Regulations (EC) No 261/2004, (EC) No 1107/2006, (EU) No 1177/2010, (EU) No 181/2011 and (EU) 2021/782, the EDPS recommends specifying that the carrier’s report on service quality standards should not contain personal data.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 29 November 2023, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on passenger rights in the context of multimodal journeys (‘the Proposal’). The Proposal is accompanied by an annex providing the list of urban nodes (Annex I) and by an annex on minimum service quality standards (Annex II).

2. The objective of the Proposal is to provide for passenger rights having regard to multimodal journeys and to ensure: (1) non-discrimination between passengers with regard to transport conditions and the provision of tickets; (2) minimum and accurate information to be provided to passengers in an accessible format and in a timely manner to passengers; (3) passenger rights in the event of disruption, in particular in the context of a missed connection between different transport modes; (4) non-discrimination against, and assistance for, persons with disabilities and persons with reduced mobility; (5) the definition and monitoring of service quality standards; (6) the handling of complaints; (7) general rules on enforcement .

3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 29 November 2023, pursuant to Article 42(1) of EUDPR. The EDPS positively notes that he was already previously informally consulted pursuant to Recital 60 of EUDPR.

2. General remarks

4. The EDPS recognises the importance of ensuring that passengers enjoy a level of protection where they switch between transport modes during a journey that is similar to the standards of protection for passengers when they travel by air, rail, sea and inland waterways, and bus and coach. The EDPS also notes that the proposal is consistent with the proposal amending Regulations (EC) No 261/2004, (EC) No 1107/2006, (EU) No 1177/20, (EU) No 181/2011 and (EU) 2021/782 as regards enforcement of passenger rights in the 4 5 Union . The EDPS adopted his Opinion on that Proposal on 25 January 2024 .

6. The EDPS observes that the Proposal entails the processing of personal data, notably of the passenger’s contact details , or about his or her qualification as ‘person with reduced 7 8 mobility’ , by the carriers. Regulation (EU) 2016/679 (‘the GDPR’) is therefore applicable to the processing of personal data in the context of the Proposal. The EDPS welcomes the reference to the applicability of the GDPR under recital 21 of the Proposal. The EDPS also welcomes, in the same recital, the specification that the obligations to provide information to passengers concerning their (consumer) rights are without prejudice to the obligation of the controller to provide information to the data subject pursuant to the GDPR.

3. Common form for reimbursement and compensation requests

7. The EDPS notes that the Proposal, under Article 11, empowers the Commission to adopt an implementing act establishing a common form for reimbursement and compensation requests.

8. The EDPS recalls the Commission that the EDPS should be consulted on these implementing acts pursuant to Article 42(1) EUDPR where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data. The EDPS also recalls that he has already provided formal comments on the draft Commission Implementing Regulation establishing a common form for rail passengers’ reimbursement and compensation requests for delays, missed connections and cancellations of rail services in accordance with Regulation (EU) 2021/782 .

4. Transmission of passenger contact details by intermediaries

9. The EDPS notes that the Proposal contains provisions on the transmission of contact details of the passenger and of the booking details by the intermediary to the carrier . In this regard, the EDPS welcomes that the Proposal describes the purposes of the processing in a clear and explicit manner . In particular, the EDPS positively notes that Article 5(8) specifies that the contact details of the passenger can only be used by the carrier to the extent necessary to comply with its obligations to provide information, provision of care, reimbursement, re-routing and compensation, and to fulfil its obligations under applicable Union law on safety and security.

10. In accordance with the principle of storage limitation, personal data may not be retained in a form which permits identification for longer than is necessary . The EDPS therefore welcomes the specification that the carrier must delete the contact details within 72 hours after the completion of the contract of carriage, unless further retention of the contact details is justified to fulfil its obligations in respect of the passenger’s right to re-routing, reimbursement or compensation.

5. Information to be transmitted by carriers to the national enforcement bodies

11. The EDPS notes that Article 17 of the Proposal would require carriers offering single multimodal contracts to establish service quality standards (covering the items listed in Annex II), to monitor their performance, and to publish a report on service quality performance on the carrier’s website.

12. The EDPS notes that the Proposal for a Regulation amending Regulations (EC) No 261/2004, (EC) No 1107/2006, (EU) No 1177/2010, (EU) No 181/2011 and (EU) 2021/782 as regards enforcement of passenger rights in the Union, issued together with the Proposal, specifies that “this report [the report on service quality performance] shall not contain personal data”. The EDPS considers that the report on service quality standards, to fulfil its function, can be limited to statistical data (e.g. on the number of complaints, types of complaints, etc.). Therefore, the EDPS recommends specifying in Article 17 of the Proposal that the report on service quality standards should not contain personal data. 6

6. Conclusions

13. In light of the above, the EDPS recommends to specify in Article 17 of the Proposal that the report on service quality standards should not contain personal data. Brussels, 24 January 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7