EDPS Opinion 12/2024 on the Proposal for a Regulation on the protection of animals during transport and related operations

5 March 2024

Opinion 12/2024

on the Proposal for a Regulation on the protection of animals during transport and related operations

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’. Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’. This Opinion relates to Proposal for a Regulation of the European Parliament and of the Council on the protection of animals during transport and related operations, amending Council Regulation (EC) NO 1255/97 and repealing Council Regulation (EC) NO 1/2005 .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 7 December 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on the protection of animals during transport and related operations, amending Council Regulation (EC) NO 1255/97 and repealing Council Regulation (EC) NO 1/2005.

The EDPS recognises the legitimate objective of the Proposal of ensuring animal protection and improving animal welfare, a value enshrined in Article 13 of the Treaty on the Functioning of the European Union.

The EDPS considers that the Proposal adequately explains why the use of road vehicle tracking is necessary to ensure animal welfare, a public interest. The EDPS further notes that the Proposal limits the impact of the use of a positioning system on the fundamental rights of the driver by clearly defining which 4 location points will be recorded and be made available to national competent authorities. The EDPS recommends, however, to further clarify the scope of processing, by providing that not more data than records on the 4 location points will be collected by the Commission in order to be made available to national competent authorities. As the processing envisaged by the Proposal might still result in a high risk to the rights and freedoms of natural persons, the EDPS recalls that carrying out a data protection impact assessment may still be necessary.

The EDPS recommends assessing whether the storage duration of 6 years provided for authorisations, certificates, journey logs and road vehicle position records is necessary for the purposes it aims to achieve, and whether such periods can be shortened.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 7 December 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on the protection of animals during transport and related operations, amending Council Regulation (EC) NO 1255/97 and repealing Council Regulation (EC) NO 1/2005 (‘the Proposal’).

2. The Proposal aims to contribute to sustainable agricultural and food production by ensuring a higher level of animal welfare, and avoiding distortions on the internal market, thereby contributing to a shift towards an economically, environmentally, and socially sustainable food system, as set out in the Farm to Fork strategy . The specific objectives of the Proposal are, among others, to: • reduce animal welfare problems linked to long journeys and repetitive unloading and re-loading linked to several rest periods; • ensure that animals have more space when transported; • improve the conditions of transport of vulnerable animals; • avoid exposing animals to extreme temperatures; • facilitate enforcement of EU rules on the protection of animals, including trough digitalisation; • better protect animals exported to non-EU countries; • better protect cats and dogs transported in connection with an economic activity .

3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 10 January 2024, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 57 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

2. General remarks

4. The EDPS recognises the legitimate objective of the Proposal of ensuring animal protection and improving animal welfare, a value enshrined in Article 13 of the Treaty on the Functioning of the European Union (‘TFEU’) . The EDPS understands that additional legislative measures as provided for by the Proposal, taking into account technological development, are necessary to this end.

5. The Proposal would entail processing of personal data by the Commission and/or national competent authorities. Such processing is necessary to assess, among others, the 7 8 9 application for an authorisation or certificate , journey logs , and to carry out official controls . It would entail the processing personal data of e.g. the organiser, transporter, person in charge, or driver involved in animal transport.

6. Any processing of personal data pursuant to the Proposal must take place in accordance with data protection legislation, and must among others be limited to what is necessary and proportionate in relation to the objectives it pursues. The EDPS therefore welcomes the reference to the GDPR and EUDPR in recital 35 of the Proposal.

3. Personal data in authorisations, journey logs and certificates

3.1. Categories of personal data

7. The Proposal provides for the application of authorisations and certificates and requires the submission of journey logs and certain additional information upon arrival at the place of destination to competent authorities. The Annexes to the Proposal provide forms to be filled in by e.g. organisers, transporters, drivers, or keepers at the place of destination. The required information may include personal data such as name and address, name of the person in charge, telephone number, email address, and authorisation number. The EDPS welcomes that the required personal data is limited and does not go beyond what is necessary to assess and review applications and submitted information.

3.2. Roles and responsibilities

8. The Proposal provides that the Commission and the Member States shall be joint controllers for the processing of personal data for the authorisations referred to in Chapter II, the journey logs referred to in Chapter IV and the certificates referred to in Chapter VIII . The EDPS notes that Article 11 of Commission Implementing Regulation (EU) 2019/1715 provides the responsibilities of the Commission and the Member States. The EDPS welcomes that the Proposal allocates the roles and the responsibilities within the meaning of data protection law.

9. The EDPS notes, however, that for certain processing of personal data, no role within the meaning of data protection law has been allocated in the Proposal. In particular, the forms set out in sections 5-6 of Annex V, regarding an application for a certificate of approval to be submitted by the transporter to the competent authority in TRACES , also include personal data. In addition, sections 3 and 5 of the journey log as set out in point 1 of Annex III, to be completed by the driver or attendant and the keeper at the place of destination, include personal data . The EDPS questions why the certificates referred to in Chapter III, and the journey log as referred to in Articles 20 and 25, are not included in Article 51(1) of the Proposal, which sets out the role of joint controllers of the Commission and the Member States for personal data processed in TRACES. The EDPS understands that the Commission and Members States are also joint controllers for such personal data in TRACES, in accordance with Article 11 of Commission Implementing Regulation (EU) 2019/1715. The EDPS therefore considers that Chapter III and Articles 20 and 25 should also be listed in Article 51(1) of the Proposal.

3.3. Storage duration

10. The EDPS notes that the Proposal provides for storage durations for personal data related to authorisations referred to in Chapter II and certificates referred to in Chapter VIII, and journey logs in Chapter IV.

11. The EDPS recalls the storage limitation principle, requiring that data is kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed . In practice, this means that a maximum, proportionate storage duration, should be determined, following the expiry of which the personal data should be deleted.

12. The Proposal provides that personal data related to authorisations and certificates shall be retained by TRACES throughout the validity of those authorisations and certificates and for a period of 6 years after their expiry or withdrawal .

13. The EDPS has not found a justification why the 6 years retention period of personal data related to authorisations and certificates is necessary . Therefore, the EDPS recommends to assess whether a shorter storage duration than 6 years would be sufficient to achieve the envisaged purpose, or to provide a justification of why a retention period of 6 years after expiry or withdrawal or an authorisation or certificate would be necessary (e.g., by way of a recital).

14. Journey logs for long journeys and short journeys to third countries are retained in TRACES for a maximum period of 6 years , and for short journeys within the Union for a period 6 years, for subsequent official controls .

15. Regarding journey logs, recital 34 provides that ‘[t]he retention period of these data should be 6 years so that these data are accessible to the competent authorities, in particular with a view to checking whether the organiser or transporter fulfils the conditions required in order to obtain a renewal of an authorisation after the expiry of the 5-year period of validity’.

16. The EDPS understands that the retention of journey logs for long journeys and short journeys to third countries, and for short journeys within the Union, is necessary for official controls and to assess whether a renewal of an authorisation may be granted.

17. With regard to retention for official controls subsequent to the journey, the EDPS recommends to assess how long after the finalisation of the journey controls generally take place, and based on such period, whether a shorter storage period than (maximum) 6 years would be sufficient for control purposes.

18. With regard to storage of journey logs to assess the renewal of an authorisation, the EDPS recommends assessing whether fewer data may be retained, e.g. only journey logs related to an official control that demonstrated abnormalities . Moreover, he understands that the start of the storage period may be linked to the moment of expiry of the validity of the authorisation. Under the Proposal, however, journey logs are retained for 6 years as of the moment they are entered into TRACES . Consequently, journey logs related to a journey carried out at the beginning of the validity of the authorisation are retained for a shorter period after expiry of the authorisation, than journey logs related to journeys carried out at the end of the validity of the authorisation.

19. The EDPS recommends either providing further justification why the proposed retention scheme would contribute to the assessment or the conditions for renewal of an authorisation, or to link the storage period to the expiry of the authorisation. In the latter case, journey logs collected during the validity period of an authorisation could be stored for a certain period (e.g. 1 year) after expiry of such authorisation. In any event, the future Regulation should limit the storage period to what is necessary for the assessment of a renewal application, and should provide a justification thereof. For example, if renewal applications generally find place within 1 year after expiry, such storage period may be sufficient to achieve the envisaged purpose.

4. Positioning systems of means of transport by road

4.1. Risks for individuals

20. The Proposal provides that means of transport by road shall be equipped with a positioning system . It defines ‘positioning systems’ as systems of infrastructures providing global, continuous, accurate and guaranteed timing and positioning services needed for the purpose of this Regulation .

21. The position system shall record the position of road vehicles on short intervals and be operational during the journey from the place of departure until arrival at the place of destination . The records obtained from the positioning systems of the means of transport shall be kept in an information system accessible to TRACES, to be established by the Commission (‘Commission information system) . After the completion of the journey, TRACES shall retrieve data from the Commission information system on the time when means of transport reached the following locations as provided by organisers when completing section 1 of the journey log as set out in point 1 of Annex III : (a) place of departure; (b) control posts; (c) exit point from the Union and border crossings between Member States; and (d) place of destination .

22. The EDPS considers that the tracking of road vehicles envisaged by the Proposal may interfere with the rights to privacy and data protection of the driver. Tracking road vehicles not only involves collecting data about the vehicle, it also entails processing of personal data of the driver using that vehicle (e.g. location data and other information about the movements of the driver). The tracking of the position of a road vehicle may give the driver the feeling of constantly being monitored or surveilled and may therefore be considered to be particularly intrusive. In order for in-vehicle tracking to be lawful under the EUDPR and GDPR, strict requirements must be met. The legitimate aim of using such technology may be to track or monitor the location of the vehicles, but it is important to ensure that the vehicle tracking should not be regarded as a method to track or monitor the movements or the whereabouts of drivers.

23. Considering that processing of records of the position of road vehicles under the Proposal shall generally entail the processing of personal data, as it reveals the location of the driver, any of such processing must take place in accordance with the EUDPR when carried out by the Commission, and with the GDPR when carried out by national competent authorities. The EDPS would like to particularly draw the attention to the importance of informing data subjects of the processing, to ensure transparency of the processing operations.

24. The EDPS recalls that where a type of processing of personal data, in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data . The EDPS considers that the type of processing envisaged by the Proposal is likely to result in a high risk to the rights and freedoms of natural persons and that a data protection impact assessment (‘DPIA’) is likely to be necessary before the processing commences. The EDPS considers that several criteria for assessing whether processing operations are likely to result in high risks are potentially met , considering that the processing may entail: • Systematic monitoring through tracking movements via location data; • Personal data processing on a large scale through TRACES and the Commission information system; • Innovative use of technological solutions that can involve novel forms of data collection, as the Commission has not yet decided what technology will be used for the positioning system ; and • Systematic profiling and analysis/predicting of data subjects’ performance/reliability at work with legal or similar effects, i.e. whether the driver respects the routes and timing to determine whether an authorisation should be renewed, in the event the driver acts as an organiser or transporter.

25. Such DPIA may for example be carried out in the context of the preparation of the implementing acts establishing technical protocols . The Proposal provides that the Commission shall, by means of implementing acts, establish the technical protocols to enable the positioning systems to communicate the position of the vehicle with a defined precision of its geographical location to the Commission information system. The EDPS recalls that any such technical protocols, allowing for processing of personal data for which the Commission is the controller , must comply with the EUDPR. The EDPS recalls that, when a proposal for an implementing act has a possible impact on the protection of personal data, the Commission is required to submit it to the EDPS for consultation in accordance with Article 42 EUDPR.

4.2. Scope of processing

26. The Proposal provides an explanation of the necessity of using a positioning system to effectively enforce the rules on journey duration to ensure animal welfare, a public interest. The preamble clarifies that limiting the length of the journey plays a fundamental role in the protection of animals during transport. In practice, the estimated duration of journey times in the initial planning are often exceeded, which can have serious detrimental effects on the welfare of the transported animals. As competent authorities currently lack the means to check the location of consignments during the journey, it is difficult for competent authorities to control that the actual journey duration corresponds to that declared and to target their controls and inspections. According to the Proposal, many of these challenges would to be solved with information gathered via an information system using of real-time positioning tools .

27. Recital 33 further clarifies that: “Accessing information concerning the time at which road vehicles have reached certain key points in the journey, such as control posts or place of destination, would allow competent authorities to strengthen and better plan and target their controls. They could in particular better detect transports that are exceeding maximum journey times, thus identifying transports that are more likely to end with animals in compromised state of welfare’ .

28. The EDPS considers that the Proposal limits the impact of the use of a positioning system on the fundamental rights of the driver by clearly defining which 4 location points will be available in TRACES , and by providing that the positioning system shall only be operational during the journey from the place of departure until arrival at the place of destination . The limitation of data elements and limitation in time contribute to the proportionality of such measure.

29. The EDPS recommends however to further clarify the scope of processing, as it is unclear which data will be included in the Commission information system. The Proposal provides that the positioning system ‘shall record the position of road vehicles on short intervals’ , and that ‘[t]he records obtained from the positioning systems of the means of transport shall be kept in an information system’ . The EDPS considers it unclear whether the Commission information system will include more position records than only the 4 locations that will be available in TRACES . Considering that for the purpose of official controls, position records of only 4 locations are necessary, it appears that there is no necessity to transfer more position records to the Commission information system, as such data shall only be available to the Commission for the purpose of retrieving the data in TRACES . Against this background, the EDPS considers that the future Regulation should further clarify the scope of the processing.

30. The EDPS welcomes that Proposal explicitly limits the purposes of the processing of data gathered by means of the positioning system. Specifically, the Proposal provides that the records obtained from the positioning systems recorded in the Commission information system shall only be accessible to the Commission, for the purpose of retrieving the locations of the 4 points of the journey identified in Article 24(5) in TRACES . The Proposal further provides that the data gathered by means of the real-time positioning system shall also be processed for the only purpose of performing official controls and other official activities as defined in Article 2 of Regulation (EU) 2017/625 .

4.3. Roles and responsibilities

31. The EDPS positively notes that the Proposal provides for the roles within the meaning of data protection legislation. According to the Proposal, the Commission shall be the controller for the purposes of the real-time tracking positioning systems . The EDPS understands that as soon as the data on the position of road vehicles recorded in the Commission information system is retrieved by TRACES , the Commission and Member States shall be joint controllers of such data, pursuant to Article 11 of Implementing Regulation (EU) 2019/1715.

4.4. Storage duration

32. Lastly, the EDPS notes that the Proposal provides for retention periods for recording of positioning data on short period intervals, which shall be retained in the Commission information system for a period of 6 years . Recital 34 provides that: ‘[p]ositioning data recorded in the information system connected to TRACES should only be recorded and kept for the purposes of official controls and other official activities linked to those controls. The retention period of these data should also be 6 years’ .

33. Similar as for the retention of journey logs, the EDPS considers it relevant to assess how long after the finalisation of the journey controls generally take place, and based on such period, whether a shorter storage period than 6 years would be sufficient to achieve the control purposes set out in recital 34. In addition, if no abnormalities are found in the position data records after the journey is finalised, and no further official controls and other official activities as defined in Article 2 of Regulation (EU) 2017/625 are to take place, the retention of such data for a period of 6 years may be longer than necessary. He considers that the future Regulation should provide a justification why the relevant storage period is necessary.

34. The EDPS considers it further necessary to clarify whether the records of position data available in TRACES shall be retained for the same period as the data in the Commission information system.

5. Implementing and delegated acts

35. The Proposal provides for several implementing and delegated acts. In addition to the implementing acts under Article 24(8) of the Proposal, referred to under paragraph 28 of this Opinion, it concerns, for example, Article 13(7) that provides for implementing acts regarding among others the establishment of an electronic database for the recording of inspections on livestock vessels for the purposes of this Article and the official controls performed under Regulation (EU) 2017/625.

36. In addition, Article 47(2) of the Proposal allows for implementing acts to update the template for journey logs in Annex III; Article 50 provides for implementing acts concerning rules for the issuance of electronic authorisations, certificates and journey logs and for the use of electronic signature; and Article 53(2) provides for implementing acts regarding specifications for the development of an application available to operators and competent authorities allowing the performance of administrative tasks in relation to the transport of animals.

37. The EDPS recalls that, when a proposal for a delegated or implementing act has a possible impact on the protection of personal data, the European Commission is required to submit it to the EDPS for consultation in accordance with Article 42 EUDPR.

6. Conclusions

38. In light of the above, the EDPS makes the following recommendations: (1) clarify the roles within the meaning of data protection law regarding the processing of personal data in the context of certificates referred to in Chapter III, and the journey logs as referred to in Articles 20 and 25, by including a reference to this Chapter and these provisions in Article 51(1) of the Proposal; (2) assess whether a shorter storage period than 6 years is sufficient for: 1) personal data related to the authorisations referred to in Chapter II and the certificates referred to in Chapter VIII, after expiry or withdrawal or an authorisation or certificate; 2) journey logs as provided for in Articles 15(6) and 16(2) of the Proposal; and 3) recording of positioning data on short period intervals as provided for in Article 51(6) of the Proposal. The EDPS considers that the future Regulation should include a justification for the storage period; (3) clarify that the Commission information systems as referred to in Article 24(3) of the Proposal will include only position records of the locations provided for in Article 24(4) of the Proposal; and; (4) clarify whether the recording of positioning data on short period intervals available in TRACES shall be retained for the same period as the position data in the Commission information system (6 years), as provided for in Article 51(6) of the Proposal. Brussels, 5 March 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 12