EDPS Opinion 11/2024 on the Proposal for a Directive establishing harmonised requirements in the internal market on transparency of interest representation carried out on behalf of third countries

6 February 2024

Opinion 11/2024

on the Proposal for a Directive establishing harmonised requirements in the internal market on transparency of interest representation carried out on behalf of third countries

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Directive of the European Parliament and of the Council establishing harmonised requirements in the internal market on transparency of interest representation carried out on behalf of third countries and amending Directive (EU) 2019/1937 . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 12 December 2023, the European Commission adopted a Proposal for a Directive of the European Parliament and of the Council establishing harmonised requirements in the internal market on transparency of interest representation carried out on behalf of third countries and amending Directive (EU) 2019/1937.

The EDPS recognises the legitimacy of the general objective of the Proposal, which aims at providing harmonised transparency requirements as regards activities conducted on behalf of third countries, when they seek to influence the development, formulation or implementation of policy or legislation, or public decision-making processes, in the Union.

In order to achieve that goal, the Proposal includes provisions which impose limitations to the right to respect for private life and the right to the protection of personal data, in particular by providing for public access to information on entities carrying out interest representation activities on behalf of third countries.

The EDPS welcomes the safeguards laid down in the Proposal in order to ensure that interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter is proportionate and limited to what is strictly necessary. In particular, the EDPS notes that the set of personal data to be made available to the public is limited, and that entities may derogate from the obligation to make information publicly available where there are overriding legitimate interests.

The EDPS also positively notes the explicit designation in the Proposal of the different authorities acting as controllers within the meaning of Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, with respect to their own data processing activities.

While the EDPS is generally satisfied with the safeguards provided by the Proposal, he nevertheless recommends reassessing whether the publication of the address of a legal representative is necessary to achieve the envisaged objective, especially as the Proposal does not provide for publication of the address of the entity mentioned in Article 3(1) of the Proposal. If so, the choice to make available the address of the representative (on not that of the entity referred to in Article 3(1)) should be duly justified.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 12 December 2023, the European Commission adopted a Proposal for a Directive of the European Parliament and of the Council establishing harmonised requirements in the internal market on transparency of interest representation carried out on behalf of third countries and amending Directive (EU) 2019/1937 (‘the Proposal’) .

2. The objective of the Proposal is to lay down rules with respect to economic activities of interest representation on behalf of a third country, with a view of achieving a common level of transparency across the Union and improving the functioning of the internal market . The Proposal, a core element of which is the establishment of national registers for entities carrying out such activities, would introduce common transparency and accountability standards in the internal market .

3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 13 December 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in recital 69 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

2. General remarks

4. The EDPS recognises the legitimate objective of ensuring transparency of interest representation activities carried out on behalf of third countries, in order to safeguard the integrity and resilience of public decision-making processes in the Union. This objective, which is related to the one of the Proposal for a Regulation on the transparency and targeting of political advertising , is clearly explained in the Proposal, in particular in the explanatory memorandum and in recitals 11 to 13.

5. By requiring that entities carrying out economic activities of interest representation on behalf of a third country provide certain information to the national authorities and provide for the exchange of such information among competent authorities as well as public access to a part of that information, the Proposal may interfere with individuals’ rights guaranteed by the EU Charter of Fundamental Rights, including the right to data protection. Therefore, the requirements of necessity and proportionality of the envisaged processing need to be assessed in accordance with Article 52(1) of the Charter . The Proposal must ensure that the limitations to the rights to private life and to the protection of personal data in relation to the information provided by these entities apply only in so far as is strictly necessary .

6. Against this background, the EDPS welcomes the reference made in recital 65 regarding the applicability of Regulation (EU) 2016/679 (‘the GDPR’) , and of the EUDPR, when personal data are processed in the context of the Proposal.

7. The EDPS positively notes that recital 37 specifies that the information to be included for the purpose of the Proposal in the registration should be limited to what is necessary to ensure transparency requirements and the effective enforcement of the proposed Directive.

8. The EDPS also welcomes the definition of the storage period for logs of personal data processing operations within national registries in Article 9(4) of the Proposal.

3. Publication of personal data

9. The EDPS notes that the Proposal provides for public access of some categories of personal data, in particular the name of entities carrying out interest representation activities on behalf of third countries or, if they are established outside the Union, the name of their designated legal representatives.

10. As noted in the explanatory memorandum , the Court of Justice of the European Union has considered that making personal data accessible to a potentially unlimited number of persons constitutes a serious interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter . At the same time, these rights are not absolute rights, and they may be restricted if such restriction is provided by law, respects the essence of these rights and is strictly necessary and proportionate in relation to the objective of general interest recognised by the European Union .

11. The EDPS notes that the Proposal provides for safeguards to ensure that the publication of personal data is limited to what is necessary to achieve transparency. According to Article 12(1) of the draft Proposal, it seems that, among data which shall be made publicly available, and which are listed exhaustively in Annex I of the Proposal, only a limited number of them may be considered as personal data (essentially names of natural persons, when they represent an entity, and names and addresses of legal representatives of entities established outside the Union).

12. The EDPS observes that the Proposal foresees in publication of the address of a designated legal representative of an entity referred to in Article 3(1) that is established outside the Union . However, the Proposal does not provide for the publication of the address of the place of establishment of the entity referred to in Article 3(1) . The EDPS therefore recommends reassessing whether the publication of the address of a legal representative is necessary to achieve the envisaged objective. If so, the choice to make available the address of the representative (and not that of the entity referred to in Article 3(1)) should be duly justified.

13. The EDPS welcomes that Article 12(3) of the Proposal provides for the possibility to limit partially or fully public access to those data, where the entity demonstrates that the limitation is justified on grounds of an overriding legitimate interest, ‘including a serious risk that the publication would expose an individual to a violation of their fundamental rights’. The EDPS understands that the enumeration of the fundamental rights mentioned in Article 12(3) is not intended to be exhaustive .

14. Paragraph 4 of Article 12 also specifies that any decision taken by a supervisory authority on an application for a derogation from the publication shall be subject to judicial redress in the Member State of registration.

15. In light of the above, the EDPS is generally satisfied that the safeguards provided by the Proposal to limit the publication of personal data are sufficiently detailed and founded to support the legitimacy of the objective pursued, and meet the requirements of necessity and proportionality.

4. Roles and responsibilities

16. The EDPS recalls that the concepts of controller, joint controller and processor play a crucial role in the application of data protection law, since they determine who is responsible for compliance with different data protection rules, and how data subjects can exercise their rights in practice.

17. Against this background, the EDPS welcomes the designation, in Article 9(2) of the Proposal, of the national authorities of Member States as ‘controllers within the meaning of Article 4, point 7 of Regulation (EU) 2016/679’, when maintaining national registries for the purpose of ensuring transparency of interest representation activities carried out on behalf of third countries.

18. The EDPS also notes that Article 15 of the Proposal provides that Member States shall designate public authorities responsible for the supervision and enforcement of the proposed Directive. These supervisory authorities should cooperate both at national and at Union level, and exchange information with the Commission, which may imply the processing of personal data. The EDPS welcomes in this context the provision included in Article 18(4), according to which these authorities ‘shall act as controllers within the meaning of Article 4, point 7 of Regulation (EU) 2016/679, and the Commission shall act as a controller within the meaning of Article 3, point 8 of Regulation (EU) 2018/1725 with respect to their own data processing activities’.

5. Conclusions

19. In light of the above, the EDPS is generally satisfied with the provisions of the Proposal laid down to ensure the protection of personal data processed in the context of the general objective of transparency of interest representation activities carried out on behalf of third countries, and makes the following recommendation: - reassess whether the publication of the information in Annex I, point 1, point (f)(ii), as provided for by Article 12(1)(a) of the Proposal, is necessary. Brussels, 6 February 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7