EDPS Opinion on the Proposal for a Regulation on EU geographical indications for wine, spirit drinks and agricultural products, and quality schemes for agricultural products

18 July 2022

Opinion 15/2022

on the Proposal for a Regulation on European Union geographical indications for wine, spirit drinks and agricultural products, and quality schemes for agricultural products

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and the Council on European Union geographical indications for wine, spirit drinks and agricultural products, and quality schemes for agricultural products, amending Regulations (EU) No 1308/2013, (EU) 2017/1001 and (EU) 2019/787 and repealing Regulation (EU) No 1151/2012. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the draft Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 2 May 2022, the European Commission adopted a Proposal for a Regulation on European Union geographical indications for wine, spirit drinks and agricultural products, and quality schemes for agricultural products, amending Regulations (EU) No 1308/2013, (EU) 2017/1001 and (EU) 2019/787 and repealing Regulation (EU) No 1151/2012 (‘the Proposal’).

The general goals of the Proposal are twofold: to ensure effective protection of intellectual property rights (IPR) in the Union - including efficient registration processes- to reward fairly producers for their efforts and to facilitate the take up of Geographical Indications (GIs) across the Union.

The EDPS positively notes that the Proposal determines the roles of the Commission and the competent authorities of Member States with regard to the processing of personal data in the procedures under this Proposal.

At the same time, the EDPS recommends explicitly indicating the role of the European Union Intellectual Property Office (EUIPO) as joint controller together with the European Commission. In addition, the EDPS recommends providing for an arrangement as envisaged by Articles 28 of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (EUDPR) and/or Article 26 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (GDPR). In this regard, the EDPS recommends including an empowerement to the Commission to adopt an implementing act to cover detailed arrangements to ensure compliance with data protection requirements.

The EDPS recommends identifying in the Proposal itself the different categories of personal data to be included in the supporting documentation accompanying the applications for registration, oppositions and official comments, extracts from the Union register and the single document. The Proposal should also indicate in which circumstances and/or conditions it is necessary to make which categories of personal data publicly available and clearly define for which objectives. Furthermore, to limit the exposure of personal data to the public, the EDPS recommends assessing whether it would be appropriate to put in place a procedure whereby only individuals who demonstrate a legitimate interest have access to additional categories of personal data, such as contact details.

Finally, the EDPS considers that the chosen data retention period for the documentation related to the cancellation of geographical indications should be further justified or reduced.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 2 May 2022, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on European Union geographical indications for wine, spirit drinks and agricultural products, and quality schemes for agricultural products, amending Regulations (EU) No 1308/2013, (EU) 2017/1001 and (EU) 2019/787 and repealing Regulation (EU) No 1151/2012 (‘the Proposal’).

2. The general objectives of the Proposal are: a) to ensure the effective protection of Intellectual Property Rights (‘IPR’) in the Union, including efficient registration processes and, b) to increase the uptake of Geographical Indications (‘GIs’) across the Union to benefit the rural economy .

3. The Proposal would modify the current legislative framework for GIs to harmonise those rules that are common to all sectors, notably the procedures to register a name or amend the product specification, protection of the names, and checks and enforcement . It also introduces the involvement of the European Union Intellectual Property Office (‘EUIPO’) in the registration procedure. More specifically, while the national level assessment would remain with the Member States, EUIPO would provide technical assistance to the Commission during the EU-level scrutiny of applications and oppositions .

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 23 May 2022, pursuant to Article 42(1) of EUDPR. In this regard, the EDPS invites the co-legislators to include an explicit reference to this consultation in one of the Recitals of the Proposal.

2. General remarks

5. The EDPS notes that the Proposal would provide for the processing of personal data, in particular where it is necessary to identify and contact individuals in the course of the procedures for registration, amendments to the product specification and cancellation of registration in respect of geographical indications, including scrutiny and opposition procedures .

6. Each procedure would consist of a ‘two-stage system’ at national and EU level. The Member States would be responsible for the first stage of the procedure, which would consist of receiving the application from the producer group, assessing it, including running a national opposition procedure and following the results of the assessment submitting the application to the Commission. The second stage would be at EU level, with the EUIPO providing assistance to the Commission for scrutinising the applications including running opposition procedures . The Commission would remain responsible for taking a decision on granting the traditional specialities guaranteed protection or not, as well as for approving Union amendments to the product specification of a registered geographical indication and cancelation of the registration of a geographical indication .

7. With regard to the involvement of the Agency, EUIPO would also be responsible for the operation of the Union register of geographical indications for wines, spirit drinks and agricultural products .

8. The EDPS welcomes the reference to the right to protection of personal data in recitals 6, 7 and 8 of the Proposal, as well as to the need for the Member States to comply with Regulation (EU) 2016/679 (‘GDPR’), and for the Commission to comply with the EUDPR. At the same time, the EDPS notes that no reference is made to EUIPO, although the tasks assigned to this agency would appear to also require the processing of personal data. Consequently, the EDPS recommends including an explicit reference to the roles and responsibilities of EUIPO with regard to the processing of personal data in the enacting terms of the Proposal, as well as in the relevant recital, as further elaborated in Section 3.1 below.

9. In addition, the EDPS notes that recital 7 refers to ‘owners of personal data’ while the intention is presumably to refer to the term ‘data subjects’ as defined in Article 4(1) GDPR and Article 3(1) EUDPR. The EDPS thus recommends replacing the term ‘owners of personal data’ by ‘data subjects’.

10. The EDPS also notes that the Proposal introduces the concept of ‘protected personal data’ in Articles 14(3), 24(3), 19(11) and 52(2), without further defining it. The EDPS highlights, in this regard, that the GDPR and the EUPDR do not define the term ‘protected personal data’. As a consequence, there is a risk that the use of such term would create a confusion on the scope of the relevant provisions and, more generally, on the interplay with the applicable data protection legal framework. The EDPS, therefore, recommends replacing the term ‘protected personal data’ by ‘personal data’, so as to enhance legal certainty and consistency of the applicable legal framework.

3. Specific remarks 3.1.Determination of roles and responsibilities

11. The EDPS positively notes that Article 3 of the Proposal aims to determine the roles of the Commission and the competent authorities of Member States under EU data protection law. Article 3(2) designates the Commission as ‘controller’ within the meaning of Article 3(9) of the EUDPR , while Article 3(3) designates the competent authorities of Member States as ‘controllers’ within the meaning of Article 4(7) of the GDPR. Each entity must be considered a controller in relation to the processing of personal data in the procedures for which they would be competent in accordance with the Proposal.

12. At the same time, the EDPS notes that the above-mentioned Article makes no reference to EUIPO, although it is apparent from the wording of recital 6, as well as Articles 17(1) and 19(4), that the tasks assigned by the Proposal to this agency are likely to require the processing of personal data. In particular, this would appear to be the case where EUIPO 12 13 would provide assistance to the Commission with regard to the scrutiny and opposition procedures.

13. The EDPS recalls that the concepts of controller, joint controller and processor play a crucial role in the application of data protection law, since they determine who is responsible for compliance with different data protection rules, and how data subjects can exercise their rights in practice. Furthermore, in line with Articles 28 of the EUDPR and 26 of the GDPR, where two or more controllers together determine the purposes and means of the processing, they are considered to be joint controllers. In addition, the concept of controllership does not necessarily refer to one single entity, but can also involve multiple parties playing a role in a processing operation. As a result, and as confirmed by the Court of Justice of the European Union (CJEU) , each of the actors involved would have obligations under data protection law. In case of joint controllers, the distribution of tasks between them has to be specified by means of an arrangement between them.

14. Against this background, the EDPS is of the opinion that EUIPO would likely qualify as joint controller and thus recommends explicitly identifying the role of EUIPO as ‘joint controller’ together with the European Commission in Article 3 of the Proposal. Indeed, the overarching criterion to determine whether such joint controllership exists is the joint participation of two or more entities (in this case EUIPO and the Commission) in the determination of the purposes and means of a processing operation . This joint participation can take the form of a common decision, but also result from converging decisions by two or more entities, regarding the purposes and the essential means. Decisions can be considered as converging on purposes and means if they complement each other and are necessary for the processing to take place in such a manner that they have a tangible impact on the determination of the purposes and means of the processing. In this regard, a key element is whether the processing would not be possible without both parties’ participation. As a result, the EDPS considers that the Commission and EUIPO would be acting as joint controllers, given that the tasks that would be entrusted to EUIPO are inextricably linked with those falling within the responsibility of the Commission.

15. Furthermore, the EDPS also recommends providing for an arrangement as envisaged by Articles 28 of the EUDPR and/or Article 26 of the GDPR. In this regard, the EDPS invites the co-legislator to include an empowerment to the Commission to adopt an implementing act to cover detailed arrangements to ensure compliance with data protection requirements.

3.2.Categories of personal data

16. The EDPS recognises the need to process personal data of applicants, opponents, beneficiaries and natural persons delegated for certain official control tasks, for the correct management of the procedures of registration, amendment or cancellation of geographical indications and traditional specialities guaranteed, as outlined in recital 6 of the Proposal. In this context, the EDPS takes note of the attempt to minimise the exposure of personal data by introducing the possibility for the Commission to adopt implementing acts on the exclusion or anonymisation of protected personal data in relation to the documentation 16 17 accompanying the applications for registration , oppositions and official comments , 18 19 extracts from the Union register , and the single document .

17. At the same time, the EDPS recalls that, in line with the data minimisation principle laid down in Article 5(1)(c) of the GDPR and Article 4(1)(c) of the EUDPR, the collection of personal data should be limited to what is necessary to fulfil the purposes for which they are processed. Consequently, the EDPS considers that the different categories of personal data that are necessary to achieve the purposes of the processing as set out in the Proposal should be laid down in the Proposal itself, and not relegated to implementing provisions. The same consideration applies to the possibility of excluding or anonymising personal data, which would be of fundamental importance to ensuring compliance of the processing of personal data pursuant to the Proposal with the applicable EU framework, and should therefore be addressed directly in the Proposal.

18. Furthermore, the EDPS notes that pursuant to Article 3 of the Proposal the Commission and the Member States “[...] shall process and make public the personal data received in the course of the procedures for registration, approval of amendments, cancellation, opposition, granting of transitional period and control”. Recital 6 clarifies that “[...] the Commission and the Member States should be allowed to process such personal data and to disclose or make it public when this is needed to identify applicants [...], opponents [...], beneficiaries of a transitional period granted [...] and bodies delegated to carry out the verification on compliance with product specification”. The same recital generically mentions “public interest” and “transparency” to justify the disclosure and publication of personal data, such as personal names and contact details.

19. In accordance with Article 52(1) of the Charter, the CJEU has clarified that the legal basis which enables an interference to the rights recognised by the Charter must itself define the scope of the limitation on the exercise of the right concerned . In accordance with the principle of proportionality, any derogations from and limitations on the protection of personal data should apply only in so far as it is strictly necessary . Against this background, while the EDPS understands that it might be necessary to make certain categories of personal data public to achieve specific and clearly defined objectives of public interest, he underlines that the specific reasons of public interest that would justify such publication as necessary and proportionate should be clearly spelled out in the Proposal. Furthermore, the EDPS underlines that the objective of transparency cannot be invoked as an end in itself. In addition, the categories of personal data to be made publicly available should be clearly and exhaustively defined as well, taking into account the principle of necessity and proportionality . Therefore, the EDPS invites the co-legislators to define in the Proposal which are the necessary category(ies) of personal data that could be made publicly available for which specific objectives. Moreover, the EDPS is of the opinion that a procedure should be put in place to ensure that only individuals who demonstrate a legitimate interest have access to certain categories of personal data, such as contact details.

20. Finally, the EDPS notes that pursuant to Article 23(3) of the Proposal, the Union register of geographical indications would include the registered names and the geographical indication of the products and that the Commission may adopt implementing acts defining its content and presentation . In this context, the EDPS wishes to recall the need to be consulted on such implementing acts where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data, in accordance with Article 42(1) EUDPR.

3.3.Storage duration

21. Article 23(6) of the Proposal would provide for the retention of documentation related to the registration of geographical indications for the period of validity of the geographical indication and, in case of cancellation, for 10 years thereafter.

22. The EDPS recalls that pursuant to the principle of storage limitation, personal data can be kept ‘for no longer than is necessary for the purposes for which the personal data are processed’. The EDPS considers that a justification is needed to substantiate the proportionality of the chosen retention period, in particular as regards the retention of documentation related to the cancellation of the registration in respect of GIs. Absent further justification, the envisaged retention period of 10 years does not seem to comply with the requirement of storage limitation and should be reduced as far as the processing of personal data is concerned .

4. Conclusions

23. In light of the above, the EDPS: (1) welcomes the explicit designation of controllers in relation to the processing of personal data in the procedures laid down by the Proposal. (2) recommends defining explicitly the role of EUIPO as ‘joint controller’ together with the European Commission under Article 3 within the meaning of Articles 28 EUDPR and 26 GDPR. (3) recommends specifying in the Proposal the categories of personal data that are necessary for the correct management of the procedures of registration, amendment or cancellation of geographical indications and traditional specialities guaranteed so as to ensure that the processing of personal data is limited to what is directly relevant and necessary to accomplish the specified purposes of the Proposal. (4) recommends identifying in the Proposal which categories of personal data should be made publicly available and clearly define for which purposes and whether a procedure should be envisaged to ensure that only individuals who demonstrate a legitimate interest have access to additional categories of personal data, such as contact details. (5) absent further justification, recommends reducing the envisaged retention period for documentation related to the cancellation of GIs registration insofar as it concerns personal data. Brussels, 18 July 2022 (e-signed) Wojciech Rafał WIEWIÓROWSKI