Road Safety Package

24 April 2023

Opinion 11/2023 on the Proposal for a Directive of the European Parliament and the Council amending Directive (EU) 2015/413 facilitating cross-border exchange of information on road-safety-related traffic offences

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to Proposal for a Directive of the European Parliament and the Council amending Directive (EU) 2015/413 facilitating cross-border exchange of information on road-safety-related traffic offences Pursuant to Article 91 (1) point (c) TFEU .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 1 March 2023, the European Commission issued the Proposal for a Directive of the European Parliament and of the Council amending Directive (EU) 2015/413 (‘the CBE Directive’) facilitating cross-border exchange of information on road-safety-related traffic offences (‘the Proposal’).

The general objectives of the Proposal are to further enhance road safety by extending the scope of the CBE Directive to other road-safety-related traffic offences and refining mutual assistance procedures between Member States in the cross-border investigation of road-safety-related traffic offences, with the view of facilitating the cross-border enforcement of sanctions. The Proposal also aims to improve the protection of fundamental rights of non-resident drivers.

The EDPS welcomes the extension of the scope of the CBE Directive, which should contribute to the reduction of the number of road fatalities. The EDPS also welcomes the intention of the Proposal to ensure alignment of the CBE Directive with the Union legislation on data protection. In this context, the EDPS recommends including additional elements, in order to determine the storage duration of personal data which may be exchanged between Member States for the investigation of road-safety-related offences, and to limit the exchanged data to what is necessary for the cross-border investigations and enforcement of sanctions. In particular, the national databases other than the national vehicle registers which may be accessed in the context of the CBE Directive should be clearly defined, as well as the entities authorised to have access to them. Similarly, the conditions of use of the CBE Portal to exchange vehicle registration data and data of persons presumed to be liable for road-safety-related offences should be clarified. The EDPS notes positively the designation of the Commission as the controller of the CBE Portal. However, the EDPS is of the opinion that further clarification is needed to determine the roles and responsibilities of Member States when exchanging personal data, as well as their relationship with the Commission when connecting to the Portal. Finally, the EDPS invites the co-legislator to review the modalities of information of the data subject, as regards the data protection rules.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 1 March 2023, the European Commission issued the Proposal for a Directive of the European Parliament and of the Council amending Directive (EU) 2015/413 (‘the CBE Directive’) facilitating cross-border exchange of information on road-safety-related traffic offences (‘the Proposal’).

2. The Proposal is part of a larger legislative package, referred to as the ‘Road Safety Package’ which also includes: a. a Proposal for a Directive on driving licences, amending Directive (EU) 2022/2561 of the European Parliament and of the Council, Regulation (EU) 2018/1724 of the European Parliament and of the Council and repealing Directive 2006/126/EC of the European Parliament and of the Council and Commission Regulation (EU) No 383/2012 (the ‘Driving Licence Directive’); b. a Proposal for a Directive on the Union-wide effect of certain driving disqualifications .

3. With the objective of reducing the death toll for all modes of transport in the EU to close to zero by 2050, the Commission issued in 2020 the ‘Sustainable and Smart Mobility Strategy’ and announced the revision of the CBE Directive. Subsequently, this initiative was inserted in Annex II to the Commission Work Programme 2022 (REFIT initiatives), under the heading ‘A New Push for European Democracy’ .

4. The objectives of the Proposal are to further enhance road safety by extending the scope of the CBE Directive to other road-safety-related traffic offences and streamlining mutual assistance procedures between Member States in the cross-border investigation of road- safety-related traffic offences, thus facilitating the cross-border enforcement of sanctions. It also aims to improve the protection of fundamental rights of non-resident drivers.

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission on 1 of March 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 37 of the Proposal.

2. General remarks

6. As already mentioned by the EDPS in his opinion on the original proposal for a Directive facilitating cross-border enforcement in the field of road safety, “it is not questionable that reducing the number of road fatalities is a legitimate purpose that could qualify as a public interest task” .

7. In addition, the Proposal foresees the establishment of cross-border investigation procedures, including a dedicated IT portal, for communication between governmental authorities, businesses and citizens. Such IT portal would inter-connect national registers/back-end IT services in the cross-border exchange of information through designated contact points. The Proposal introduces also a possibility of applying the duty of the vehicle owner or holder to cooperate with authorities in the identification of the liable person .

8. The EDPS considers that the elements presented in the Impact Assessment, as well as in the Explanatory Memorandum and in the Preamble of the Proposal give a clear indication of the objectives of the Proposal, in support of the necessity of the foreseen exchange of personal data.

9. The EDPS welcomes the intention of the Commission to ensure alignment of the CBE Directive with the new rules on personal data protection . Such an alignment is of utmost importance in the context of digitalisation of current cross-border investigation procedures.

10. The present opinion will examine in particular the relationship between the Proposal and the EU data protection legal framework, the applicable rules on data retention, the use of the European car and driving licence information system (EUCARIS) as well as other databases and the online portal (‘the CBE Portal’) to exchange data, the role and responsibilities of the different actors involved in the processing of data, and the rights of the data subject.

3. Relationship to Union legislation on data protection

11. The EDPS welcomes Recital 26 of the Proposal, which refers to the “Union legal framework on handling personal data” and the need to align the provisions of the Proposal on the processing of personal data with the new legal framework .

12. The EDPS also welcomes Recital 28 of the Proposal according to which “Any processing of personal data under Directive (EU) 2015/413 should comply with Regulation (EU) 2016/679, Directive (EU) 2016/680 and Regulation (EU) 2018/1725 within their respective scope of application”.

13. Moreover, Recital 29 of the Proposal specifies the legal basis for the processing activities necessary for the Member States to provide mutual assistance to each other in order to identify the persons liable for the road-safety-related traffic offences. The principle of data minimisation is also clearly mentioned in Recital 31 dedicated to the CBE Portal, which recalls that “the exchanged personal data should be limited to what is necessary for the crossinvestigations and enforcement of sanctions”.

14. In this regard, the EDPS notes positively, in situations of mutual assistance between Member States in identifying the liable person, the possibility for the Member State of registration or of residence to refuse to provide the additional information requested. Such is the case, in particular, when the requested information would reveal the identity of a person protected or when “there are substantial grounds to believe that providing the requested information would be incompatible with the Member State of registration’s or with the Member State of residence’s obligations in accordance with Article 6 of the Treaty on European Union and the Charter of Fundamental Rights of the European Union” . As clarified by the Court of Justice of the European Union (‘the CJEU’) , the need for such safeguards is all the greater where personal data is subjected to automated processing and where the protection of the particular category of personal data that is sensitive data is at stake.

15. The EDPS notes that Article 7 of the current CBE Directive is dedicated to data protection and refers explicitly not only to the applicability of the former EU Directive on data protection, but also to key principles relating to processing of personal data: accuracy, storage limitation, purpose limitation and data subject’s rights to information, to access, to rectification, erasure and blocking, to compensation and to judicial redress. In his formal comments issued on 3 October 2014, the EDPS welcomed such references. However, all the relevant provisions of the current Article 7 of the CBE Directive have been moved to the recitals of the Proposal. The EDPS understands that such a change is purely formal, since in any case the EU data protection legal framework should apply to any processing of personal data of data subjects in the Union, in accordance with Article 8 of the Charter of fundamental rights of the European Union.

4. Data retention

16. According to the storage limitation principle, the GDPR, the EUDPR and the LED provide for personal data to be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed”. Article 5 LED explicitly requires Member States to provide for appropriate time limits to be established for the erasure of personal data or for a periodic review of the need for the storage of personal data.

17. Against this background, the EDPS welcomes Recitals 7 and 8 of the Proposal, which refer respectively to the necessity to impose “further obligations” on Member States “regarding the need to keep certain data in the relevant databases available and up-to-date to increase the effectiveness of the information exchange”, and to establish “a data retention period (...) as regards the identity of the previous owners”.

18. However, pursuant to the new Article 4(3) of the CBE Directive, Member States would retain data relating to previous holders, owners and, when available, end users of the vehicles in the national vehicle registers “for at least 6 months” after any modification of the ownership or use of the vehicle in question. The EDPS considers that the envisaged storage duration should be specified unambiguously. The reference to a minimum period of storage is not sufficient to ensure consistency and legal certainty. Therefore, the EDPS recommends to also indicate the maximum period of time for which the data may be retained.

19. Similarly, the EDPS recommends to introduce in the new Article 8 of the CBE Directive dedicated to the establishment of the CBE Portal, a provision determining a storage duration for the personal data processed in the context of this portal.

5. Exchanges of data by using other databases

20. The new Article 4(c) of the CBE Directive would lay down the possibility for Member States to exchange or access data by using other databases “such as driving licence registers or population registers for the sole purpose of the identification of the liable person”. This Article specifies that such exchange or access can be done only and in so far as it is “explicitly based on Union legislation”.

21. The EDPS welcomes the reference to the need for a legal basis to allow such use of other databases both in Recital 15 and in Article 4(c). In addition, Recital 15 refers explicitly to the necessity to respect “the fundamental rights of non-resident drivers”. However, the current wording of Article 4(c) leaves open the possibility of using any database, without excluding those which might have a purpose incompatible with the one for which data are stored in national vehicle registers. The EDPS recommends to set out precisely which databases could be consulted, and to specify that only national contact points can have access to such databases for the sole purpose of the identification of the liable person. In addition, a specific procedure should be foreseen, whereby Member States would communicate to the Commission the list of relevant databases, and such lists would be published in the Official Journal of the European Union.

22. The EDPS also welcomes Recital 9, which recommends the sole use of EUCARIS to carry out requests to disclose vehicle registration data and the exchange of the data elements in cross-border cases: “Member States should prevent the exchange of information by other means, which would be less cost-efficient and may not ensure the protection of the transmitted 7 data”. However, the Proposal provides for an online portal, dedicated in particular to the exchange of information “and other interactions” between national contact points and other relevant authorities of Member States with each other. The new Article 8 (1) (a) of the Directive specifies that this may “include exchanging vehicle registration data and the data on persons presumed to be liable or liable for road-safety-related offences”.

23. The EDPS considers that the interplay between exchanges of data via EUCARIS and those through the CBE Portal should be clarified, in order to specify when the portal should be used instead of, or in addition to the decentralised system based on the use of EUCARIS. In particular, in light of the data minimisation principle referred to in Recital 31, the EDPS invites the co-legislator to specify what is meant by the “other interactions” allowed through the CBE Portal. Moreover, as regards the access to the Portal, the EDPS invites the co-legislator to justify the authorisation given to “other relevant authorities that are competent in the identification of the liable persons” , since these authorities might not be involved in the investigation of the road-safety-related traffic offences.

6. Determination of roles and responsibilities

24. The EDPS takes note that the Commission has been defined as controller of the CBE Portal, both in Recital 31 of the Proposal and the new Article 8(3) of the CBE Directive, in accordance with Regulation 2018/1725.

25. The EDPS also notes that the above-mentioned Recital and Article make no reference to the responsibilities of Member States, although it stems from the wording of these provisions that the CBE Portal should facilitate communication between Member States, which implies the processing of personal data.

26. The EDPS recalls that the concepts of controller, joint controller and processor play a crucial role in the application of data protection law, since they determine who is responsible for compliance with different data protection rules, and how data subjects can exercise their rights in practice. Furthermore, in line with Articles 28 EUDPR and 26 GDPR, where two or more controllers together determine the purposes and means of the processing, they are considered to be joint controllers. In addition, the concept of controllership does not necessarily refer to one single entity, but can also involve multiple parties playing a role in a processing operation. As a result, and as confirmed by the CJEU , each of the actors involved would have obligations under data protection law. In case of joint controllers, the distribution of tasks between them has to be specified by means of an arrangement between them.

27. Against this background, the EDPS invites the co-legislators to further clarify who bears responsibility and needs to take action if something goes wrong, legally, technically, or otherwise, when using the Portal or one or another of the interconnected “relevant portals, networks, websites or platforms” . Not only the role of the Commission, but also that of the Member States should be explicitly defined in the Proposal.

7. Rights of the data subject

28. The right to information of the data subject on data protection rules is explicitly foreseen in the new Article 5(2)(h) of the Directive. However, this provision lays down the possibility for Member States to provide only the reference to the place where this information “may be easily retrieved”, pursuant to Article 13 LED and 13 and 14 GDPR. The EDPS considers more appropriate that clear and comprehensive information about the rights of the data subject is directly given to him/her, in a self-contained document, to be joined to the information letter.

29. The EDPS also notes in the new Article 5(3) that in case of checks on the spot of the liable person, the information letter may not contain the information on the applicable data protection rules. The EDPS invites the co-legislator to clarify the grounds for such a derogation which, prima facie, does not seem justified.

8. Conclusions

30. In light of the above, the EDPS makes the following recommendations: (1) to determine the maximum storage durations for personal data processed in national vehicle registers as well as in the CBE Portal, (2) to specify the other databases to which Member States can have access for the sole purpose of the identification of the liable person, as well as the authorities authorised to access them, (3) to clarify the relations between the decentralised system based on the use of EUCARIS and the CBE Portal, (4) to designate Member States as joint controllers, together with the Commission, of the CBE Portal, (5) to provide to the data subject a comprehensive information on the data protection rules. Brussels, 24 April 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI