EDPS Opinion 22/2024 on the Proposal for a Regulation on the welfare of dogs and cats and their traceability

18 November 2024

Opinion 22/2024

on the Proposal for a Regulation on the welfare of dogs and cats and their traceability

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. In accordance with Article 57(1)(g) of Regulation 2018/1725, the EDPS shall ‘advise, on his or her own initiative or on request, all Union institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Council mandate for negotiations with the European Parliament regarding the Proposal for a Regulation of the European Parliament and of the Council on the welfare of dogs and cats and their traceability .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 26 July 2024, the Council consulted the EDPS on the Council mandate for negotiations with the European Parliament regarding the proposal for a Regulation of the European Parliament and of the Council on the welfare of dogs and cats and their traceability (‘the Proposal’).

The objectives of the Proposal are to ensure a smooth functioning of the market of dogs and cats and a rational development of the sector, as well as a high level of animal welfare. In order to achieve these objectives, both national competent authorities and the Commission must be able to process certain personal data. Against this background, the EDPS welcomes the inclusion of a specific provision regarding data protection in the Proposal and the aim of ensuring a high level of data protection.

With this Opinion, the EDPS provides a number of recommendations regarding the categories of personal data to be processed by either national competent authorities or the Commission. In particular, the EDPS recommends providing further clarifications regarding personal data processed in the context of (1) the notification and registration of establishments; (2) the national database of the identification and registration of dogs and cats (and their owners); (3) the online system performing automated checks of the authenticity of the identification and registration information; (4) the Union pet travellers’ database and (5) the list of approved breeding establishments.

The EDPS also recommends explicitly designating the Commission as the controller responsible for processing personal data through the online system performing automated checks of the authenticity of the identification and registration of dogs and cats placed on the market.

Finally, the EDPS welcomes that the Proposal provides for maximum storage periods and explains why these storage periods are considered necessary. However, he recommends re-evaluating whether a shorter maximum storage period of personal data relating to present and past owners of dogs or cats would be sufficient to achieve the envisaged purposes. He also suggests defining the maximum period for any personal data processed through the system verifying the authenticity of the identification and registration of dogs and cats.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Articles 57(1)(g) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 7 December 2023, the European Commission issued a proposal for a Regulation of the European Parliament and of the Council on the welfare of dogs and cats and their traceability and submitted the proposal to the Council of the European Union. The EDPS was not consulted on the Commission proposal.

2. At its meeting on 26 June 2024, the Permanent Representatives Committee of the Council approved a compromise text, which included amendments that impact the protection of individuals’ rights and freedoms with regard to the processing of personal data.

3. On 26 July 2024, the Council consulted the EDPS on the Council mandate for negotiations with the European Parliament regarding the proposal (‘the Proposal’) and requested that the EDPS submit its opinion no later than 15 November 2024.

4. The objective of the Proposal is to lay down minimum requirements for: (a) the welfare of dogs and cats bred or kept in establishments, or placed on the Union market; (b) the traceability of dogs and cats placed on the Union market .

5. The Proposal is accompanied by three Annexes .

6. The present Opinion of the EDPS is issued in response to a consultation by the Council of the European Union of 26 July 2024, in accordance with Article 57(1)(g) EUDPR. The EDPS 4 observes that a reference to this consultation in a recital of the Proposal is missing. Therefore, the EDPS recommends inserting such reference in a recital of the Proposal.

2. General remarks

7. The EDPS recognizes the legitimate objective of the Proposal of ensuring a smooth functioning of the market of dogs and cats and a rational development of the sector, as well as a high level of animal welfare .

8. To this end, the EDPS understands that it is necessary to establish minimum requirements for the welfare of dogs and cats bred and kept in establishments , as well as strengthened 9 10 requirements regarding the traceability of dogs and cats placed on the Union market .

9. The EDPS notes that the Proposal would entail the processing of personal data by national competent authorities. Such processing may occur in the context of the notification and registration of the establishments referred to in Article 7 of the Proposal. Processing of personal data would also take place in the context of the identification and registration of dogs and cats referred to in Article 17 of the Proposal, which provides that the dogs and cats that are kept in establishments and all dogs and cats placed on the market shall be registered in a national database, referred to in Article 19 of the Proposal .

10. The EDPS notes that the Proposal would also entail the processing of personal data by the Commission, for instance in the context of the Union pet travellers’ database referred to in the second subparagraph of Article 21(4a) of the Proposal .

11. Against this background, the EDPS welcomes the reference to both the EUDPR and the GDPR in recital 44a of the Proposal.

3. Categories of personal data

3.1.Notification and registration

12. The Proposal provides that operators of establishments shall notify the competent authorities of their activity, providing at least the information outlined in Article 7, 16 17 including their name and address , as well as any changes thereof .

13. In accordance with the data minimisation principle , only personal data that is necessary for the purpose of notifying the activities of the establishments to the competent authorities may be processed. Therefore, the EDPS considers it important that the Proposal avoids open-ended terms such as ‘at least’ insofar as personal data are concerned. Instead, the Proposal should aim to specify, as exhaustively as possible, any categories of personal data to be processed in relation to this purpose.

3.2.National database

14. With regard to the registration of dogs and cats in the national database, Article 17(2) of the Proposal provides that for dogs and cats kept in establishments, the registration shall be made in the name of the operator of the establishment responsible for the dog or the cat. For natural persons placing a dog or a cat on the market, the registration shall be made in the name of that person. In case of transfer of ownership or responsibility, the natural or legal person placing the dog or cat on the market shall ensure that any change of ownership or responsibility is recorded in the database referred to in Article 19 of the Proposal.

15. In order to ensure compliance with the principle of data minimisation , the EDPS recommends clarifying which categories of personal data shall be recorded in the database in case of registration and in case of transfer of ownership or responsibility. In particular, the EDPS recommends clarifying whether the personal data processed shall be limited to the names and, potentially, contact details of the persons concerned.

3.3.Online system

16. Article 17(6) of the Proposal, provides that ‘[t]he Commission shall ensure that an online system performing automated checks of the authenticity of the identification and registration of dogs and cats placed on the market, using the database referred to in Article 19, is publicly available and free of charge. The Commission may entrust the development, maintenance and operation of this system to an independent entity...’. Such system shall be compliant with data protection in accordance with the EUDPR and the GDPR .

17. The EDPS understands that the online system pursuant to Article 17(6) of the Proposal will use the database referred to in Article 19(1) of the Proposal. As the database referred to in Article 19(1) involves the processing of personal data (e.g. name of natural persons placing a dog or a cat on the market or subsequent owner), the EDPS recommends clarifying, either in the Proposal or by way of an implementing act , which categories of personal data, if any, will be made available to the verifying person during the verification of the authenticity of the identification and registration of dogs and cats placed on the market.

18. The EDPS underlines that any processing of personal data through the online system and the functionalities it will provide should be limited to the specific purpose of the online system, i.e. to enable the verification of the authenticity of the registration and identification of dogs and cats.

3.4.Union pet travellers’ database

19. The Proposal stipulates that the entry of dogs and cats into the Union under a noncommercial movement , shall be pre-notified by their owners into an online Union pet travellers’ database at least 5 working days before the crossing of the Union border. The owner shall pre-notify their identity and where relevant the identity of the authorised person travelling with the dog or cat, the identification number of the microchip of the dog or cat, its main destination in the Union, and where relevant the planned date and place of exit from the Union .

20. The EDPS notes that the Proposal does not further specify precisely what ‘identity’ information owners would be expected to provide when pre-notifying. Since the Proposal does not empower the Commission to issue delegated or implementing acts in relation to Article 21a(4) of the Proposal, the EDPS recommends specifying which identity information should be provided by the owner or the authorized person traveling with the pet.

3.5.List of approved breeding establishments

21. In addition, the Proposal provides that competent authorities shall maintain a list of the approved breeding establishments and make it publicly available . The Proposal does not explicitly specify what information from the list of approved breeding establishments will be made public (e.g., whether it will include personal data such as the names and addresses of the operators of breeding establishments in case those operators are natural persons). To ensure legal clarity and foreseeability, the EDPS recommends clearly specifying which categories of data will be included in the publicly available list of breeding establishments, taking into consideration the principle of data minimisation and purpose limitation.

4. Roles and responsibilities

22. The EDPS welcomes the inclusion of a specific provision regarding data protection in the Proposal, which also aims to clarify which entities act as a controller when processing personal data that is collected under Article 7, Article 7a, Article 19(1) and Article 21(4) of the Proposal .

23. The EDPS observes that no reference is made to the processing of personal data through the online system pursuant to Article 17(6) of the Proposal. The EDPS recommends specifying in Article 20a(1) of the Proposal that the Commission shall also be the controller with regard to the processing of personal data through this system, especially in case any personal data would be made available during the verification of the authenticity of the identification and registration of dogs and cats placed on the market .

5. Data storage

24. The EDPS welcomes that the Proposal provides for storage durations for personal data related to the notification and registration of establishments, the approval of the breeding establishments the registration of dogs and cats in the database, as well as the prenotification of dogs and cats entering into the Union . The EDPS also welcomes that the Proposal includes a justification of why these storage periods would be necessary to achieve the envisaged purposes .

25. Recital 44d of the Proposal states that “[t]he retention period of personal data of the present and past owners for dogs or cats in national databases should be 5 years after the recording of the death of the dog or cat in those databases or 30 years from the date of the first registration of the dog or cat in those databases, in order to cover the life expectancy of dogs and cats, to maintain a robust traceability systems for all dogs and cats traded in the Union, and to allow for official controls on welfare problems such as abnormal death rates requiring data analysis, including after the death of the dog or cat” .

26. The EDPS understands that the justification for the storage of personal data of owners for thirty years - in case the death of the dog or cat is not recorded - is based on the life expectancy of dogs and cats, as well as the potential need for posthumous analysis (e.g., welfare concerns, abnormal death rates). However, a thirty-year storage period may exceed the realistic period during which personal data is needed, particularly for dogs, considering that it significantly exceeds their life expectancy. Hence, the EDPS recommends reevaluating whether a shorter maximum storage period would be sufficient for the intended purposes.

27. Finally, the EDPS recommends defining the maximum period for any personal data processed through the online system for verifying the authenticity of the identification and registration of dogs and cats, referred to in Article 17(6) of the Proposal.

6. Implementing acts

28. The Proposal provides for several implementing acts. For instance, the Commission shall adopt implementing acts laying down: (a) based on the content of the databases referred to in Article 19(3)(a), the exact information to be provided by natural and legal persons placing dogs or cats on the market, as proof of identification and registration of the dogs and cats in accordance with Article 17(3)(a), both in cases where the dogs and cats are offered through online platforms and by other means; (b) the following aspects of the system referred to in Article 17(6): the key functionalities of the system; the technical, electronic and cryptographic requirements for the system .

29. Moreover, with regard to the databases, referred to in Article 19 of the Proposal, the Commission shall, by means of implementing acts, lay down provisions concerning, among others, data protection pursuant to the requirements of Regulation (EU) 2018/1725 and Regulation (EU) 2016/679 .

30. In this regard, the EDPS reminds the Commission of its obligation to consult the EDPS when preparing implementing acts that would have an impact on the protection of individuals' rights and freedoms with regard to the processing of personal data pursuant to Article 42(1) of the EUDPR.

7. Conclusions

31. In light of the above, the EDPS makes the following recommendations: (1) specify the categories of personal data to be processed and particularly: a. provide an exhaustive list of all categories of personal data processed for the notification and registration of establishments, as outlined in Article 7 of the Proposal; b. clarify whether the personal data processed for the registration of dogs and cats in the national database referred to in Article 19 of the Proposal, shall be limited to the names and, potentially, contact details of the persons concerned. c. clarify, either in the Proposal or by way of an implementing act, which categories of personal data, if any, will be made available to the verifying person during the verification of the authenticity of the identification and registration of dogs and cats d. specify which identity information should be pre-notified by the owner or the authorised person travelling with the pet into the online Union pet traveller’s database, as referred to in Article 21(4a) of the Proposal; e. clarify whether any personal data, and if so which categories, will be included in the publicly available list of breeding establishments, as outlined in Article 7a(3) of the Proposal. (2) explicitly designate, in Article 20a(1) of the Proposal, the Commission as controller responsible for processing personal data through the online system performing automated checks of the authenticity of the identification and registration of dogs and cats placed on the market, provided for in Article 17(6) of the Proposal. (3) re-evaluate the maximum storage period for the personal data of present and past owners in the database referred to in Article 19(1) of the Proposal. (4) define the maximum period for any personal data processed through the system verifying the authenticity of the identification and registration of dogs and cats, as specified in Article 17(6) of the Proposal. Brussels, 18 November 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 10