EDPS Opinion on the Proposal for a Regulation as regards conversion of the Farm Accountancy Data Network into a Farm Sustainability Data Network (FSDN)

11 August 2022

Opinion 18/2022

on the Proposal for a Regulation as regards conversion of the Farm Accountancy Data Network into a Farm Sustainability Data Network

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council amending Council Regulation (EC) No 1217/2009 as regards conversion of the Farm Accountancy Data Network into a Farm Sustainability Data Network. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the draft Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 22 June 2022, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council amending Council Regulation (EC) No 1217/2009 as regards conversion of the Farm Accountancy Data Network into a Farm Sustainability Data Network.

The Proposal aims to regulate the processing of personal data in the context of the collection of farm level economic, environmental and social data as well as the further management and use of such data in the Farm Sustainability Data Network (‘FSDN’). In this regard, the EDPS welcomes the explicit references to the need to comply with both the GDPR and with the EUDPR. The EDPS also welcomes that the Proposal contains references to the GDPR and EUDPR when providing definitions of relevant terms such as ‘personal data’ and ‘processing’. However, in the interest of legal certainty, the EDPS strongly recommends revisiting the proposed definitions to ensure that both the GDPR and EUDPR are referenced in a systematic and consistent manner and to avoid introducing definitions of concepts already covered by those instruments.

The EDPS positively notes that in case individual data will be shared by the Commission or liaison agencies, the data of the farmers and all other individual details obtained pursuant to the Proposal would be anonymised or pseudonymised. Both anonymisation and pseudonymisation are important techniques to mitigate data protection risks. That being said, the EDPS considers it important to preserve a clear distinction between these concepts, as pseudonymous data can still be related to an identifiable individual and therefore qualifies as personal data.

As regards the publication of FSDN data, the EDPS recalls that any requirement to publish personal data should, in addition to being provided by law, also fulfil the other requirements arising from Article 52(1) of the Charter and Article 6(3) of the GDPR. The EDPS considers that the Proposal, in its current form, does not provide a specific reason of public interest justifying the publication personal data in identifiable form, even if the data were to be pseudonymised prior to publication. The EDPS therefore recommends specifying that only duly anonymised FSDN data may be made publically available.

The EDPS considers that certain specifications regarding the processing of personal data should be addressed by the Proposal itself rather than by way of delegated acts. In particular, the EDPS considers that the categories of personal data, as well as the specific purposes for which they may be processed, should be specified directly in the Proposal. Furthermore, the EDPS recommends specifying (criteria to determine) the retention period for the relevant categories of personal data and clarifying the roles of the actors involved. Finally, insofar as the Proposal aims to establish an IT system for the purpose of linking databases, the EDPS recommends including in the Proposal a high level description of the IT tool, including data protection roles and responsibilities and relevant applicable safeguards.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 22 June 2022, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council amending Council Regulation (EC) No 1217/2009 (‘the Regulation 1217/2009’) as regards conversion of the Farm Accountancy Data Network into a Farm Sustainability Data Network (‘the Proposal’).

2. The main objective of the Proposal is to amend Regulation 1217/2009 in order to convert the Farm Accountancy Data Network (‘FADN’) into a Farm Sustainability Data Network (‘FSDN’), with a view to collect farm level data on sustainability. The conversion would also contribute to the improvement of advisory services to farmers and benchmarking of farm performance.

3. Data are currently collected mainly to assess economic aspects of agricultural holdings, while there is a need to assess the overall sustainability of the holding, including environmental data linked to soil, air, water and biodiversity, as well as data covering the social dimension of farming. The conversion to a FSDN would enable the benchmarking of farm performance against regional, national and sectorial averages. Regarding accountancy data, accounts of agricultural holdings constitute the basic source for any assessment of incomes on agricultural holdings or study of their business operation. The information collected could also be used to provide personalised advisory services and feedback to farmers with the aim to improve the agricultural holdings’ sustainability .

4. The Proposal would also change the way the data is collected, providing inter alia for interoperability with other systems containing farm data, making it possible to combine data originally collected for different purposes. To this end, a unique farm ID would be introduced. In addition, the Proposal also mandates the publication of FSDN data.

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 22 June 2022, pursuant to Article 42(1) of EUDPR. In this regard, the EDPS invites the co-legislators to include an explicit reference to this consultation in one of the Recitals of the Proposal.

2. General remarks

6. The EDPS notes that the Proposal would regulate the processing of personal data in the context of the collection of farm level economic, environmental and social data as well as the further management and use of such data in the FSDN. In this regard, the EDPS welcomes the references, in Article 1(4) of the Proposal, to the need to comply with Regulation (EU) 2016/679 (‘GDPR’) and with the EUDPR during the processing, management and use of data.

7. Regulation 1217/2009 currently provides that the data obtained shall serve as the basis for the drawing up of reports by the Commission on the situation of agriculture and of agricultural markets, as well as on farm incomes in the Union. It also provides that those reports shall be made publicly available on a dedicated website . Article 1(3) of the Proposal would mandate the publication of data in more general terms, specifying that ‘FSDN data shall be made publicly available in a manner consistent with Articles 7 and 8 of the Charter of Fundamental Rights of the European Union and Regulations (EU) 2016/679 and 2018/1725’. While welcoming the references to the Charter, the GDPR and EUDPR, the EDPS considers that the Proposal does not provide an adequate legal basis for the publication of personal data, for the reasons further set out below .

8. The EDPS welcomes that Article 2 of the Proposal refers to the GDPR and EUDPR when providing definitions of relevant terms such as ‘personal data’ and ‘processing’. At the same time, the EDPS notes that the cross-references are not always consistent . Moreover, the Proposal also aims to define concepts which are closely related (but not identical) to terms and concepts already explained in the GDPR and EUDPR . In the interest of legal certainty, the EDPS strongly recommends revisiting the proposed definitions to ensure that both the GDPR and EUDPR are referenced in a systematic and consistent manner and to avoid introducing definitions of concepts already covered by those instruments.

9. Finally, the EDPS welcomes the fact the Proposal would extend measures to protect individuals with regard to the processing of their personal data to legal persons . The EDPS also recalls that data concerning legal persons concerning legal persons may, as clarified by the Court of Justice of the European Union , constitute personal data in certain cases. For the reasons set out in the previous paragraph, however, the EDPS considers that the extension of data protection guarantees to legal persons should be provided separately from the definition of personal data as such.

3. Specific remarks

3.1.Anonymisation and pseudonymisation

10. The EDPS welcomes Recital 8, 9 and Article 16(2) of the Proposal, which indicate that in case individual data will be shared by the Commission or liaison agencies, the data of the farmers and all other individual details obtained pursuant to the Proposal will be anonymised or pseudonymised, covering both natural and legal persons.

11. Both anonymisation and pseudonymisation are important techniques to mitigate data protection risks. It is important to note, however, there is a significant difference between these two concepts.

12. Article 4(5) of the GDPR and Article 3(6) of the EUDPR define ‘pseudonymisation’ as “the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person”. This means that the use of “additional information” can lead to the identification of the individuals, which is why pseudonymous personal data is still personal data .

13. Anonymous data, on the other hand, cannot be associated to specific individuals. In line with Recital 26 of the GDPR and Recital 16 of the EUDPR anonymous data is “information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable”. Once data is truly anonymous and individuals are no longer identifiable, the data will not fall within the scope of the GDPR or the EUDPR. An important factor is that the processing must be irreversible .

14. In summary, what differentiates pseudonymisation from anonymisation is that the latter consists in processing this data in a way that it can no longer be related to an identified or identifiable individual. Unlike anonymised data, pseudonymised data qualifies as personal data. A clear distinction between these two concepts should be preserved. Therefore, Article 6

15. Moreover, the EDPS considers that it is not clear whether Article 16(2) of the Proposal refers only to the exchange of data between the national liaison agencies and the Commission or also extends to the sharing of data with the general public or otherwise making it available for reuse. The EDPS therefore recommends further clarifying which type of data can be made available to whom.

3.2.Publication of FSDN data

16. As regards the publication of FSDN data, the EDPS recalls that any requirement to publish personal data should, in addition to being provided by law, also fulfil the other requirements arising from Article 52(1) of the Charter and Article 6(3) of the GDPR, and in particular must meet an objective of public interest and be proportionate to the legitimate aim pursued .

17. The EDPS underlines that the objective of transparency cannot be invoked as an end in itself . If there is a specific objective of public interest that would justify publication of personal data as necessary and proportionate, it should be clearly spelled out in the enacting terms of the Proposal as such . In addition, it must be borne in mind that an objective of general interest may not be pursued without having regard to the fact that it must be reconciled with the fundamental rights affected by the measure, by properly balancing the objective of general interest against the rights at issue .

18. As regards the objectives pursued, the EDPS notes that Article 1 provides that data obtained pursuant to this Regulation shall contribute to the assessment of EU agriculture’s sustainability. The EDPS considers that ‘contributing to the assessment of EU agricultural policy’ does not amount to a specific reason of public interest justifying the publication personal data in identifiable form, even if the data were to be pseudonymised prior to publication. Therefore, EDPS recommends specifying in Article 16 of the Proposal that only duly anonymised FSDN data may be made publically available.

3.3.Specifications concerning the processing of personal data

19. The EDPS notes that Article 4(3) of the Proposal would empower the Commission to adopt delegated acts on the data management process, in particular the farm ID, data storage, data quality and validation, use of data, access to and transmission of primary data, processing of primary data, combination of data with other data sources, procedure for ensuring availability of detailed and aggregated data, compatible data storage and exchange systems, review of refusal to provide data, obligations for end-users of scientific data and other interested parties. Moreover, in line with Article 4(4) of the Proposal, the Commission shall adopt implementing acts establishing and updating form and content of common regular and special surveys as well as methods and requirements for reusing and sharing data.

20. The EDPS considers that, insofar as the Proposal intends to allow the Commission to process, manage and use of personal data collected by the Member States, a certain degree of specification as regards the processing of personal data should be provided in the Proposal itself, and not only by way of delegated acts.

21. The EDPS recalls that, in line with the data minimisation principle laid down in Article 5(1)(c) of the GDPR and Article 4(1)(c) of the EUDPR, the collection of personal data should be limited to what is necessary to fulfil the purposes for which they are processed. Consequently, the EDPS considers that the categories of personal data should be specified directly in the Proposal. While the EDPS understands that the precise data to be collected will be set out in surveys and it may not be possible to fully detail each possible data category, the EDPS considers that only more detailed data fields (sub-categories of data) falling under the already defined categories of data should be specified through the adoption of delegated acts. When specifying the categories of data, the EDPS recalls first and foremost the need to comply with the requirements of necessity and proportionality .

22. The EDPS notes that in line with Article 1 of the Proposal the data obtained shall contribute to the assessment of EU agriculture’s sustainability. However, Recital 4 of the Proposal seems to indicate also other purposes that do not seem to be supported by the enacting terms of the Proposal (e.g., the provision the personalised advisory services). The EDPS recommends clearly specifying all the purposes for which personal data may be processed in the enacting terms of the Proposal.

23. Furthermore, pursuant to the principle of storage limitation, personal data can be kept “for no longer than is necessary for the purposes for which the personal data are processed” . Therefore, the Proposal should establish a retention period for the relevant categories of personal data, or at least laying down criteria to determine such periods, taking into account the purposes of the processing.

24. Finally, the EDPS recalls the need to be consulted on delegated acts where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data, in accordance with Article 42(1) EUDPR.

3.4.Determination of roles and responsibilities

25. The concepts of controller, joint controller and processor play a crucial role in the application of data protection law, since they determine who shall be responsible for compliance with different data protection rules, and how data subjects can exercise their rights in practice.

26. The EDPS recalls that in line with Articles 28 of the EUDPR and Article 26 of the GDPR “where two or more controllers determine the purposes and means of the processing, they shall be joint controllers”. This specification makes it clear that the concept of controllership does not necessarily refer to one single entity, but can also involve multiple parties playing a role in a processing operation. As a result, and as confirmed by the CJEU, each of the actors involved have obligations under data protection law . Insofar as the various actors act as joint controllers, they “shall in transparent manner determine their respective responsibilities for compliance with their data protection obligations, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information (...)”. In that case, the distribution of tasks between them should be laid down, preferably by law, or by an arrangement between the joint controllers.

27. The allocation of the responsibilities between the various actors should be clear and accessible in order in particular to ensure that the data subjects can fully exercise their rights under the EUDPR and GDPR. While detailed arrangements to ensure compliance with data protection requirements may be specified by way of a delegated act, the EDPS considers that the roles of the various actors involved as controller, joint controller or processor should be clearly assigned in the Proposal.

3.5.Interoperability

28. According to the Explanatory Memorandum, the FSDN plans to introduce a unique farm ID, which could be introduced, for instance, under the Integrated Farm Statistic (‘IFS’) and help linking the IFS and FSDN data. Adaptations (to either the legal act, system or methods of collection) for the purpose of linking databases would be required under each database. Therefore, even if the FSDN provides possibility for interoperability, other databases and systems would have to mirror it .

29. Article 19(3) of the Proposal specifies that when setting up of the system for collecting the additional environmental and social variables, including training and interoperability between data collection systems, necessitates significant adaptations in the national FADN data collection system of a Member State.” In addition, the revised Article 19(6) states that the Commission shall adopt implementing acts establishing (...) adaptations to the data collection system”.

30. The EDPS recognises that interoperability, when implemented in a well thought-out manner and in compliance with the requirements of necessity and proportionality, may be a useful tool to address legitimate needs of competent authorities of the Member States and the Commission and can contribute to the development of effective and efficient information sharing.

31. Insofar as the Proposal aims to establish an IT system for the purpose of linking databases, the EDPS recommends including in the Proposal a high level description of the IT tool, including data protection roles and responsibilities and relevant applicable safeguards. Furthermore, the EDPS recalls that when a proposal for legislation has a possible impact on data protection, the European Commission has to submit it to the EDPS for consultation. This includes above mentioned implementing acts.

4. Conclusions

32. In light of the above, the EDPS recommends: a) to revisit the proposed definitions to ensure that both the GDPR and EUDPR are referenced in a systematic and consistent manner and to avoid introducing definitions of concepts already covered by those instruments; b) amending Article 16(2) and recital (8) of the Proposal to remove any suggestion that pseudonymisation would avoid the possibility of identification; c) specifying in Article 16 of the Proposal that only duly anonymised FSDN data may be made publically available; d) specifying the categories of personal data so as to ensure that the processing of personal data is limited to what is directly relevant and necessary to accomplish the specified purposes of the Proposal ; e) specifying all the purposes for which personal data may be processed in the enacting terms of the Proposal; f) establishing a retention period for the relevant categories of personal data concerned, or at least laying down criteria to determine such periods, taking into account the purposes of the processing; g) clearly assigning the roles of the various actors involved as controller, joint controller or processor; h) insofar as the Proposal aims to establish an IT system for the purpose of linking databases, including in the Proposal a high level description of the IT tool, including data protection roles and responsibilities and relevant applicable safeguards. Brussels, 11 August 2022 [e-signed] Wojciech Rafał WIEWIÓROWSKI 10