Proposal for a Regulation of the European Parliament and of the Council on the financial rules applicable to the general budget of the Union (recast)

7 July 2022

Opinion 14/2022

on the Proposal for a Regulation of the European Parliament and of the Council on the financial rules applicable to the general budget of the Union (recast)

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Commission Proposal for a Regulation of the European Parliament and of the Council on the financial rules applicable to the general budget of the Union (recast). This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the draft Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 16 May 2022, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on the financial rules applicable to the general budget of the Union, amending the Financial Regulation. The EDPS notes that the Proposal aims to improve the quality and interoperability of data on recipients of Union funding and on those ultimately benefitting, directly or indirectly, from Union funding in order to effectively prevent, detect, investigate and correct frauds or remedy irregularities.

The EDPS fully supports the goals of the Proposal, including the increased use of digitalisation to better protect EU financial interests and to combat fraud and other irregularities. While processing of personal data may be necessary to achieve this goal, it is incumbent upon the EU legislator to ensure that any interference with the right to data protection remain limited to what is strictly necessary and proportionate to the objectives pursued.

The EDPS welcomes that the Proposal aims to establish the categories of data that will be processed in order to achieve the Proposal’s objectives. The EDPS understands, however, that the process of data-mining and risk-scoring will not be limited to the data explicitly identified by the Proposal and that those data would be compared with data from other sources. The EDPS considers it necessary to explicitly identify all the categories of personal data to be processed, as well as the sources of those data. Appropriate safeguards to ensure the quality and accuracy of those data should also be put in place, particularly in circumstances where those other data would be collected from third parties.

The EDPS observes that no additional information in the Proposal is provided as regards to the IT system itself. Therefore, he recommends clarifying the type of the IT system to be used, in particular whether the Commission plans to base the system on the already existing IT system “Arachne” or to create a completely new IT system. Regardless of the use of existing structures, the EDPS would like to remind that appropriate safeguards need to be established and introduced in the architecture of this IT system, in line with the general data protection rules applicable to the processing of personal data. This should be well reflected upon in the design and development phase of the IT system, in line with the requirement of data protection by design.

The EDPS also strongly recommends the co-legislator to clearly define the maximum duration for which personal data referred to may be stored and made available in the single integrated IT system for data-mining and risk-scoring provided by the Commission.

Regarding publication of relevant information concerning all recipients of funds financed from the EU budget, the EDPS positively notes the efforts to made to balance the principle of transparency against the interference with the right of the recipients concerned to respect for their private life in general and to the protection of their personal data by exempting recipients from publication of their personal data if certain conditions would be met (threshold in terms of the amount of aid received, nature of the measure, risks for the rights and freedoms etc.).

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 16 May 2022, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on the financial rules applicable to the general budget of the Union (recast) (‘the Proposal’), amending the Financial Regulation .

2. The objective of the Proposal is to align the Financial Regulation with the 2021-2027 Multiannual Financial Framework (MFF) package, to maintain a “single rule book” governing the expenditure of the Union, meaning that all general financial rules are included in the Financial Regulation. In addition, the Proposal includes targeted improvements and simplifications which have been identified since the entry into force of the 2018 Financial Regulation. The Proposal also aims to increase the use of digitalisation to better protect EU financial interests, to better contribute to the achievement of the EU policy objectives and to achieve additional simplification for recipients of Union funds .

3. The present EDPS Opinion is issued in response to a consultation by the European Commission of 16 May 2022, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 257 of the Proposal. In this regard, the EDPS also positively notes that he had been informally consulted pursuant to recital 60 EUDPR.

2. General remarks

4. The Financial Regulation lays down the principles and general financial rules for establishing and implementing the EU budget and controlling EU finances. This Proposal amending the Financial Regulation comes after the adoption of the MFF package, to further improve the rules to be used in the implementation of the 2021-2027 programmes and instruments, and beyond. The Proposal reflects certain derogations to the current Financial Regulation that the Union legislator decided during the MFF negotiations.

5. The EDPS acknowledges the objectives pursued by this Proposal, namely targeted amendments to maintain a single rulebook governing the expenditure of the Union and appreciates that he has been consulted on this Proposal. Nevertheless, he would like to point out and regret that he had not been consulted during the legislative procedure on the Financial Regulation itself, prior to this Proposal for a recast of the same Regulation, given that the Financial Regulation itself already introduced provisions having an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data .

6. Although the current Proposal introduces a number of changes to the provisions of the Financial Regulation, the focus of this Opinion is on two provisions, most relevant from the data protection point of view. In that regard, the EDPS notes that Article 36 of the Proposal introduces an obligation, for the different bodies implementing the EU budget, to record data on the recipients of EU funding (including their beneficial owners) and to use a single integrated IT system for data-mining and risk-scoring to analyse those data with a view of combatting fraud, corruption, conflicts of interest, double funding and other irregularities. In addition, the EDPS takes note of Article 38 of the Proposal aiming to ensure transparency of the use of the Union budget, by publication of relevant information concerning all recipients of funds financed from the EU budget. Finally, as a matter of keeping legal references in the Financial Regulation up to date with current legislative developments, the EDPS appreciates that references to the repealed Regulation (EC) No 45/2001 are now to be replaced with references to EUDPR.

7. The EDPS supports the goals of the Proposal, including the increased use of digitalisation to better protect EU financial interests and to combat fraud and other irregularities. While processing of personal data may be necessary to achieve this goal, it is incumbent upon the EU legislator to ensure that any interference with the right to data protection remain limited to what is strictly necessary and proportionate to the objectives pursued. In accordance with the established case law of the Court of Justice of the European Union (“CJEU”), any limitation on fundamental rights, including the right to the protection of personal data, implies that the legal basis which permits interference with those rights must itself define the scope of the limitation of the exercise of the right concerned. A measure enabling such interference must provide for clear and precise rules on the scope and application of the measure in question and establish minimum requirements to ensure that the persons whose personal data have been transmitted have sufficient guarantees to effectively protect their data against risks of misuse . In order to ensure that an interference is limited to what is strictly necessary, the legal basis in question should also clearly identify and circumscribe the personal data that may be processed and should indicate in a sufficiently clear and precise manner the databases concerned (at least in such a manner that would make such databases identifiable) .

3. Compulsory integrated IT system for data-mining and riskscoring

3.1. Purposes of the processing

8. The Proposal aims to improve the quality and interoperability of data on recipients of Union funding and on those ultimately benefitting, directly or indirectly, from Union funding in order to effectively prevent, detect, investigate and correct frauds or remedy irregularities . In that regard, the proposed amendments to Article 36 of the Financial Regulation provide for standardised electronic recording and storing of data on the recipients of Union funds and their beneficial owners, for the purposes of prevention, detection, correction and follow-up of fraud, corruption, conflicts of interest, double funding and other irregularities .

9. The Proposal would also establish an obligation to use a single integrated IT system for data-mining and risk-scoring provided by the Commission. The system would access and analyse data on the recipients of Union funds to facilitate risk assessment for the purposes of selection, award, financial management, monitoring, investigation, control and audit and contribute to effective prevention, detection, correction and follow-up of fraud, corruption, conflicts of interest, double funding and other irregularities .

3.2. Roles and responsibilities

10. The EDPS welcomes that Article 36(7) of the Proposal provides for a clear identification of the recipients of the data and entities who may make use of the IT system for data-mining and risk-scoring , as well as the designation of the Commission as a controller for the IT system.

11. The EDPS notes, that in line with Article 36(7), there are entities other than Commission that will be using and accessing the data within the exercise of their respective competences. Insofar as these entities would process personal data in accordance with their own tasks and obligations, the EDPS considers that these entities would likely (also) be acting as controllers. The EDPS therefore invites the co-legislator to further clarify in the Proposal the roles of the entities that would be using and accessing any personal data processed by the single integrated IT system for data-mining and risk-scoring.

3.3. Categories of personal data

12. Article 36(6) of the Proposal specifies certain categories of data to be recorded and stored electronically in an open, interoperable and machine-readable format and regularly made available in the single integrated IT system for data-mining and risk-scoring provided by the Commission. Specifically, the following categories of data shall be recorded, stored and made available: (a) the recipient’s full legal name in the case of legal persons, the first and last name in the case of natural persons, their VAT identification number or tax identification number where available or another unique identifier at country level and the amount of funding. If a natural person, also the date of birth; (b) the first name(s), last name(s), date of birth, and VAT identification number(s) or tax identification number(s) where available or another unique identifier at country level of beneficial owner(s) of the recipients, where the recipients are not natural persons.

13. The EDPS welcomes that the Proposal aims to establish the categories of data that will be processed in order to achieve the Proposal’s objectives. The EDPS understands, however, that the process of data-mining and risk-scoring will not be limited to the data explicitly identified by the Proposal in Article 36(6) and that those data would be compared with data from other sources. The EDPS considers it necessary to explicitly identify all the categories of personal data to be processed, i.e. which data will be brought into connection with the identification data mentioned in Article 36(6) of the Proposal, as well as a clear indication of the sources of those data. Appropriate safeguards to ensure the quality and accuracy of those data should also be put in place, particularly in circumstances where those other data would be collected from third parties.

14. A clear specification of the categories of personal data and the databases with which those personal data may be combined (or compared) is necessary in order to establish that the processing of personal data in the context of the integrated IT system for data-mining and risk-scoring is limited to what is strictly necessary.

15. Finally, the EDPS would like to point out that the storage and processing of a variety of data categories in a single integrated IT system creates risks. To minimise these risks, due consideration must be given to the requirements of data minimisation, data protection by design, as well as security. The EPDS regrets that the impact assessment accompanying the Proposal does not contain sufficient elements that would demonstrate the necessity of the envisaged approach. In particular, the current reference to an open, interoperable and machine-readable format of data, which are to be made available in the single integrated IT system for data-mining and risk-scoring, does not allow for the EDPS to conclude whether, for the purpose of risk-scoring, a hit / no hit scenario would be a suitable one, less restrictive alternative to the creation of a separate single integrated IT system.

3.4. The nature of the IT system and the security aspects

16. The EDPS would like to point out that the newly added paragraph 7 of Article 36 of the Proposal, stipulates that the Commission shall be responsible for the development, management and supervision of this IT system. However, no additional information as regards to the IT system itself is provided. Therefore, the EDPS recommends clarifying the type of the IT system to be used, in particular whether the Commission plans to base the system on the already existing IT system “Arachne” or to create a completely new IT system. The EDPS would like to remind in this context that the controller in any event needs to review continuously the risks assessment as defined in Article 33(1) of the EUDPR, when changes are made either on the system itself or there were other developments affecting security. The requirement of data protection by design and by default should be taken into consideration both during the design of the system and when there are significant changes of the system.

17. Moreover, the same paragraph 7 of Article 36 of the Proposal states that the Commission should be responsible, among other, for “ensuring the security, integrity and confidentiality of data, the authentication of the users and for protecting the IT system against mismanagement and misuse”. While the EDPS welcomes the confirmation of responsibilities for information security, the EDPS recalls that the IT system must in any event take into account the obligation to security of personal data perspective under the EUDPR, as appropriate, and in particular to ensure compliance with its Article 33 .

18. In addition, regardless of the use of existing structures, the EDPS would like to remind that appropriate safeguards need to be established and introduced in the architecture of this IT system, in line with the general data protection rules applicable to the processing of personal data. This should be well reflected upon in the design and development phase of the IT system, in line with the principle of data protection by design. The current reference to an open, interoperable and machine-readable format of data, which are to be made available in the single integrated IT system for data-mining and risk-scoring, does not allow for the EDPS to conclude on the nature of the structure of the IT system or the fact that the principle of data protection by design has so far been applied in its design and development phase. In particular these concerns regard, but are not limited to, the fact that the Proposal does not define why the system is “interoperable”, with what it would be “interoperable”, under which circumstances, which actors would be involved and why it should allow for interoperability in the first place. In a similar manner, the Proposal does not clarify the “open” nature of the IT system by stating who should access it and for which purpose.

19. The EDPS therefore recommends, regardless of whether the Commission intends to make use of existing structures, to include in the Proposal itself a high level description of the tool, including data protection roles and responsibilities and relevant applicable safeguards. The EDPS also recommends further clarifying the types of processing and logic involved in the “data-mining and risk-scoring” envisaged by the Proposal.

20. The EDPS also notes that, in line with Article 38 of the Proposal, certain the data to be processed within the IT system is to be published on a website. However, some of the data, such as the VAT of a natural person, would not be made public. Provided that processing such categories of data is in fact necessary and proportionate, the EDPS suggests applying additional safeguards for those non-published types of data. For instance, pseudonymisation of data should be considered and encouraged.

21. Finally, the EDPS notes that the Proposal adds a new paragraph 2(d) to Article 36 of the Financial Regulation, which provides that prevention, detection, correction and follow-up of fraud, corruption, conflicts of interest, double funding and other irregularities would be achieved “through the electronic recording and storage of data on the recipients of Union funds including their beneficial owners, as defined in Article 3, point 6 of Directive (EU) 2015/849, and through the use of a single integrated IT system for data-mining and risk-scoring provided by the Commission to access and analyse those data”. The EDPS would like to point out that it is not clear from the Proposal whether this electronic recording and storage of data would be done within the IT system for data-mining and risk-scoring or the IT system would just have access to data stored somewhere else and suggests to clarify this ambiguity.

3.5. Storage duration

22. According to the storage limitation principle, personal data should be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. The period of time should be as short as possible in relation to the purpose pursued and must be justified so as to ensure that the storage is limited to what is strictly necessary for the purposes pursued. The EDPS strongly recommends the co-legislator to clearly define the maximum duration for which the data referred to in Article 36 of the Proposal may be stored and made available in the single integrated IT system for data-mining and risk-scoring provided by the Commission .

4. Publication of data on natural persons

23. The EDPS takes note of Article 38 of the Proposal aiming to ensure transparency of the use of the Union budget, by publication of relevant information concerning all recipients of funds financed from the EU budget. He would however, like to recall that the CJEU rejected the argument that the disclosure of personal data to the public serves such a significant goal that the objective of transparency would automatically prevail over the right to protection of personal data .

24. Moreover, Article 3(1) EUDPR defines personal data as ‘any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person’. Even the data concerning legal persons may therefore, in some cases be considered as personal data, as clarified by the CJEU . In these cases, the determining factor is whether the information ‘relates to’ an ‘identifiable’ natural person. Consequently, personal data would normally be processed in all cases where the information concerning the recipients of funds pertains to an identified or identifiable individual. The EDPS would also like to recall that the Court has additionally confirmed that the seriousness of the breach of the right to protection of personal data manifests itself in different ways for, on the one hand, legal persons and, on the other, natural persons . In that regard, the EDPS positively notes that the Proposal indeed differentiates the categories of data to be published depending on whether it would be a natural or a legal person .

25. The EDPS furthermore positively notes the fact that the Commission has taken into consideration alternative methods of publishing information on the recipients of funds that would be consistent with the principle of transparency while causing less interference to the recipients' rights to privacy and personal data protection . In that respect, the EDPS appreciates that Article 38 of the Proposal undertakes to balance the principle of transparency against the interference with the right of the recipients concerned to respect for their private life in general and to the protection of their personal data by exempting recipients from publication of their personal data if certain conditions would be met (threshold in terms of the amount of aid received, nature of the measure, risks for the rights and freedoms etc.) .

5. Conclusions

26. In light of the above, the EDPS makes the following recommendations: (1) to clarify the role of all entities that would be using and accessing any personal data processed by the single integrated IT system for data-mining and risk-scoring. (2) to clarify the type of the IT system to be used, in particular whether the Commission plans to base the system on the already existing IT system “Arachne” or to create a completely new IT system. (3) to explicitly identify all the categories of data concerned, i.e. which data will be processed/brought into connection with the identification data mentioned in Article 36 paragraph 6 of the Proposal, as well as the sources of those data. (4) introduce appropriate safeguards to ensure the quality and accuracy of data, particularly in case those other data would be collected from third parties. (5) regardless of whether the Commission intends to make use of existing structures, to include in the Proposal itself a high level description of the IT tool, including data protection roles and responsibilities and relevant applicable safeguards. (6) to apply additional safeguards for the non-published types of data. For instance, pseudonymisation of data should be considered. (7) to clarify whether electronic recording and storage of data would be done within the IT system for data-mining and risk-scoring or the IT system would only have access to data stored elsewhere. (8) to clearly define the maximum duration for which the data referred to in Article 36 of the Proposal may be stored and made available in the single integrated IT system for data-mining and risk-scoring provided by the Commission. Brussels, 7 July 2022 [e-signed] Wojciech Rafał Wiewiórowski 12