Shareholders Rights Directive

Opinion of the European Data Protection Supervisor

on the Commission Proposal for a Directive of the European Parliament and of the Council amending Directive 2007/36/EC as regards the encouragement of long-term shareholder engagement and Directive 2013/34/EU as regards certain elements of the corporate governance statement

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, and in particular Article 28(2) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. INTRODUCTION 1.1. Consultation of the EDPS

1. On 9 April 2014, the Commission adopted a proposal for a Directive of the European Parliament and of the Council amending Directive 2007/36/EC as regards the encouragement of long-term shareholder engagement and Directive 2013/34/EU as regards certain elements of the corporate governance statement ('the Proposal'). The next day, the Commission sent the Proposal to the EDPS for consultation.

2. We welcome the fact that we were consulted on this Proposal prior to its adoption and that we were given the possibility to provide informal comments to the Commission. The Commission took into account several of these comments. As a result, the data protection safeguards in the proposed Directive have been strengthened. We also welcome the reference in the preamble to the consultation of the EDPS. 1.2. Context, objective and scope of the Proposal

3. In 2012, the Commission's Action Plan: European company law and corporate governance - a modern legal framework for more engaged shareholders and sustainable companies provided the Commission’s roadmap in this area, based on the objectives of enhancing transparency and engaging shareholders.

4. The EDPS in his letter of 27 March 2013 to the Commission commented on relevant items on the Action Plan. In particular, we provided preliminary guidance with regard to data protection and privacy concerns regarding 'shareholder identification' and 'shareholder oversight of remuneration policy'.

5. The overall objective of the current Proposal, in relevant part, is to amend Directive 2007/36/EC ('Shareholders' rights Directive') , which introduced minimum standards to ensure that shareholders have timely access to the relevant information ahead of the general meeting and simple means to vote at a distance and also set a number of other common requirements with regard to the rights of shareholders.

2. ANALYSIS OF THE PROPOSAL 2.1. Personal data processed under the Proposal

6. Although the processing of personal data is not the main focus of the Proposal, the Proposal nevertheless requires processing of a significant amount of personal data. These typically relate to the shareholders and directors of the companies concerned, if they are individuals. The following provisions of the Proposal are particularly relevant from the data protection perspective:  Article 3a on 'Identification of shareholders' and  Article 9b on 'Right to vote on the remuneration report'.

7. As will be explained further in Section 2.3, Article 3a(1) of the Proposal, in essence, gives companies the 'right' to identify their shareholders. Any 'intermediaries', in particular, will be required to offer companies the possibility to identify their shareholders.

8. As will be explained further in Section 2.4, Article 9b requires the public disclosure of the remuneration of individual directors as part of the 'remuneration report' that shareholders are given the right to vote on.

9. In addition to these two provisions it cannot be excluded that other provisions of the Proposal may also require processing of personal data in some situations. This may be the case, for example, with regard to Article 9c on 'Right to vote on related party transactions', which requires the disclosure of information on related party transactions. Related parties, in some cases, may be individuals. 2.2. References to applicable data protection law

10. The Explanatory Memorandum (on page 7), Recital 20, as well as Article 9b(2) each refer to the applicability of Directive 95/46/EC. The EDPS welcomes the fact that references have been made to applicable data protection legislation, and that this has also been done in the main body of the text, in addition to the recitals.

11. We note, however, that among the substantive provisions there is only one specific reference to Directive 95/46/EC, in Article 9b(2) of the Proposal, and this deals only and specifically with publication of information on the remuneration of individual directors.

12. This might lead to potential ambiguities, considering that the implementation of other parts of the Directive may also require processing of personal data though they are not covered by this reference: in particular, Article 3a on the 'Identification of shareholders' and Article 9c on 'Right to vote on related party transactions'. We therefore suggest including a more general reference (also in a substantive provision), which would unambiguously apply to all processing of personal data under the Proposal.

13. In addition, we also recommend that instead of referring to Directive 95/46/EC, a reference be made to ‘national laws implementing Directive 95/46/EC’.

14. Finally, on page 7 of the Explanatory Memorandum, we recommend that a reference be made to both Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, thus more clearly covering both the rights to privacy and the protection of personal data. 2.3. Article 3a on 'Identification of shareholders'

15. Article 3a(1) provides that ‘Member States shall ensure that intermediaries offer to companies the possibility to have their shareholders identified’. This ‘right’ for the companies to identify their shareholders may have significant implications for investor privacy, as we pointed out in our letter of 27 March 2013.

16. We acknowledge the potential benefits and policy objectives of shareholder identification. We also welcome the fact that the Proposal does not call for the creation of a central database and instead only requires in Article 3a(2) that 'Member States shall ensure that, on the request of the company, the intermediary communicates without undue delay to the company the name and contact details of the shareholders …'.

17. Further, we welcome that the Proposal:  clearly specifies and limits the personal data to be shared to the name and contact details of the shareholder;  provides for a limited retention period (24 months after receipt of data);  specifies the rights of rectification and erasure; and  specifies and limits the purposes for which the information disclosed may be used (i.e. facilitation of the exercise of the rights of the shareholder). 2.4. Article 9b on 'Right to vote on the remuneration report'

18. Article 9b requires the public disclosure of the remuneration of individual directors as part of the 'remuneration report' that shareholders are given the right to vote on. Balancing transparency and data protection/privacy

19. We acknowledge the importance of the objectives of transparency and accountability, which these provisions serve.

20. We also understand that the 'Commission has considered the possibility of introducing less intrusive alternatives, such as for instance requiring an aggregated disclosure for the entire board of directors where only the number of directors and the total remuneration would be indicated' and that in the view of the Commission, 'such shareholders to assess the link between pay and performance and to remedy potential 8 situations where an individual director seriously underperforms'.

21. As regards transparency and access to information requirements, it is useful to make a few preliminary comments with regard to the interplay between EU law and national law. We would like to underline in particular that unlike data protection laws, which are harmonised to a certain degree based on Directive 95/46/EC, access to information laws significantly diverge across EU Member States.

22. In principle, access regimes typically call for a balancing test that compares the interests protected by privacy and data protection rules against the benefits of openness and transparency. Considering the divergences, the outcome of the balancing exercise may be different in the different EU Member States.

23. That being said, national legislation must comply with Article 8 of the European Convention on Human Rights (‘ECHR’) as well as Articles 7 and 8 of the Charter of Fundamental Rights of the European nion (‘E Charter’) when implementing E law. This implies as the European Court of ustice held in the sterreichischer Rundfunk and Schecke cases that it should be ascertained that the disclosure is necessary for and proportionate to the legitimate aim pursued by the law.

24. In view of the lack of harmonisation on these issues at EU level, we would have welcomed more clarity and legal certainty in the text of the Proposal and more detailed and more specific consideration of alternatives in the Impact Assessment. That said, we do not, in principle, have objections against the public disclosure of information about the remuneration of individual directors, so long it is clear what data will be made publicly available and further provided that any public disclosure is made taking into account the principle of proportionality, and subject to appropriate safeguards under the 10 Proposal and/or under national law. This should be made clear in the text of the Proposal, as will be discussed below. Purpose limitation and limitations on accessibility

25. With regard to safeguards, first of all, we call attention to the principle of purpose specification and purpose limitation set forth in Article 6(1)(b) of Directive 95/46/EC. We recommend that Article 9b (perhaps in a new paragraph) clearly specify that the information relating to the remuneration of individual directors is published in order to facilitate the exercise of shareholders' rights, and to allow for further transparency and accountability with regard to their performance as directors of the companies concerned, and shall not be used (by anyone) for any incompatible purposes. In addition, a recital may clarify that the data shall not be used, among others, for marketing to these individuals, or for creating profiles of these individuals.

26. As a related point, we recall that once data have been made publicly available as part of the remuneration report, especially if this has been done via the internet, it is very difficult, if not impossible, to have any definitive control over what will happen to that information. For example, as third parties may have already reused the information, replicated it and may have dispersed it more widely on the internet, it may not always be possible to definitely ensure deletion or inaccessibility of the data after a certain period of time.

27. Nevertheless, considering that the information published, in principle, will not serve its intended purposes after an appropriate, limited period of time , we recommend that the Proposal require that Member States ensure that the companies take appropriate technical and organisational measures to limit the accessibility of personal data after an appropriate period of time. For example, measures can ensure that the companies concerned will either take off from their websites information relating to out-dated information (such as older remuneration reports) after a number years (e.g. five years), and/or that the personal data available in the archives of the registry will not be searchable by the names of the individual directors concerned, and not be available for search by external search engines either in this manner. Dealing with potentially sensitive information

28. Another concern that requires appropriate safeguards arises out of the fact that in specific situations the remuneration of a director may reveal potentially sensitive information, for example, health data. Indeed, the Impact Assessment foresees this possibility. It provides that 'information should also be disclosed on individual remuneration paid and all its components such as fixed pay, variable pay, stock options, retirement benefits and all benefits in kind. Potentially sensitive information should however be explicitly excluded in order not to disproportionately interfere with the private and family life of individuals. A common template regarding the disclosure of remuneration should be used to ensure comparability for investors across the EU'.

29. We welcome the fact that the Impact Assessment specifically highlights this issue and that a common template is to be prepared.

30. In order to ensure legal certainty in this regard, we recommend that the Proposal, in a substantive provision, specifically provide that in case the disclosure of the details of an individual director's remuneration package reveal health data or other special categories of data protected under Article 8 of Directive 95/46/EC, then the information should be redacted so as to exclude any reference to such 'more sensitive' information.

31. We further recommend that the template provide for suggestions how to address this issue in a way that ensures accurate reporting of remuneration while at the same time not disproportionately intruding upon the privacy and other fundamental rights of the individuals concerned. Data subjects' rights, including information to the data subjects

32. Sections IV to VII of Directive 95/46/EC require that certain information be given to the data subjects and also give certain rights to the data subjects, including rights of access, and the right to object.

33. With regard to the information given to data subjects, we note that, as discussed elsewhere, it is essential that some information be already provided in the Proposal and/or in national law, such as the types of data to be processed (published) and the purposes of processing (accountability and transparency). Additional information should also be provided to the individuals concerned by the controllers (companies) about the processing of their personal data, in accordance with Articles 10 and 11 of Directive 95/46/EC (such as the time limit for retention of personal data and information on how individuals can exercise their rights).

3. CONCLUSIONS

34. We welcome the consultation of the EDPS on this Proposal and the fact that the Commission took into account several of our comments. As a result, the data protection safeguards in the proposed Directive have been strengthened.

35. In the present Opinion we recommend the following further improvements:  A general, substantive provision should be added to refer to applicable data protection legislation, including 'national laws implementing Directive 95/46/EC’.  Further, the Proposal should specify the purposes of processing and should clearly provide that neither the information regarding the identity of the shareholders, nor the data on the remuneration of individual directors, shall be used for any incompatible purposes.  Further, the Proposal should also require companies to ensure that technical and organisational measures are put in place to limit accessibility of the information regarding individuals (such as shareholders or individual directors) after a certain period of time.  Finally, the Proposal should require that in case the disclosure of the details of an individual director's remuneration package reveal health data or other special categories of data protected under Article 8 of Directive 95/46/EC, then the information should be redacted so as to exclude any reference to such 'more sensitive' information. Done in Brussels, 28 October 2014 (signed) Giovanni BUTTARELLI Assistant European Data Protection Supervisor