EDPS Opinion 14/2024 on the Proposal for a Directive on harmonised river information services (RIS) on inland waterways in the Community

20 March 2024

Opinion 14/2024

on the Proposal for a Directive on harmonised river information services (RIS) on inland waterways in the Community

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’. Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’. This Opinion relates to the Proposal for a Directive amending Directive 2005/44/EC on harmonised river information services (RIS) on inland waterways in the Community .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 26 January 2024, the European Commission issued the Proposal for a Directive of the European Parliament and of the Council amending Directive 2005/44/EC on harmonised river information services (‘RIS’) on inland waterways in the Community (‘the Proposal’).

The EDPS acknowledges the importance of providing an efficient framework for the deployment and use of RIS. He also positively remarks that one of the objectives of the Proposal is to address data protection concerns.

The EDPS understands that the Proposal does not aim to provide for an obligation to exchange personal data currently through RIS. However, the RIS Directive enables the exchange of data and, according to the impact assessment, certain elements (such as data relating to the position of the vessel or the identification number of vessel) may be considered as falling within the definition of personal data under the GDPR.

In this regard, the EDPS recalls that any legislative proposal that implies the processing of personal data must comply with the Charter of Fundamental Rights of the European Union, including the right to respect for private and family life and the right to protection of personal data. The EDPS considers that the provisions of the Proposal, in their current form, are too broad and general to adequately address the data protection concerns raised by RIS deployment in the Member States. In addition, the Proposal does not clearly indicate when the performance of RIS entails the collection and processing of personal data.

Against this background, the EDPS recommends to clearly indicate in the Proposal when the performance of RIS will lead to the collection and processing of personal data and what is the legal basis that justifies such processing. In addition, the Proposal should maintain the obligation for the Member States to provide an explicit legal basis in the Member States law. In other words, the EDPS recommends to maintain (not delete) Article 9(1) of the current Directive 2005/44/EC, which imposes on the Member States the obligation to ensure that processing of personal data necessary for the operation of RIS is carried out in accordance with the data protection legal framework.

In addition, the EDPS considers that both the purposes of the processing and the categories of personal data in the context of the deployment of RIS should be clearly delineated by the Proposal. Provided that the interference is not serious, the categories of personal data could also be further specified in the implementing or delegated acts that would be adopted in line with the explicit empowerment given to the Commission in the Proposal. Finally, as regards the RIS platform, the EDPS recommends clearly assigning the roles of the competent authorities as controllers in the enacting terms of the Proposal.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 26 January 2024, the European Commission issued the Proposal for a Directive of the European Parliament and of the Council amending Directive 2005/44/EC on harmonised river information services (‘RIS’) on inland waterways in the Community (‘the Proposal’).

2. The general objective of the Proposal is to amend the Directive 2005/44/EC (‘the RIS Directive’) in order to provide an efficient framework for the deployment and use of RIS. The specific objectives are: – to ensure RIS data availability and harmonised standards; – to facilitate the integration of inland water way (‘IWT’) into the multimodal chain; and – to ensure greater uptake and interoperability of digital solutions, and address data protection concerns .

3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 26 January 2024, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 26 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of the EUDPR.

2. General comments

4. The EDPS acknowledges the importance of providing an efficient framework for the deployment and use of RIS. The deployment of RIS on inland waterways supports the safety and efficiency of transport by inland waterways, and ultimately its sustainability, by increasing the efficiency of inland waterways operations. He also positively remarks that one of the objectives of the Proposal is to address data protection concerns .

3. Processing of personal data

5. According to the Explanatory Memorandum , the Proposal does not provide for an obligation to exchange personal data currently through RIS. Nevertheless, the RIS Directive enables the exchange of data and, according to the impact assessment, certain elements (such as data relating to the position of the vessel or the identification number of the vessel) may be considered as falling within the definition of personal data under the GDPR .

6. In this context, the EDPS recalls that personal data is any information that relates to an identified or identifiable living individual . An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number or location data.

7. In order to determine whether a natural person is identifiable, directly or indirectly, account should be taken of all the means likely reasonably to be used either by the controller, within the meaning of Article 4(7) of the GDPR, or by any other person, to identify that person, without, however, requiring that all the information enabling that person to be identified should be in the hands of a single entity . Thus, to be personal data, the information must (i) relate to a natural person and (ii) the controller or another person has means reasonably likely to identify that person.

8. In a recent judgement the Court of Justice of the EU (‘the Court’) further clarifies that when an identification number, in this case Vehicle Identification Number (VIN), is used as a mere alphanumeric code, it does not constitute personal data. However, it could become "personal" to someone who has access to it and has means enabling him to use it to identify the owner of the vehicle to which it relates. The Court found that "where independent operators may reasonably have at their disposal the means enabling them to link a VIN to an identified or identifiable natural person (…) that VIN constitutes personal data for them" .

4. Lawfulness of processing

9. The Impact Assessment specifies that the current RIS Directive is a legal framework providing for the technical requirements, specifications and conditions which ensure the electronic exchange of personal data if national or international regulations foresee such exchange. Currently, RIS is basically a platform for data exchange providing harmonised technical specifications for data, but not the legal basis on which some personal data is actually collected and has to be submitted (e.g. border regulations, police regulations, etc.) .

10. Pursuant to Recital 15 of the Proposal, Member States should exchange RIS related information to increase the efficiency of RIS and reduce reporting requirements. Where transmission and exchange of RIS related information for these purposes cannot be achieved without processing of personal data, Member States should ensure the lawfulness of the processing of those personal data in accordance with the GDPR .

11. The EDPS notes that Article 9(1) of the current Directive 2005/44/EC, which imposes on the Member States the obligation to ensure that processing of personal data necessary for the operation of RIS is carried out in accordance with the data protection legal framework, would be removed by the Proposal. In this regard, the EDPS recalls that any legislative proposal that implies the processing of personal data must comply with the Charter of Fundamental Rights of the European Union, including the right to respect for private and family life and the right to protection of personal data.

12. The EDPS considers that the provisions of the Proposal, in their current form, are too broad and general to adequately address the data protection concerns raised by RIS deployment in the Member States. In addition, the Proposal does not clearly indicate when the performance of RIS entails the collection and processing of personal data.

13. Against this background, the EDPS recommends to clearly indicate in the Proposal when the performance of RIS will lead to the collection and processing of personal data and what is the legal basis that justifies such processing. In addition, the Proposal should maintain the obligation for the Member States to provide an explicit legal basis in the Member States law. In other words, the EDPS recommends to maintain (not delete) Article 9(1) of the current Directive 2005/44/EC, which imposes on the Member States the obligation to ensure that processing of personal data necessary for the operation of RIS is carried out in accordance with the data protection legal framework. In this regard, the EDPS refers to draft Guidance for co-legislators on key elements of legislative Proposals , which offers practical advice on the main elements to consider with regards to legislative proposals that imply the processing of personal data.

14. Even if the Proposal does not seek to provide a legal basis for the processing of personal, the EDPS considers that both the purposes of the processing and the categories of personal data in the context of the deployment of RIS should be clearly delineated by the Proposal. Provided that the interference is not serious, the categories of personal data could also be further specified in the implementing or delegated acts that would be adopted in line with the explicit empowerment give to the Commission in the Proposal.

5. Roles and responsibilities

15. In line with the Explanatory Memorandum , the Proposal introduces an important change in the architecture of RIS, as it requires a central node for the exchange of information and the provision of services (‘RIS Platform’). Therefore, information now is not exchanged directly between the different users (like the vessel operator with inland ports) but is done through the platforms and functionalities of the RIS Platform.

16. According to the amended Article 4(5) Member States shall create, operate, use and maintain a single RIS Platform which provides fairway-, infrastructure-, traffic-, and transport related data. The RIS Platform shall be accessible for all RIS users and be the main platform for the exchange of RIS related information. The Commission, shall adopt implementing acts laying down the functional and technical specifications for the RIS platform.

17. The EDPS welcomes Recital 10 of the Proposal that specifies that Member States should designate one or more competent authorities responsible for operating RIS Platform and that these authorities are controllers for purpose of operating the RIS Platform. The EDPS recommends clearly assigning the role of the competent authorities as controllers also in the enacting terms part of the Proposal.

6. Implementing acts

18. According Article 4(5) of the Proposal, the Commission shall adopt implementing acts laying down the operational characteristics, roles and procedures for the RIS platform and identifying its operating entity, based on the principles for RIS technical specifications set out in point 7 of Annex II, to ensure their uniform implementation throughout the Union.

19. Furthermore, recital 16 states that in order to ensure that RIS users are supplied with the necessary information concerning navigation and voyage planning, and taking account of scientific and technical progress, the power to adopt acts in accordance with Article 290 TFEU should be delegated to the Commission in order to amend the minimum data requirements established in the Annex I to Directive 2005/44/EC.

20. In this regard, the EDPS reminds the Commission of its obligation to consult the EDPS when preparing delegated or implementing acts that would impact on the protection of individuals' rights and freedoms with regard to the processing of personal data pursuant to Article 42(1) of the EUDPR.

7. Conclusions

21. In light of the above, the EDPS makes the following recommendations: (1) to clearly indicate in the Proposal when the performance of RIS will lead to the collection and processing of personal data and what is the legal basis that justifies such processing; (2) to reinstate in the Proposal Article 9(1) of the current Directive 2005/44/EC, while replacing the reference in this Article to Directive 95/46 with a reference to the GDPR; (3) to clearly specify the purposes for which personal data may be processed in the context of the deployment of RIS; (4) to specify the categories of personal data in the context of the deployment of RIS directly in the Proposal or in the implementing or delegated acts that would be adopted in line with the explicit empowerment give to the Commission in the Proposal; (5) to clearly assign the role of the competent authorities as controllers in the enacting terms of the Proposal. Brussels, 20 March 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8