Financing, management and monitoring of the common agricultural policy (transparency, post-Schecke)

Opinion of the European Data Protection Supervisor

on the Amendment to the Commission proposal COM(2011) 628 final/2 for a Regulation of the European Parliament and of the Council on the financing, management and monitoring of the common agricultural policy (hereinafter: "the Amendment")

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data ,

HAS ADOPTED THE FOLLOWING OPINION:

I. INTRODUCTION

I.1. Consultation of the EDPS

1. On 25 September 2012 the Commission adopted the Amendment to the Commission proposal COM(2011) 628 final/2 for a Regulation of the European Parliament and of the Council on the financing, management and monitoring of the common agricultural policy (hereinafter: "the Amendment"). The Amendment to the Commission proposal was sent to the EDPS for consultation.

2. Before the adoption of (the Amendment to) the Proposal, the EDPS was given the possibility to provide informal comments.

3. I.2. Context of the Amendment

4. The Amendment adds a new chapter on transparency to the legislative proposals reforming the Common Agricultural Policy (hereinafter: "the 3 4 CAP") , on which the EDPS issued an Opinion on 14 December 2011 . According to the information available, it is not clear whether other legislative proposals for the CAP after 2013 will also be amended in this sense. In this regard, the EDPS refers to the abovementioned Opinion, in which other proposals are identified as relevant for the publication of personal data 5 (Articles 157(1), 157(2)(d) and 157(3)(c) of the single CMO regulation) . The EDPS would welcome the opportunity to provide advice in the event that these provisions are amended. II. ANALYSIS OF THE AMENDMENT II.1. General Comments

5. In general, the EDPS encourages the Commission to find a solution that would achieve the aim of transparency while respecting the fundamental rights to privacy and data protection of the beneficiaries.

6. The Amendment lays down the obligation for Member States to publish data on the beneficiaries (both natural and legal persons) of the EAGF and the EAFRD. Names of beneficiaries which in one year have received an amount of aid which is equal or less than a specific threshold will not be published.

7. The EDPS welcomes the effort of the Commission in striking a balance between the principle of transparency and the beneficiaries' rights to privacy and personal data protection.

8. However, he would recommend some improvements, in particular as regards the publication of data of legal persons, the justification for the publication of data on natural persons, the justification of the retention period and the information to be provided to data subjects. II.2. Specific comments II.2.1 Publication of data on legal persons

9. The EDPS recommends applying the exception from publication only to natural persons. Although the names of legal persons might indirectly identify 6 natural persons , the Court of Justice of the European Union has stated that it would be unreasonably burdensome for national authorities to examine whether the name of each legal person identifies natural person(s) .

10. In addition, the Court stated that, as regards legal persons, the former provisions on the publication of beneficiaries were not disproportionate and acknowledged that legal persons "are already subject to a more onerous obligation in respect of the publication of data relating to them" .

11. Therefore, the EDPS recommends amending Article 110b, second paragraph as follows: "Where the amount of aid received in one year by a beneficiary who is a natural person is equal or less than the amount fixed by a Member State pursuant to Article 49 of Regulation (EU) NoDP/xxx that Member State shall not publish the name of that beneficiary as provided for in point (a)(i) of the first subparagraph of Article 110a(l) of this Regulation". II.2.2. Publication of data on natural persons

12. As regards natural persons the analysis is different . The EDPS welcomes the fact that the Commission has taken into consideration alternative methods of publishing information on the beneficiaries that would be consistent with the principle of transparency while causing less interference to the beneficiaries' rights to privacy and personal data protection. The 2011 consultation of stakeholders organised by the Commission , mentioned in Recital 70b of the Amendment, and the explanations provided in Recitals 70d to 70h show this effort.

13. The option chosen by the Commission, which consists of limiting the publication of data of beneficiaries according to the amount of the aid received, is one of the methods suggested by the Court. Other possible methods mentioned by the Court consist of limiting the publication according to the periods for which they received aid, the frequency or the nature of the aid received . The EDPS notes that the Commission envisages striking the balance as required by the Court.

14. The exception from publication for beneficiaries below a specific threshold of 13 aid is complemented by an obligation to publish, for these beneficiaries, their municipality and the amount received, together with a code chosen by the Member States. This option also aims at following the suggestions of the Court in the Schecke case . However, the EDPS recalls that these data might still allow identification, especially with regard to small municipalities with few beneficiaries, and is thus still personal data . Data subjects below that threshold are entitled to exercise the same data protection rights as the rest. The EDPS therefore encourages including an additional provision to ensure that in case of small communities only aggregated data are published. II.2.3. Justification of the publication

15. Having said that, the EDPS is not convinced by the justification provided in Recital 70c. As the Proposal states at the beginning of this Recital, in the Schecke case the Court did not question the legitimacy of the objective of reinforcing transparency and public control. However, the Recital justifies the need for publication with an economic argument, mainly the cost of increasing the minimum control rates beyond the levels currently applied. According to this Recital, the possible reduction of on-the-spot checks that is foreseen in the new financial management and control framework justifies the need for national authorities to rely more on public control.

16. The EDPS recalls that, according to Article 52(1) of the EU Charter of Fundamental Rights, any limitation to the rights to private life and the protection of personal data can only be justified if it is necessary and proportional. The European Court of Human Rights considers such interference necessary if it answers a pressing social need, if it is proportionate to the aim pursued and if the reasons put forward by the public authority to justify it are relevant and sufficient . According to the Court of Justice of the European Union, the principle of proportionality requires demonstrating that other less intrusive methods were not available .

17. In our view, the Preamble should better explain why other less intrusive measures would not fulfil the purpose of transparency and why the other options suggested by the Court have been considered less appropriate than the one chosen by the Commission. Transparency and public control are legitimate aims by themselves, as confirmed by the Court, and cannot be presented as a replacement for specific controls and on-the-spot-checks by competent authorities. Economic constraints might justify the reduction of those controls, but not the publication of information on the beneficiaries. II.2.4 Duration of the publication

18. The EDPS welcomes the fact that Article 110a(3) defines the period during which the data will be publicly available (2 years after their initial publication). However, he recommends justifying in a recital the reason why this specific period has been chosen and how it contributes to striking a balance between the principle of transparency and the protection of privacy and personal data. III.2.5. Information to data subjects

19. The EDPS also welcomes Article 110c on information to the beneficiaries. However, this Article should better specify the obligation for Member States to inform beneficiaries on the identity and contact details of the controller and the fact that beneficiaries who are natural persons have the right to obtain the rectification or blocking of inaccurate or incomplete personal data in accordance with national laws implementing Articles 10 and 11 of Directive 95/46/EC. IV. CONCLUSION

20. The EDPS welcomes the effort of the Commission in striking a balance between the principle of transparency and the beneficiaries' rights to privacy and personal data protection.

21. However, he recommends the following:  applying the exemption from publication for beneficiaries below the threshold only to natural persons (Article 110b);  better justifying in Recital 70c why other less intrusive measures would not fulfil the purpose of transparency and why other ways of publication have been considered less appropriate;  including an additional provision to ensure that in case of small communities only aggregated data are published.  justifying in the Preamble the duration chosen in Article 110a(3) for the publication of the data;  complement the information to be provided to data subjects in Article 110c. Done in Brussels, 9 October 2012 (signed) Giovanni Buttarelli Assistant European Data Protection Supervisor