EDPS Opinion 13/2024 on the Proposal for a Regulation on the screening of foreign investments in the Union and repealing Regulation (EU) 2019/452

15 March 2024

Opinion 13/2024

on the Proposal for a Regulation on the screening of foreign investments in the Union and repealing Regulation (EU) 2019/452

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3) ‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on the screening of foreign investments in the Union and repealing Regulation (EU) 2019/452 of the European Parliament and of the Council . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 24 January 2024, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on the screening of foreign investments in the Union and repealing Regulation (EU) 2019/452 of the European Parliament and of the Council (‘the Proposal’).

The aim of the Proposal is to enhance the EU’s security and public order in the context of foreign direct investments and investments made by foreign investors through an undertaking established in the EU. In particular, the Proposal aims to provide legal certainty for national screening mechanisms on grounds of security and public order, to increase consistency between the national screening mechanisms and to improve the efficiency and effectiveness of the cooperation mechanism between Member States and the Commission on foreign investments.

The EDPS welcomes the attention paid to the data protection aspects of the Proposal. In particular, the EDPS welcomes that the Proposal clearly sets out the categories of personal data concerned and the purposes for which they may be processed. The EDPS also welcomes that the Proposal mentions the protection of personal data as a factor to be assessed when screening the foreign investment.

As regards the processing of personal data in the context of the cooperation mechanism, the EDPS recommends specifying the roles of the Commission and of the Member States as joint controllers in the enacting terms of the Proposal. In addition, the EDPS recommends specifying the maximum storage periods for personal data processed for the screening of foreign investments by Member States, as well as for personal data processed for ensuring the effectiveness of the cooperation mechanism. Alternatively, the maximum storage periods could also be specified by way of an implementing act.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 24 January 2024, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on the screening of foreign investments in the Union and repealing Regulation (EU) 2019/452 of the European Parliament and of the Council (‘the Proposal’). The Proposal is accompanied by two annexes: Annex I provides a list of projects and programs of Union interest; Annex II lists the technologies, assets, facilities, equipment, networks, systems, services and economic activities of particular importance for the security or public order interests of the Union.

2. The objective of the Proposal is to ensure that all Member States have a screening mechanism that allows the assessment of transactions before they are completed, and to address key shortcomings in the effectiveness and efficiency of the cooperation mechanism between all national authorities and the Commission . The Explanatory Memorandum notes that despite Regulation (EU) 2019/452 (‘the FDI Screening Regulation’) , and the increasing adoption of screening mechanisms at Member State level, ‘a significant share of Foreign Direct Investments (‘FDIs’) in the EU still goes to Member States that do not have a screening mechanism and this leaves vulnerabilities because potentially critical FDIs remain undetected.’

3. The Proposal would establish a cooperation mechanism to enable Member States and the Commission to exchange information on foreign investments, assess their potential impact on security or public order, and identify potential concerns that shall be addressed by the Member State that is screening the foreign investment.

4. The EDPS recalls that he previously issued formal comments on the Proposal that led to the FDI Screening Regulation currently in force.

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 24 January 2024, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in the preamble of the Proposal. In addition, the EDPS positively notes that he was already previously informally consulted pursuant to Recital 60 of EUDPR.

2. General remarks

6. The screening of foreign investments by the Member States and the exchange of FDI information under the Union cooperation mechanism provided by the Proposal would regularly involve processing of personal data. A clear example are the notifications that would be required under the Proposal, which may include the names and addresses of natural persons involved in a transaction . In this respect, the EDPS recalls that the official title of a legal person can also constitute personal data, in particular when it identifies one or more natural persons . Moreover, the description of the ownership structure of a legal person (be it the foreign investor or the European target), which the Member States should make available to the Commission and the Member States in the context of notification and own initiative procedures under Chapter 3 of the Proposal, may contain personal data.

7. The EDPS welcomes the clarification in the Proposal that the EUDPR and the GDPR apply to the processing of personal data by the Commission and the Member States respectively, and that processing of personal data under the Proposal should comply with these Regulations .

3. Information requirements

8. The EDPS notes that the Commission would be required to adopt implementing acts to set out the forms to be used by Member States to provide the type of information required under the notification of foreign investments referred to in Article 5 and the request for information referred to in Article 9(5) of the Proposal . Since such forms would include fields containing personal data (such as names and contact details of investors), the EDPS reminds the Commission of its obligation pursuant to Article 42(1) EUDPR to consult the EDPS when preparing implementing acts that would affect the protection of individuals’ rights and freedoms with regard to the processing of personal data.

4. International cooperation with responsible authorities of third countries

9. The EDPS observes that Article 15 of the Proposal would allow Member States and the Commission to cooperate with the responsible authorities of third countries on issues relating to the screening of investments on grounds of security and public order. The EDPS recalls that any transfer of personal data that would take place in the context of such cooperation would need to comply with the GDPR and the EUDPR, as applicable, including the rules on transfers of personal data to third countries.

5. Purpose limitation

10. The EDPS positively notes that Article 17(2) of the Proposal specifies that processing of personal data pursuant to the Proposal must be carried out ‘only when necessary for the screening of foreign investments by Member States and for ensuring the effectiveness of the cooperation provided for in this Regulation’. The EDPS welcomes this specification, which is in accordance with the purpose limitation principle laid down in the GDPR and in the EUDPR .

6. Storage periods

11. The EDPS notes that the Proposal specifies that personal data related to the implementation of the Proposal must be kept only for the time necessary to fulfil the purposes for which they were collected . However, the EDPS considers that fixed storage periods should be defined, following the expiry of which personal data should be deleted by the Member States and the Commission, as applicable .

12. Storage periods should be defined in a manner which is proportionate to the purposes pursued. As a result, it may be appropriate to define different storage periods for (a) personal data processed for the screening of foreign investments by Member States, and (b) for personal data processed for ensuring the effectiveness of the cooperation mechanism provided for in the Proposal.

13. The EDPS recalls that, in accordance with the case law of the Court of Justice of the European Union , the determination of a storage duration must be based on objective criteria and be as short as possible. The EDPS recommends including maximum storage periods in the enacting terms of the Proposal, and to include the justification for those storage periods in a recital of the Proposal. Alternatively, the maximum storage periods could be further specified by way of an implementing act.

7. Joint controllership for the cooperation mechanism

14. Having regard to the cooperation mechanism , the EDPS recommends specifying, in the enacting terms of the Proposal, the roles of the Commission and of Member States’ competent authorities as joint controllers having regard to the processing of personal data in the context of the cooperation mechanism. While detailed arrangements to ensure compliance with data protection requirements may be further defined by way of a joint controller arrangement , the EDPS points out that the roles of the Commission and of the Member States should be clearly specified in the Proposal as such.

8. Protection of personal data, security and public order

15. The EDPS welcomes that potential effects on the protection of personal data are included among the factors that the Member States or the Commission must consider when determining whether a foreign investment is likely to affect security or public order under the Proposal , notably, the impact on “the protection of sensitive information, including personal data, in particular with regard to the ability of the foreign investor to access, control, and otherwise process such personal data”. This represents an important acknowledgement of the role of personal data as a critical asset in the geopolitical context, where control of sensitive data by foreign investors could negatively impact security and public order. The EDPS invites the co-legislators to keep this provision in the final text of the Regulation.

16. The EDPS welcomes that artificial intelligence technologies (including data analytics technologies) are included in Annex II of the Proposal , containing a list of technologies, assets, facilities, equipment, networks, systems, services and economic activities of particular importance for the security or public order interests of the Union.

17. The EDPS also appreciates that Article 19(2) of the Proposal would empower the Commission to amend Annex II via a delegated act considering, among others, the emergence of vulnerabilities in relation to access to or other forms of processing of sensitive information, including personal data, to the extent they are likely to negatively affect the security or public order interests of the Union .

9. Conclusions

18. In light of the above, the EDPS makes the following recommendations: (1) to clearly specify, in the enacting terms of the Proposal, the roles of the Commission and of the Member States as joint controllers having regard to the processing of personal data in the context of the cooperation mechanism; (2) to specify maximum storage periods for personal data processed for the screening of foreign investments by Member States, as well as for personal data processed for ensuring the effectiveness of the cooperation mechanism, and to include the justification for these maximum storage periods in a recital of the Proposal. Alternatively, such storage periods could be specified by way of an implementing act. Brussels, 15 March 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI