Digital tools and processed in company law

Opinion 6/2018

EDPS Opinion on the proposal amending Directive 2017/1132 as regards the use of digital tools and processes in company law

26 July 2018 1 | P a g e

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 41(2) of Regulation 45/2001 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to privacy, are respected by the Community institutions and bodies’, and ‘…for advising Community institutions and bodies and data subjects on all matters concerning the processing of personal data’. Under Article 28(2) of Regulation 45/2001, the Commission is required, ‘when adopting a legislative Proposal relating to the protection of individuals’ rights and freedoms with regard to the processing of personal data...’, to consult the EDPS.

He was appointed in December 2014 together with the Assistant Supervisor with the specific remit of being constructive and proactive. The EDPS published in March 2015 a five-year strategy setting out how he intends to implement this remit, and to be accountable for doing so.

This Opinion responses to a formal consultation by the European Commission and the European Parliament pursuant to Article 28(2) of Regulation 45/2001 and provides comments and recommendations on how to better safeguard the right to privacy and the protection of personal data in the proposed Directive amending Directive 2017/1132 as regards the use of digital tools and processes in company law (COM(2018)239 final-2018/0113 (COD)).

2 | P a g e

Executive Summary

The Opinion is issued in response to a consultation by the European Commission, as well as upon a specific request of the European Parliament.

The Proposal for a Directive amending Directive 2017/1132 as regards the use of digital tools and processes in company law aims at complementing the current EU framework by

addressing the lack of rules for online company registration, filing and publication of the registered information on companies and branches in electronic form or the divergence

of such rules in the Member States. Moreover, it aims at ensuring that Member States enable companies to benefit from the use of electronic identification and at providing for an

additional exchange of data between the national business registers concerning the

disqualification of directors. It also ensures a free of charge access of a list of documents and information in all Member States and introduces the once-only principle in the area of company law so that companies should not have to provide the same information twice to different authorities. Finally, it introduces the possibility for the Commission to establish an optional access point for EU institutions to the platform.

The EDPS welcomes the Proposal and shares the Commission’s views that the use of digital tools may provide for more equal opportunities for companies while recalling the need to take into account the fact that increased access to personal data must be accompanied with effective measures to prevent unlawful or unfair processing of these data. That is why the Opinion focuses on specific recommendations with two objectives: to guarantee legal certainty and to raise awareness as to risks resulting from the accessibility of personal data that would be made widely available on the internet in digital form in multiple languages via an easily accessible European platform/access point.

The EDPS recommends to take the opportunity of the revision of the Business Registers Interconnection System provisions to carefully consider the recommendations provided in his Opinion on the Proposal for a Directive of the European Parliament and of the Council amending Directives 89/666/EEC, 2005/56/EC and 2009/101/EC as regards the interconnection of central, commercial and companies registers. Moreover he recommends to take into account the specific recommendations which were given in the Opinion on the proposal for a Regulation establishing a Single Digital Gateway and the ‘once-only’ principle, in order to ensure legal certainty in the personal data processing.

The EDPS further suggests adding a reference to the new Regulation that will soon replace Regulation 45/2001. He also recommends to make sure that the Proposal specifies the framework for data-flows and administrative cooperation procedures using the electronic network, in order to ensure that data is processed through a solid legal basis and that adequate data protection safeguards are provided for, in particular in relation to the personal data concerning the disqualification of directors.

Finally, the EDPS recommends to add a reference to the Decision of the European

Commission, of 5 June 2014, on the protection of personal data in the European e-Justice

Portal, which states the tasks and responsibilities of the Commission in the data processing in the context of the E-justice portal. Moreover he calls for a clarification of the respective

division of tasks and responsibilities of each party involved in the data processing in the

context of controllership and joint controllership.

3 | P a g e

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof, Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) , Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular Articles 28(2), 41(2) and 46(d) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. INTRODUCTION AND BACKGROUND

1. On 25 April 2018, the European Commission (‛Commission’) adopted the proposal for a Directive of the European Parliament (‛Parliament’) and of the Council amending Directive (EU) 2017/1132 as regards the use of digital tools and processes in company law (‘Proposal’), together with the proposal for a Directive of the European Parliament and of the Council amending Directive (EU) 2017/1132 as regards cross-border conversions, mergers and divisions . As the latter provides for harmonised rules in the area of crossborder conversions, mergers and divisions of companies, the Opinion focuses on the Proposal.

2. This Opinion is in response to a consultation by the Commission and a separate request from the Parliament to the European Data Protection Supervisor (‛EDPS’), as an independent supervisory authority, to provide an Opinion on the Proposal. The EDPS is grateful to have been consulted as required by Article 28(2) of Regulation 45/2001 and that a reference to the Opinion is included in the preamble of the Proposal. 1.1. Objectives of the Proposal

3. The Proposal is based on Article 50(1) and points (b), (c), (f) and (g) of Article 50(2) of the Treaty on the functioning of the European Union. It aims at:  complementing the current EU framework by addressing the lack of rules for online company registration, filing and publication of the registered information on companies and branches in electronic form or the divergence of such rules in the 5 | P a g e Member States, which, according to the Commission, create unncessary costs and burdens to entrepreneurs ;  ensuring that Member States would enable companies to benefit from the use of electronic identification and trust services through the eIDAS Regulation ;  providing for an additional exchange of data between the national business registers concerning the disqualification of directors;  expanding the access to disclosed documents and information on companies, to companies other than the limited liability companies listed in Annex II to the Directive 2017/1132 ;  ensuring the free of charge access of a list of documents and information in all Member States;  introducing the once-only principle in the area of company law so that companies should not have to provide the same information twice to different authorities;  introducing the possibility for the Commission to establish an optional access point for EU institutions to the platform. 1.2. Context of the proposal

4. Directive 2017/1132, which is to be amended by the Proposal, has codified several Directives in the field of company law , including Directive 2012/17/UE of the European Parliament and of the Council of 13 June 2012 amending Council Directive 89/666/EEC and Directives 2005/56/EC and 2009/101/EC of the European Parliament and of the Council as regards the interconnection of central, commercial and companies registers . Directive 2012/17 has established the Business Registers Interconnection System (‛BRIS’), which has been further detailed under the Commission Implementing Regulation (EU) 2015/884 of 8 June 2015 establishing technical specifications and procedures required for the system . The BRIS has been in place since 8 June 2017. According to the Commission’s website, 31 countries participate (the EU Member States plus European Economic Area countries). The BRIS connects the national business registers to a ‛European Central Platform’ and provides for a single point of access via the European e-Justice Portal, through which citizens, businesses and public administrations can search for information on companies and their branches opened in other Member States. CEF eDelivery (one of the building blocks of the European Commission’s Connecting Europe Facility) allows Member State business register systems to exchange messages securely via the CEF eDelivery. Users of BRIS can also benefit from the login system as the E-justice Portal uses CEF-eDelivery.

5. Nonetheless, according to the impact assessment accompanying the Proposal, the EU still offers a very inconsistent landscape when it comes to the availability of online tools for companies in their contact with public authorities in the area of company law. Member States provide for e-government services at variable degrees. Currently, EU company law includes certain elements of digitalisation such as the obligation for Member States to make available online information about limited liability companies. However these requirements 6 | P a g e are limited and lack precision, leading to a very diverse implementation at national level. In addition, certain digital processes are not covered at all by EU law and today only 17 Member States provide for a procedure ensuring the fully online registration of companies. The situation is similar for the online registration of branches . 1.3. Synergies with other initiatives

6. In the explanatory memorandum of the Proposal, it is noted that the provision of more specific, substantial rules on the procedures for establishing and registering limited liability companies and branches would complement the Commission’s proposal for a Regulation on the establishment of a Single Digital Gateway , which covers the general registration of business activity via onlines means except for the constitution of limited liability company. The introduction of the ‘once-only principle’ in the area of company law, according to which companies should not have to provide the same information twice to different authorities, is also in line with the e-Government Action Plan 2016-2020, supporting EU wide efforts to reduce the administrative burdens on citizens and businesses .

2 COMMENTS AND RECOMMENDATIONS

7. The EDPS shares the Commission’s views that the use of digital tools may help providing more equal opportunities for companies. Therefore we support the objectives of the Proposal. Our comments are to be evaluated in light of this constructive approach. 2.1. Accessibility of personal data

8. First, the EDPS recalls that personal data is defined under the GDPR as any information relating to an identified or identifiable natural person (‘data subject’). Thus the GDPR does not cover the processing of data concerning legal persons and in particular undertakings established as legal persons (including the name and the form of the legal person and he contact details of the legal person) . However, we would like to underline that “the fact that information [is] provided as part of a professional activity does not mean that it cannot be characterised as a set of personal data” and that “[...] legal persons can claim the protection of Articles 7 and 8 of the Charter in relation to such identification only in so far as the official title of the legal person identifies one or more natural persons [emphasis added]. That is the case with the applicant in the main proceedings in Case C-92/09. The official title of the partnership in question directly identifies natural persons who are its partners. [emphasis added]” . In this regard, the EDPS welcomes the assessment made in the impact assessment to the Proposal according to which there will at least be some exchange of personal data, e.g. information about the person founding a company or its director in online registration, filing and also in necessary documents for cross-border operations (mergers, divisions, conversions) and that personal data would be accessible via business registers. 7 | P a g e

9. On the disclosure of personal data contained in the registers, the impact assessment to the Proposal indicates that “[...] the recent jurisprudence of the ECJ makes it clear that the disclosure of the data in registers is essential, since the only safeguards limited liability companies offer to third parties are their assets, which constitutes an increased economic risk for the latter. The Court held that it appears justified that natural persons who choose to participate in trade through such a company are required to disclose the data relating to their identity and functions within that company, especially since they are aware of that requirement when they decide to engage in such activity” . In this regard, the EDPS recalls that in the same judgment, the Court also stated that “[...] it cannot be excluded, however, that there may be specific situations in which the overriding and legitimate reasons relating to the specific case of the person concerned justify exceptionally that access to personal data entered in the register is limited, upon expiry of a sufficiently long period after the dissolution of the company in question, to third parties who can demonstrate a specific interest in their consultation.[emphasis added]” .

10. The EDPS emphasizes that increased access to personal data must be accompanied with effective measures to prevent unlawful or unfair processing of these data. This is especially so for personal data made widely available on the internet in digital form in multiple languages and via an easily accessible European platform/access point. In his Opinion on the Proposal for a Directive of the European Parliament and of the Council amending Directives 89/666/EEC, 2005/56/EC and 2009/101/EC as regards the interconnection of central, commercial and companies registers, the EDPS already underlined the necesssity to carefully assessed what personal information should be made via the Common European platform/access point, and what additional data protection safeguards - including technical measures to restrict search or download capabilities and data mining - should apply . The EDPS notes that the recommendations which we provided in the Opinion have not been fully taken on board. Therefore, we recommend to take the opportunity of the revision of the legal framework related to BRIS to carefully consider the recommendations provided in the EDPS Opinion of 2011. 2.2. Legal certainty

11. In his Opinion 8/2017 on the Single Digital Gateway Proposal and the ‘once-only’ principle, the EDPS drew the attention of the legislators on the questions which the ‘once-only’ principle, depending on the way in which it is defined and implemented, may raise in relation to protection of personal data. These questions concern in particular the legal basis requirement for processing (Article 6 of the General Data Protection Regulation (‛GDPR’)), the purpose limitation principle (Article 5(1)(b) of the GDPR), the data minimisation principle and other principles (Articles 5 and 25 of the GDPR). In that regard and in order to ensure legal certainty, we recommended that, whenever possible: 8 | P a g e  further processing of personal data based on the once-only principle be specified in a legislative instrument, which provide appropriate safeguards to ensure compliance with data protection law, including the principle of purpose limitation and ensuring data subjects’ rights;  the legislative instrument introducing application of the principle of ‘once-only’ should be clear on whether any government data sharing is subject to freely given, specific, informed and unambiguous consent of the individuals concerned or whether the law creates an obligation or a permission for data sharing;  the law clearly specifies the legal basis for processing of personal data (typically in the main body of the legal instrument or in a recital where sufficient and appropriate). The EDPS is of the view that these recommendations should be taken into account when introducing the once-only principle into EU company law. 2.3. Reference to data protection law

12. The EDPS welcomes the references to the data protection law in the Proposal. In particular, we appreciate that these references are set forth not only in the preamble (Recitals 15 and 29 of the Proposal) but also in the main body of the Proposal (Article 1 (17) of the Proposal amending Article 161 of the Directive 2017/1132). However, we note that reference is made only to the GDPR. Therefore, we recommend to add a reference to the new Regulation that will soon replace Regulation 45/2001 . 2.4. Framework for data flows, legal basis and exchange of sensitive data

13. The EDPS would like to recall that it is essential that the Proposal specifies the framework for data-flows and administrative cooperation procedures that may take place using the electronic network . This is particularly important in order to ensure that (i) any data exchange is made on a solid legal basis, and that (ii) adequate data protection safeguards are provided for. Indeed, according to the EDPS, any data exchange or other data processing activity using the electronic network (e.g. public disclosure of personal data via the common platform/access point) should be based on a binding EU act adopted on a solid legal basis. This should be clearly laid down in the proposed Directive. In this respect, if there is a potential need for data processing in an Internal Market area not covered by a specific Union act, the EDPS calls for further reflection on the modalities of a legal framework which would allow, perhaps in combination with general Treaty provisions, specific provisions in the proposed Directive, and further delegated acts, to provide an adequate legal basis from the data protection perspective. It should also be specified in the proposed Directive whether the business registers may use the electronic network and the common access point to exchange or publicly disclose personal data not foreseen in a Union act but permitted or required under national law.

14. In this respect, the EDPS notes that according to the explanatory memorandum of the Proposal , the Proposal establishes rules on disqualified directors as safeguards against 9 | P a g e fraud and abuse, to address concerns highlighted by some stakeholders in the public consultation. These rules are twofold: on the one hand, the Proposal aims at requiring Member States to ensure that their registers are able to provide through BRIS information on disqualified directors. The information, that “shall be provided for the purpose of registration”, includes, in addition of whether of not the person is disqualified, “what period any disqualification is in force”. Member States may also provide the grounds of disqualification . On the other hand, the Proposal aims at allowing a new data exchange between the national business registers, i.e. where the rules laid down by Members States for the online registration of companies provide for procedures to verify the appointment of directors taking into account the disqualification of directors by competent authorities of other Member States, the register where the company is to be registered, may, through BRIS, request the “confirmation from the registers of other Member States as to whether or not the person who is to be appointed as director of the company is currently disqualified from acting as director in those other Member States” .

15. In this regard, the EDPS would like to recall the recommendations made by the Reflection Group on the Future of EU Company Law in its Report in 2011 . While recognising the importance of making disqualifications known throughout the Union to avoid that unacceptable behaviour is continued by use of cross-border mobility, the Group underlined that “substantial problems not just concerning technology, but also and more seriously concerning privacy, data protection and fundamental rights must be solved first.” In particular, the Group pointed out that the decisions about disqualification of company directors or the grounds for such disqualification are not publicly available in all Member States and that where a disqualification is limited in time, the public notice of disqualification must be removed. The Group therefore advised “[...] the Commission to conduct a comparative study to provide an overall system that secures the proper balance between the public’s need for transparency and considerations of personal privacy, data protection and fundamental right” . The EDPS regrets that the Impact Assesment accompagnying the Proposal does not contain any such study and that no explanation is given as to the balance to be ensured in this matter .

16. As previously recalled, any system used for the exchange of personal data between competent national authorities need to have a proper legal basis in EU law, that is to say in the Directive 2017/1132 to be amended. The EDPS is of the view that the mere reference to the GDPR under Recital 15 in relation to the processing of data relating to disqualification of director is therefore not sufficient.

17. Also, the EDPS underlines that the exchange of information about disqualification of directors is likely to involve the exchange of data relating to criminal convictions and offences, considered as sensitive data. In particular, in accordance with Article 10 of the GDPR, it is provided that proceesing personal data relating to criminal convictions and offences shall be carried out only under the control of official authority or when the 10 | P a g e processing is authorised by Union or Member States law providing for appropriate safeguards for the rights and freedoms of data subjects.

18. Regarding the amount of information that will be shared, the EDPS would like to highlight that if the information of whether or not the person is diqualified and the duration of the disqualification “shall be provided for the purpose of registration”, there seems to be no such purpose for sharing the grounds of the disqualification. We would like to recall that not all Member States disclose the grounds of disqualification and that, even if it seems that the Proposal establishes such exchange of data as an option left to Member States - as the wording “may” indicates - the data minimisation principle should nevertheless be taken into account . 2.5. Controllership and joint controllership

19. The EDPS notes that the Proposal does not include amendments so as to refer clearly to the decision of the Commission of 5 June 2014 on the protection of personal data in the European e-Justice Portal and which states the tasks and responsibilities of the Commission in the data processing in the context of the E-justice portal . The EDPS recommends to add a reference to that Decision.

20. Regarding the exchange of information between Member States and assuming that personal data will be processed in this context, the EDPS considers that the Proposal is a good opportunity to amend the Directive 2017/1132 in order to reflect the clear division of tasks and responsibilities of each party involved in the data processing in the context of the BRIS. We acknowledge that it may not be feasible to specifically designate in the Directive every single processing operation and allocate responsibility for each of them to the Commission or to other parties involved in the data processing. However, at least some guidance should be given in the Directive itself.

21. In this context, it is worth mentioning that the Proposal for a Regulation that will replace Regulation 45/2001 (currently in the final stages of the legislative process) defines in Article 3(2)(b) the notion of the controller and in Article 28 clarifies the responsibilities of joint controllers. Where thus two or more entities “jointly determine the purposes and means of processing” they are considered joint controllers. It appears that the concept of “joint controllers” could apply as regards the division of tasks and responsibilities between the Commission and the Member States. This article requires the joint controllers to determine in a transparent manner their respective responsibilities for compliance with their data protection obligations.

22. In this respect, the EDPS recalls that it is essential to answer two questions: who is the “controller” (i.e. decides on the purposes and means of the processing) and who merely processes personal data on behalf of a “controller”, and is thus the processor? The primary reason why the clear and unambiguous identification of the controller is so crucial is that it determines who shall be responsible for compliance with data protection rules. The 11 | P a g e Article 29 Working Party adopted an opinion (Opinion 1/2010) that states: “[...] if it is not sufficiently clear what is required from whom - e.g. no one is responsible or a multitude of possible controllers - there is an obvious risk that too little, if anything, will happen and that the legal provisions will remain ineffective” .

23. Clarity is especially needed in situations where multiple actors are involved in a cooperative relationship. This is often the case with EU information systems used for public purposes where the purpose of processing is defined in EU law.

24. Furthermore, the Article 29 Working Party in the abovementioned Opinion has provided guidance on the notions of controller, joint controllers and processor. Accordingly, the concept of controller not only is an autonomous notion of EU data protection law, but is also functional, in the sense that it is intended to allocate responsibilities on the basis of the factual influence rather than on a basis of a formal analysis. In particular, in the present case, it seems that the Commission contributes to the determination of the purposes and especially of the means of processing of personal data.

25. Therefore, the EDPS recommends that the proposal clarifies the respective division of tasks and responsibilities of each party involved in the data processing. The essence of this division shall also be made available to data subjects (see Article 28(2) of the new Regulation), for instance through an explanation in the data protection notice .

3 CONCLUSION

Therefore, the EDPS recommends:  to take the opportunity of the revision of the Directive 2017/1132 related to BRIS to carefully consider the recommendations provided in his previous Opinion of 2011;  to take into account the specific recommendations which were given in his previous Opinion on the proposal for a Regulation on the establishment of a Single Digital Gateway and the ‘once-only’ principle;  to add a reference to the new Regulation that will soon replace Regulation 45/2001;  to make sure that the Proposal specifies the framework for data-flows and administrative cooperation procedures using the electronic network, in order to ensure that (i) any data exchange or other data processing activity using the electronic network (e.g. public disclosure of personal data via the common platform/access point) is made on a solid legal basis, and that (ii) adequate data protection safeguards are provided for, in particular in relation to the personal data concerning the disqualification of directors.  to add a reference to the Decision of the European Commission, of 5 June 2014, on the protection of personal data in the European e-Justice Portal, which states the tasks and responsibilities of the Commission in the data processing in the context of the E-justice portal;

12 | P a g e

to clarify the respective division of tasks and responsibilities of each party involved in the data processing in the context of controllership and joint controllership. Brussels, 26 July 2018

(signed)

Giovanni Buttarelli

13 | P a g e

Notes

14 | P a g e

15 | P a g e