EDPS Opinion 6/2024 on the Proposal for a Regulation amending Regulations (EC) No 261/2004, (EC) No 1107/2006, (EU) No 1177/2010, (EU) No 181/2011 and (EU) 2021/782 as regards enforcement of passenger rights in the Union

24 January 2024

Opinion 6/2024

on the Proposal for a Regulation amending Regulations (EC) No 261/2004, (EC) No 1107/2006, (EU) No 1177/2010, (EU) No 181/2011 and (EU) 2021/782 as regards enforcement of passenger rights in the Union

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’. Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’. This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council amending Regulations (EC) No 261/2004, (EC) No 1107/2006, (EU) No 1177/2010, (EU) No 181/2011 and (EU) 2021/782 as regards enforcement of passenger rights in the Union . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 29 November 2023, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council amending Regulations (EC) No 261/2004, (EC) No 1107/2006, (EU) No 1177/2010, (EU) No 181/2011 and (EU) 2021/782 as regards enforcement of passenger rights in the Union (‘the Proposal’).

The aim of the Proposal is to enhance the level of protection of passenger rights having regard to travel by air, rail, sea and inland waterways, and bus and coach. More specifically, the Proposal aims to ensure: reimbursement when the ticket was booked via an intermediary; improving information to passengers on their rights at the time of booking and during journey disruptions; service quality standards; common form for reimbursement and compensation requests; risk-based approach to the monitoring of compliance; sharing of information with national enforcement bodies and information about alternative dispute resolution ADR by national enforcement bodies.

The EDPS welcomes the attention paid to the data protection aspects of the Proposal, notably having regard to the transmission of the contact details of the passenger to the carrier in case the passenger booked the ticket via an intermediary, as well as the specification that the carrier’s report on service quality standards should not contain personal data. In the light of the above, the EDPS does not have specific recommendations on the Proposal.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 29 November 2023, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council amending Regulations (EC) No 261/2004 , (EC) No 4 5 6 7 1107/2006 , (EU) No 1177/2010 , (EU) No 181/2011 and (EU) 2021/782 as regards enforcement of passenger rights in the Union (‘the Proposal’). The Proposal is accompanied by four annexes on minimum service quality standards.

2. The objective of the Proposal is to provide, having regard to travel by air, rail, sea and inland waterways, and bus and coach. More specifically, the Proposal aims to ensure reimbursement when the ticket was booked via an intermediary; improving information to passengers on their rights at the time of booking and during journey disruptions; service quality standards; common form for reimbursement and compensation requests; risk-based approach to the monitoring of compliance; sharing of information with national enforcement bodies and information about alternative dispute resolution ADR by national enforcement bodies.

3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 29 November 2023, pursuant to Article 42(1) of EUDPR. The EDPS positively notes that he was already previously informally consulted pursuant to Recital 60 of EUDPR.

2. General remarks

4. The EDPS recognises the importance of enhancing consumer’s rights of passengers travelling by air, rail, sea and inland waterways, and bus and coach. The EDPS also notes that the proposal is consistent with the proposal the Proposal for a Regulation on passenger rights in the context of multimodal journeys . The EDPS adopted his Opinion on that Proposal on 25 January 2024 .

6. The EDPS observes that the Proposal entails the processing of personal data, notably of the passenger’s contact details , or about his or her qualification as ‘person with reduced 12 13 mobility’ , by the carriers. Regulation (EU) 2016/679 (‘the GDPR’) is therefore applicable to the processing of personal data in the context of the Proposal. The EDPS welcomes the reference to the applicability of the GDPR under recital 8 of the Proposal. The EDPS also welcomes, in the same recital, the specification that the obligations to provide information to passengers concerning their (consumer) rights are without prejudice to the obligation of the controller to provide information to the data subject pursuant to the GDPR.

3. Common form for reimbursement and compensation requests

7. The EDPS notes that the Proposal would empower the Commission to adopt an implementing act establishing a common form for reimbursement and compensation requests .

8. The EDPS recalls the Commission that the EDPS should be consulted on these implementing acts pursuant to Article 42(1) EUDPR where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data. The EDPS also recalls that he has already provided formal comments on the draft Commission Implementing Regulation establishing a common form for rail passengers’ reimbursement and compensation requests for delays, missed connections and cancellations of rail services in accordance with Regulation (EU) 2021/782 .

4. Transmission of passenger contact details by intermediaries

9. The EDPS notes that the Proposal contains provisions on the transmission of contact details of the passenger and of the booking details by the intermediary to the carrier . In this regard, the EDPS welcomes that the Proposal describes the purposes of the processing in a clear and explicit manner . In particular, the EDPS positively notes that these provisions specify that the contact details of the passenger can only be used by the carrier to the extent necessary to comply with its obligations to provide information, provision of care, reimbursement, re-routing and compensation, and to fulfil its obligations under applicable Union law on safety and security.

10. In accordance with the principle of storage limitation, personal data may not be retained in a form which permits identification for longer than is necessary . The EDPS therefore welcomes the specification that the carrier must delete the contact details within 72 hours after the completion of the contract of carriage, unless further retention of the contact details is justified to fulfil its obligations in respect of the passenger’s right to re-routing, reimbursement or compensation .

5. Information to be transmitted by carriers to the national enforcement bodies

11. The EDPS notes that the Proposal requires air carriers to establish service quality standards (covering the items listed in Annex II), monitor their performance, and publish a report on service quality performance on the carrier’s website .

12. The EDPS welcomes the specification that “this report shall not contain personal data” . The same specification is made having regard, respectively, to the service quality standards 23 24 for waterborne passengers and for passengers by bus and coach . Indeed, the EDPS remarks that the report on service quality standards, to fulfil its function, can be limited to statistical data (e.g. on the number of complaints, types of complaints, etc.).

6. Conclusions

13. In light of the above, the EDPS has no specific recommendation to be made on the Proposal. Brussels, 24 January 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7