EDPS Opinion 9/2024 on the Proposal for a Regulation establishing a common data platform on chemicals

29 January 2024

Opinion 9/2024

on the Proposal for a Regulation establishing a common data platform on chemicals

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council establishing a common data platform on chemicals, laying down rules to ensure that the data contained in it are findable, accessible, interoperable and reusable and establishing a monitoring and outlook framework for chemicals .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 7 December 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council establishing a common data platform on chemicals, laying down rules to ensure that the data contained in it are findable, accessible, interoperable and reusable and establishing a monitoring and outlook framework for chemicals (‘the Proposal’).

The EDPS welcomes the objectives of the Proposal, namely to ensure the efficient delivery of coherent hazard and risk assessments of chemicals to achieve a high level of protection of human health and the environment, to enable the development and use of sustainable chemicals, to ensure the proper functioning of the single market for chemicals, and to improve the Union’s citizens’ trust in the scientific base for the decisions taken under Union legal acts on chemicals.

While the Proposal focuses mainly on the processing of chemicals data, the EDPS notes that the Proposal also envisages the processing of personal data, albeit to a limited extent. The EDPS therefore suggests a number of clarifications in relation to the provisions that are relevant from a data protection perspective.

The Proposal provides for the establishment and management by the European Chemicals Agency of a common data platform on chemicals, providing access to chemicals data. Insofar as personal data is processed via this platform, the EDPS considers that the future Regulation should specify the roles within the meaning of data protection law. In particular the Proposal should clarify the role of the European Chemicals Agency as the manager of the platform, and of the entities providing personal data to which the common data platform provides access.

The Proposal also provides rules on the processing of human biomonitoring data by the European Environment Agency (‘EEA’), which may involve the processing of personal data. The EDPS positively notes the attention paid to data protection aspects in this regard. In particular the EDPS welcomes the explicit indication that the EEA shall make human biomonitoring data they hold or host publicly available only in anonymised form through the Information Platform for Chemical Monitoring. The EDPS suggests however further clarifications with regard to the processing of human biomonitoring personal data carried out by the EEA. He recommends clarifying that any processing of biomonitoring data constituting personal data by the EEA for the purposes set out in the Proposal shall not entail the sharing of such data with third parties. Furthermore, the EDPS recommends to provide in the Proposal the obligation for the EEA to inform the providers of human biomonitoring data of the type of data that they should make available to the EEA. The EDPS recalls that when personal data are processed for scientific research and statistical purposes those data shall, in principle, be rendered anonymous (or alternatively pseudonymous), provided that the purposes can be fulfilled in this manner.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 7 December 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council establishing a common data platform on chemicals, laying down rules to ensure that the data contained in it are findable, accessible, interoperable and reusable and establishing a monitoring and outlook framework for chemicals (‘the Proposal’).

2. The objective of the Proposal is to ensure the efficient delivery of coherent hazard and risk assessments of chemicals where those assessments are required by Union legal acts, to achieve a high level of protection of human health and the environment, to enable the development and use of sustainable chemicals, to ensure the proper functioning of the single market for chemicals, and to improve the Union’s citizens’ trust in the scientific base for the decisions taken under Union legal acts on chemicals .

3. In order to fulfil the commitment to start using the ‘one substance, one assessment’ approach and in order to collate relevant information on the safety and sustainability of chemicals and on early warning signals for chemicals risks, the Proposal aims to: • develop a common data platform bringing together chemicals data from multiple sources, including environmental sustainability-related data; • ensure that information contained in the common data platform is secure, of high quality, findable, accessible, interoperable and re-usable; • enable the commissioning of testing and monitoring of substances as part of the regulatory framework when further information is considered necessary; • keep records of studies commissioned or carried out by businesses in a chemicals regulatory context and set up an early warning system for emerging chemical risks; • establish a monitoring and outlook framework for chemicals .

4. The Proposal would not create any new data requirements. Instead, the Proposal aims to streamline information flows and to centralise the data collected under current EU legislation.

5. The development of a common open data platform on chemicals was already announced in the Chemicals Strategy for Sustainability , which in its turn was announced by the European Green Deal .

6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 7 December 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 51 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of the EUDPR.

2. General remarks

7. The EDPS welcomes the objective of the Proposal to increase the level of protection of the environment and human health from the risks arising from hazardous chemicals, as well as to facilitate the functioning of the internal market for chemicals .

8. While the Proposal focuses mainly on the processing of chemicals data, the EDPS notes that the Proposal also envisages the processing of personal data , albeit to a limited extent. The EDPS recommends to clarify in the recitals that any processing of personal data pursuant to the Proposal should be carried out in accordance with Union law on the protection of personal data. In that regard, any processing of personal data by the Union institutions, bodies, offices and agencies shall take place in accordance with the EUDPR. Similarly, the future regulation should clarify that any processing of personal data pursuant to this Proposal by competent authorities of the Member States or researchers or research consortia should take place in accordance with Regulation (EU) 2016/679 (‘GDPR’) .

9. With the remainder of this Opinion, the EDPS suggests a number of additional clarifications in relation to the provisions of the Proposal that are relevant from a data protection perspective.

3. Common data platform on chemicals

10. Article 3(1) of the Proposal provides that the European Chemicals Agency (‘ECHA’) shall establish and manage a common data platform on chemicals (‘the common data platform’). Article 3(2) of the Proposal provides that the common data platform shall provide access to all chemicals data: • generated or submitted as part of the implementation of the Union acts listed in Annex I to this Regulation and held by the Agencies or the Commission; • generated as part of Union, national or international programmes or research activities in the sphere of chemicals and held by the ECHA, the EEA, the EFSA, the EU-OSHA or the Commission; • listed in Annex II and held by the EMA.

11. Although the platform is primarily meant to host data concerning chemicals , the EDPS understands that information to which the common data platform would provide access may in some instances also include or constitute personal data (e.g., the contact details of the chemicals data owner).

12. As the common data platform will bring together data originating from different entities, the EDPS recommends to clarify their roles within the meaning of data protection law (i.e. as controller, joint controller(s), or processor). In particular the Proposal should clarify the role of the European Chemicals Agency as the manager of the platform, and the entities providing personal data to which the common data platform provides access.

4. Human biomonitoring data

13. Article 6 of the Proposal concerns human biomonitoring data, defined as concentrations of chemicals measured in human matrices such as blood or urine . The EDPS understands that human biomonitoring data should be considered as a type of chemicals data as referred to in Articles 2(10) and 3(2) of the Proposal.

14. As human biomonitoring data can also constitute personal data , the EDPS welcomes the specification that the European Environment Agency (‘EEA’) shall (only) make such data publicly available in anonymised form .

15. The EDPS also positively notes that Article 6(6) of the Proposal clearly designates the EEA as the controller for the human biomonitoring personal data it holds or hosts and processes for the purposes referred to in paragraph 2. For the sake of completeness, the EDPS considers that the reference to paragraph 2 should be replaced with a reference to paragraphs 3, 4 and 5.

16. In addition, the EDPS welcomes that Article 6(4) of the Proposal clearly specifies the purposes of the processing of biomonitoring data constituting personal data. He understands that these purposes are meant to achieve the objective of providing support to the Commission and Agencies, as provided for in Article 6(3) of the Proposal. For the sake of legal certainty, the EDPS therefore considers it necessary that Article 6(4) provides an explicit reference to Article 6(3) of the Proposal.

17. With regards to Article 6(4) of the Proposal, the EDPS also recommends clarifying that any processing of biomonitoring data constituting personal data by the EEA for the purposes stipulated in this Article shall not entail the sharing of such data with third parties, as the purposes can be achieved without any further sharing of such data.

18. The EDPS understands that the EEA would receive human biomonitoring data from the Commission , and from researchers or research consortia funded by Union framework programmes . In the interest of legal certainty, the EDPS recommends to clarify in the Proposal whether the EEA would also receive such data from any other sources, either at national or Union level.

19. The EDPS further recommends to provide in the Proposal the obligation for the EEA to inform the providers of human biomonitoring data of the type of data that they should make available to the EEA, taking into account the public interests which the EEA is meant to achieve. These processing operations in the public interests may also entail processing for scientific, research or statistical purposes. The EDPS recalls that according to Article 89 GDPR and Article 13 EUDPR, processing for such purposes shall be subject to appropriate safeguards. Moreover, they stipulate that, when personal data are processed for these purposes, those data shall, in principle, be rendered anonymous (or alternatively pseudonymous), provided that the purposes can be fulfilled in this manner. The EDPS therefore recommends to also make explicit reference to Article 89 GDPR and Article 13 EUDPR in a recital to the Proposal.

20. Regarding human biomonitoring data constituting personal data processed by the EEA, the EDPS recalls that it should not be kept in a form which permits identification of data subjects longer than is necessary for the purposes for which the personal data are processed. The EDPS considers it necessary that the appropriate storage period for the EEA to hold the data is specified in the future regulation, or that the future regulation provides for an implementing or delegated act that will define such storage period.

5. Access rights to the common data platform on chemicals and transparency

21. Article 16(1) of the Proposal provides the Authorities with access to all the chemicals data in the common data platform, including data which is deemed to be confidential under Article 5(2), second sentence .

22. The EDPS recalls that any processing of personal data by Authorities, including access to chemicals data in the common data platform, should comply with the data minimisation principle. Therefore, the EDPS considers that the Proposal should clarify that the access rights of Authorities to personal data in the common data platform shall be limited to what is necessary in relation to the purposes for which personal data are processed by Authorities.

6. Implementing and delegated acts

23. Article 4(1) of the Proposal provides that the Commission shall adopt and publish an implementation plan identifying datasets for inclusion in the common data platform together with a timeline for their inclusion by means of an implementing decision. Article 4(4) provides for the adoption of a Commission implementing decision adopting and publishing the governance scheme, further detailed in Article 4(5). Article 4(5)(e) states that the governance scheme shall, among others, describe any other rules or requirements necessary for the operation of the common data platform such as the data update, archiving and deletion policy. With regard to the archiving and deletion policy, the EDPS recalls that insofar personal data is concerned, it should not be kept in a form which permits identification of data subjects longer than is necessary for the purposes for which the personal data are processed. This should be taken into account when defining the storage period in the implementing decision. Furthermore, Article 23 of the Proposal empowers the Commission to adopt delegated acts to amend Annexes I, II, and III of the Proposal for the purposes specified in the provision.

24. The EDPS recalls that, when a proposal for a delegated or implementing act has a possible impact on the protection of personal data, the European Commission is required to submit it to the EDPS for consultation in accordance with Article 42 EUDPR.

7. Conclusions

25. In light of the above, the EDPS makes the following recommendations: (1) clarify in the recitals that any processing of personal data pursuant to the Proposal by Union institutions, bodies, offices and agencies shall comply with the EUDPR; (2) clarify in the recitals that any processing of personal data pursuant to the Proposal by competent authorities of the Member States or researchers or research consortia shall comply with the GDPR; (3) clarify the role of the European Chemicals Agency as the manager of the common data platform, and the entities providing personal data to which the common data platform provides access; (4) replace the reference to paragraph 2 in Article 6(6) of the Proposal with a reference to paragraphs 3, 4 and 5 of the same provision; (5) include a reference to Article 6(3) in Article 6(4); (6) clarify that any processing of biomonitoring data constituting personal data by the EEA for the purposes stipulated in Article 6(4) of the Proposal shall not entail the sharing of such data with third parties; (7) clarify whether the EEA receives human biomonitoring data from sources other than the Commission and researchers or research consortia; (8) provide the obligation for the EEA to inform the providers of human biomonitoring data of the type of data that they should make available to the EEA; (9) refer in the recitals to the compliance with Article 89 GDPR and Article 13 EUDPR regarding the processing of personal data for scientific research and statistical purposes; (10)provide for a storage period for human biomonitoring data constituting personal data held by the EEA, either in the future regulation or in a implementing or delegated act; and (11)clarify that the rights to access to personal data in the common data platform by Authorities pursuant to Article 16(1) shall be limited to what is necessary in relation to the purposes for which they are processed by Authorities. Brussels, 29 January 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 9