EDPS Opinion on the Proposal for a Regulation on European statistics on population and housing

16 March 2023

Opinion 8/2023

on the Proposal for a Regulation on European statistics on population and housing

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to This Opinion relates to the Proposal for a Regulation on European statistics on population and housing, amending Regulation (EC) No 862/2007 and repealing Regulations (EC) No 763/2008 and (EU) No 1260/2013 . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 20 January 2023, the European Commission issued a Proposal for on European statistics on population and housing, amending Regulation (EC) No 862/2007 and repealing Regulations (EC) No 763/2008 and (EU) No 1260/2013.

The Proposal contains provisions aiming to facilitate access to available data sources that will improve the production processes and general quality of social statistics. In this context, the EDPS considers that the recitals of the Proposal should make specific reference to compliance with the safeguards relating to processing for statistical purposes under Article 89 of the GDPR and Article 13 of the EUDPR. In addition, the Proposal should clarify that in principle only anonymised or pseudonymised data will be used and shared for statistical purposes.

High quality statistics are necessary to support the design, implementation and evaluation of Union policies, including fundamental rights policies. The EDPS also recognises that new innovative approaches can bring promises for statistics and research. However, the EDPS has serious concerns regarding the indication that information relating to specific persons might be obtained from any source, including digital traces relating to specific persons. The EDPS therefore considers that the last sentence of Article 2(3) of the Proposal, which refers to the use of any appropriate source or combination of them, including digital traces relating to the person, should be deleted.

In addition, the EDPS considers that further clarification is needed regarding the sources and categories of data that will be accessed and used by the Member States and the Commission (Eurostat), in particular as regards administrative data sources and privately held data. Privately held data can be diverse, as it is understood to encompass a vast amount of data held by business, including data gathered through mobile phone records, location data, social media data, but also through the Internet of Things (IoT) and provision of digital services. The EDPS considers that collection of personal data from such sources may not be proportionate to the aims pursued, having regard to the potential risks for the rights and freedoms of data subjects. Insofar as the Proposal seeks to provide a legal basis for the processing of personal data by the Member States or the Commission, it is necessary to provide a clear and comprehensive overview of the categories of personal data that may be processed under the Proposal, taking into account the requirements of necessity and proportionality. Moreover, the sources from which those categories of personal data may be obtained should be clearly set out in the Proposal itself.

As regards the collection of statistics from the Large-Scale IT systems (LSITs) in the Area of Freedom, Security and Justice, the EDPS that Article 10 of the Proposal should be amended. In particular, the Proposal should clarify that statistics for LSITs shall be gathered (exclusively) from the central repository for reporting and statistics (CRRS). In case the Commission would like to foresee transitional measures until the CRRS is fully operational, specific transitional measures should be introduced.

2

The EDPS welcomes that the Proposal envisages the testing and use of privacy-enhancing technologies that implement data minimisation by design. The EDPS is aware of the potential of privacy enhancing technologies as enablers of data sharing which is both privacy friendly and socially beneficial and fully supports the use of privacy-enhancing technologies in this context. At the same time, the EDPS recalls that any sharing of personal data must in any event comply with all relevant provisions of the GDPR and EUDPR, including Article 89(1) GDPR and Article 13 EUDPR.

Finally, concerning the establishment of a secure infrastructure to facilitate such data sharing, the EDPS notes that the Proposal does not specify the roles and responsibilities of the Commission (Eurostat) and the competent national authorities within the meaning of data protection law. While detailed arrangement to ensure compliance with data protection requirements may be specified by way of an implementing act, the EDPS considers that the roles of the various actors involved as controller, joint controller or processor should be clearly specified in the enacting terms of the Proposal.

3

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 20 January 2023, the European Commission (‘Commission’) issued a Proposal for on European statistics on population and housing, amending Regulation (EC) No 862/2007 and 4 5 repealing Regulations (EC) No 763/2008 and (EU) No 1260/2013 (‘the Proposal’).

2. The objective of the Proposal is to facilitate access to available data sources that would improve the production processes and general quality of social statistics. It also contains provisions to strengthen the links to and general consistency of all EU social statistics based on persons and households, as well as provisions aimed at developing a harmonised definition of population based on sound statistical concepts for all outputs. The Proposal also contains provisions to further align population and international migration statistics with statistics on administrative and judicial events related to asylum, legal and irregular migration under Articles 4, 5, 6 and 7 of Regulation (EC) No 862/2007 .

3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 20 January 2023, pursuant to Article 42(1) of the EUDPR. The EDPS welcomes the reference to this consultation in recital 40 of the Proposal.

2. General remarks

4. The EDPS welcomes the objective of the Proposal, namely to establish a common legal framework for the development, production and dissemination of European statistics on population and housing . High quality statistics are necessary to support the design, implementation and evaluation of Union policies, including fundamental rights policies . In the European context, high quality statistics across Member States are essential to support many policy areas and initiatives across the EU .

5. The EDPS recognises that new innovative approaches can bring promises for statistics and research, but will also pose risks and raise challenges, thus requiring legislators to ensure that any potential benefits never come at the expense of individuals’ rights. To provide effective protection for the right of privacy and the right to the protection of personal data, legislators should anticipate the potential risks and challenges that these promising approaches may bring and provide for appropriate safeguards .

6. The EDPS welcomes recitals 30 and 33 of the Proposal, which emphasise that the EUDPR and the GDPR are to apply to the processing of personal data under the Proposal. In this context, the EDPS recalls that personal data must be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes . Further processing of personal data for statistical purposes is considered compatible with the original processing purposes, provided the conditions in Article 89(1) of the GDPR and Article 13 of the EUDPR are satisfied. In particular, Article 13 EUDPR and Article 89 GDPR stipulate that when personal data are (further) for statistical purposes, those data shall in principle be rendered anonymous (or alternatively pseudonymous), provided that the statistical purpose be fulfilled in this manner . The EDPS considers that the recitals of the Proposal should make specific reference to compliance with the safeguards relating to processing for statistical purposes under Article 89 of the GDPR and Article 13 of the EUDPR. In addition, the Proposal should clarify that in principle only anonymised or pseudonymised data will be used and shared for statistical purposes.

7. While further processing personal for statistical purposes constitutes both a legitimate and compatible purpose, the EDPS considers that several provisions of the Proposal, as currently drafted, risk entailing an excessive interference with the rights to privacy and data protection.

8. For example, the EDPS notes that the statistics compiled under the Proposal shall be based on statistically sound and well-documented methods taking into account international recommendations and best practice such as ‘signs of life’, ‘rate of stay’ and other scientifically-based statistical estimation methods used for compiling usually resident population in the Member States . In line with the definition set out in Article 2(3) of the Proposal, ‘signs of life’ means “any information indicative of the actual presence and usual residence of a person on the territory of interest. They can be obtained from any appropriate source or combination of them, including digital traces that relate to the person” (emphasis added).

9. The EDPS understands that it is necessary to determine whether a person lives in the national territory, which corresponds to the concept of resident population. The EDPS also understands that statistical agencies use the notion of “signs life” to refer to the use of additional sources (other than surveys or censuses) to validate residency, by considering the presence of the individual in the different data sources (e.g., records indicating that the individual works, attends the education system, pays taxes, is registered in the employment office, but also medical records, electricity or water consumption, phone calls, etc.) .

10. While the EDPS understands that sources other than surveys or censuses are useful when generating statistics, the EDPS has serious concerns regarding the indication that information relating to specific persons might be obtained from any source, including digital traces relating to specific persons. Such concerns are magnified in light of recital 19 of the Proposal, which refers to ‘sources related to the Internet of Things (‘IoT’) and the provision of digital services’. Such information could concern special categories of personal data and other sensitive data that would enable to draw intimate inferences on the data subject’s life and the collection of such personal data in relation to specific persons is unlikely to be proportionate to the aims pursued. The EDPS therefore considers that the last sentence of Article 2(3) of the Proposal, which refers to the use of any appropriate source or combination of them, including digital traces relating to the person, should be deleted.

11. The EDPS recalls that any limitation on the right to personal data must be based on a legal basis that is adequately accessible and foreseeable and formulated with sufficient precision to enable individuals to understand its scope. In accordance with the principles of necessity and proportionality , the legal basis must also define the scope and manner of the exercise of their powers by the competent authorities and be accompanied by sufficient safeguards to protect individuals against arbitrary interference.

12. As further specified in section 3 of this Opinion, to the extent the Proposal aims to cover the processing of personal data, an appropriate legal basis and a clear and comprehensive overview of the categories of personal data that may be processed, should be provided in the Proposal.

3. Data sources and methods

13. The EDPS notes that Article 9(1) of the Proposal lists the data sources to be used by the Member States and the Commission (Eurostat) for the purposes of the Regulation. To this end, the EDPS also notes that Article 9(1) refers to concepts not defined in the Proposal, notably “administrative data sources” and “other sources including privately held data”.

14. As regards privately held data, recital 23 of the Proposal highlights that such data can improve the coverage, timeliness and crisis response capacities of European statistics on population and housing or to enable statistical innovation. According to the same recital, such data have the potential to complement existing demography and migration statistics, bring statistical innovation and even serve for production of early estimates. Lastly, it specifies that national statistical institutes, other competent national authorities and the Commission (Eurostat) should have access to and use such data.

15. The EDPS understands that privately held data have the potential to help producers of official statistics to provide more accurate statistics that reflect topics of interest to users at a faster pace. However, he also points out that privately held data can be diverse, as it is understood to encompass a vast amount of data held by business, including data gathered through mobile phone records, location data, social media data , but also through IoT and provision of digital services. Further to offering a rich profile on individuals’ behaviour, such information could concern special categories of personal data and other sensitive data that would enable to draw even more intimate inferences on the data subjects’ life and could thus represent a significant risk for the rights and freedoms of data subjects.

16. The EDPS recalls that the processing of personal data shall be lawful if the data subject (the identified or identifiable natural person to whom personal data relate) has given consent to the processing of his or her personal data for one or more specific purposes or if another appropriate legal basis under Article 6 GDPR and/or Article 5 EUDPR can be validly applied. In case of processing of special categories of data, regard must also be had to the general prohibition included in Article 9 GDPR and Article 10 EUDPR. In addition, the EDPS recalls that data concerning the use of electronic communications services, as well as the accessing of information stored in the end-user’s device is subject to specific rules under Directive 2002/58/EC (‘ePrivacy Directive’).

17. The EDPS considers that the Proposal does not clearly specify the categories of personal data to be accessed and used by the Member States and the Commission (Eurostat). Insofar as the Proposal seeks to provide a legal basis for the processing of personal data by the Member States or the Commission, the EDPS considers that it is necessary to provide a clear and comprehensive overview of the categories of personal data that may be processed under the Proposal. Moreover, the sources from which those categories of data may be obtained should be clearly set out in the Proposal itself.

18. When specifying the categories of data, the EDPS recalls first and foremost comply with the data minimisation principle , which provide that personal data must be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed". As previously indicated, the collection of special categories of personal data or otherwise sensitive data that would enable drawing intimate inferences on the data subject’s life may not be proportionate to the aims pursued.

4. Data sharing

4.1. Collection of statistics from the Large-Scale IT systems (LSITs) in the Area of Freedom, Security and Justice

19. Article 10 of the Proposal states that the Commission may request both "data and metadata" from the databases and interoperability systems, "including (...) statistical data stored in the central repository for reporting and statistics (CRRS)".

20. As regards the soon to be interoperable Large Scale IT Systems (LSITs) in the area of freedom, security and justice, a repository for reporting and statistics (‘CRRS’) is to be established to generate cross-system statistical data and analytical reporting for policy, operational and data quality purposes in accordance with the applicable legal instruments . This CRRS stores anonymised data extracted from the underlying EU information systems, the shared biometric matching service, the common identity repository and the multi-identity detector, in order to provide cross-system statistical reporting for policy, operational and data quality purposes. The EDPS recalls his formal comments, with several recommendations, on the CRRS .

21. The goal underpinning the establishment of the CRRS was to create a single point of retrieval for statistical information, leveraging the new possibilities of interoperability to avoid needing to retrieve statistics from the individual systems. It also plays an important role as a gateway and a filter to transform data which is stored for operational purposes (which is gathered and further processed by operational actors such as border guards and police officers), to statistical data that can be further used for general policymaking. Therefore, allowing parallel retrieval of data from any underlying system should not be pursued for the aim of (further) processing statistics – doing so would clearly undermine also the reason for existence of the CRRS in the first place.

22. With this in mind, the EDPS considers that Article 10 of the Proposal should be amended. If indeed the CRRS is to be used as the single (anonymous) repository, the wording of Article 10 should be made more precise. Specifically for the CRRS, additional clarity should be provided by splitting up the paragraph and clarify that for LSITs statistics shall be gathered exclusively from the CRRS. In case the Commission would like to foresee transitional measures until the CRRS is fully operational, it could introduce a paragraph immediately following this to indicate what should happen in the meantime.

4.2. Privacy enhancing technologies

23. Article 13 of the Proposal provides that data shall be shared between the competent national authorities of different Member States, and between these competent national authorities and the Commission (Eurostat) for the purpose of developing and producing European statistics governed by this Regulation and of improving their quality.

24. Article 13(3)(b) of the Proposal provides that the sharing of personal data shall be allowed and may take place on a voluntary basis provided, among others, it is based preferably on privacy enhancing technologies that are specifically designed to implement the principles of the GDPR and EUDPR, with particular regard to purpose limitation, data minimisation, storage limitation, integrity and confidentiality. The Explanatory Memorandum recalls that the GDPR strictly limits data sharing in this context, based on the six data protection principles .

25. Article 13(4) of the Proposal specifies that the Commission (Eurostat) and the Member States shall test and assess by means of pilot studies the fitness of relevant privacy enhancing technologies for data sharing. Furthermore, where the pilot studies identify effective and secure data sharing solutions, the Commission may adopt implementing acts laying down technical specifications for the data sharing and measures for the confidentiality and security of information.

26. The EDPS welcomes recital 30 of the Proposal, which states that, when data sharing entails processing of personal data according to the GDPR and the EUDPR, the principles of purpose limitation, data minimisation, storage limitation and integrity and confidentiality should be fully applied. At the same time, the EDPS recalls that any sharing of personal data must in any event comply with all provisions of the GDPR and EUDPR, including Article 89(1) GDPR and Article 13 EUDPR (pursuant to which in principle only anonymised or pseudonymised data will be used and shared for statistical purposes) .

27. The EDPS welcomes that, in order to enable effective data sharing in line with the GDPR and EUDPR, the Proposal envisages the testing and use of privacy-enhancing technologies that implement data minimisation by design . The EDPS is aware of the potential of privacy enhancing technologies as enablers of data sharing which is both privacy friendly and socially beneficial. Privacy-enhancing technologies are linked to the principle of data protection by design and by default , and are therefore relevant to the appropriate technical and organisational measures that should be put in place to mitigate the data protection risks identified in the mandatory assessment by the controller. These measures shall be designed to implement the data protection principles effectively and integrate necessary safeguards into the data processing.

28. For example, techniques such as Private Set Intersection, Secure Multi-Party Computation and Homomorphic can be explored to find linkages and make calculations among data records submitted by multiple parties in a way that data one party contributes remains confidential against the other parties. Or, other techniques such as differential privacy may be assessed to avoid (re-)identification while preserving statistical properties within a certain level of accuracy. The statistical community has already some experience and is experimenting the use of privacy enhancing technologies .

29. The EDPS welcomes that the Proposal sets an obligation for the Commission (Eurostat) to evaluate the results of the pilot and feasibility studies in cooperation with Member States, as well as the obligation to prepare reports on the findings of those studies. He considers that the pilot and feasibility studies can contribute to the mandatory assessment that controllers should perform based on Article 26 EUDPR to identify and then implement appropriate technical and organisational measures. The EDPS recalls that the Commission (Eurostat) should evaluate if a mandatory Data Protection Impact Assessment (DPIA) is necessary .

30. It is the EDPS understanding that, in its current form, the Proposal could be understood as allowing for access to data of identified or identifiable individuals provided by Member States and EU databases at large scale, in particular to implement quality requirements as provided for in Article 12. These personal data might include the categories described in the Annex of the Proposal. These categories currently include health data such as “late fetal deaths” and other person's socio-economic characteristics, as well as migration, citizenship and partnership status. These elements should be taken into account in assessing whether the processing activities might entail high risks for individuals and thus a mandatory DPIA.

31. Should the outcome of the pilot and studies not provide assurance on the effectiveness of the technical and organisational measures tested, the EDPS expects that the Commission will continue its assessment until it finds the needed appropriate measures. In case the outcome of a possible DPIA requires it, the Commission shall consult the EDPS prior to the processing .

4.3. Infrastructure to facilitate data sharing

32. The EDPS notes that recital 29 of the Proposal provides that the Commission (Eurostat) should establish a secure infrastructure to facilitate such data sharing while ensuring all necessary safeguards. Furthermore, Article 13(2) of the Proposal provides that “[t]he Commission (Eurostat) shall set up a secure infrastructure to facilitate data sharing (...)” and that “[c]ompetent national authorities for statistics under this Regulation may use this secure data sharing infrastructure (...)”.

33. The EDPS notes that the Proposal does not specify the roles and responsibilities within the meaning of data protection law of the Commission (Eurostat) and the competent national authorities, where personal data is processed. Ensuring clarity of the role of each actor involved in the processing of personal data is important to promote transparency of processing and the effective exercise of data subject rights. While detailed arrangement to ensure compliance with data protection requirements may be specified by way of an implementing act, the EDPS considers that the roles of the various actors involved as controller, joint controller or processor should be clearly specified in the enacting terms of the Proposal.

4.4. Implementing and delegated acts

34. The EDPS notes that according to Article 7 of the Proposal the Commission would be empowered to adopt delegated acts to supplement the Proposal by specifying the data sets and metadata to be provided by Member States on an ad hoc basis, where the collection of additional statistics is deemed necessary for the purpose of addressing additional statistical needs under this Regulation.

35. Furthermore, the Commission would be empowered to adopt the implementing acts that would specify the technical properties of the data sets and metadata to be provided to the Commission (Eurostat) , that would specify the technical properties of the ad hoc data sets and metadata , and that would lay down technical specifications for the data sharing and measures for the confidentiality and security of information .

36. In this regard, the EDPS recalls that, when a proposal for legislation has a possible impact on the protection of personal data, the European Commission has to submit it to the EDPS for consultation.

Conclusions

In light of the above, the EDPS makes the following recommendations:

(1) to include in a recital of the Proposal a reference to compliance with the safeguards relating to processing for statistical purposes under Article 89 of the GDPR and Article 13 of the EUDPR;

(2) to clarify in the Proposal that in principle only anonymised or pseudonymised data will be used and shared for statistical purposes;

(3) to delete the last sentence of Article 2(3) of the Proposal, which refers to the use of any appropriate source or combination of them, including digital traces relating to the person;

(4) insofar as the Proposal seeks to provide a legal basis for the processing of personal data, to provide a clear and comprehensive overview of the categories of personal data that may be processed as well as the sources from which those categories of data may be obtained;

(5) to amend Article 10 of the Proposal and clarify that statistics for LSITs shall be gathered exlusviely from the central repository for reporting and statistics (CRRS) established by the relevant instruments instruments. In case the Commission would like to foresee transitional measures until the CRRS is fully operational, specific transitional measures should be introduced;

(6) to specify the roles of the Commission and the Member States under data protection law in relation to the secure infrastructure to be established in accordance with Article 13(2) of the Proposal.

Brussels, 16 March 2023

Wojciech Rafał WIEWIÓROWSKI

[e-signed]

12