Opinion on the European Media Freedom Act

11 November 2022

Opinion 24/2022

on the Proposal for a Regulation establishing a common framework for media services in the internal market (European Media Freedom Act) and amending Directive 2010/13/EU

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation (EU) 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation (EU) 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council establishing a common framework for media services in the internal market (European Media Freedom Act) and amending Directive 2010/13/EU. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the draft Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 16 September 2022, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council establishing a common framework for media services in the internal market (European Media Freedom Act) and amending Directive 2010/13/EU.

The Proposal aims to improve the functioning of the internal media market, particularly by fostering cross-border activity and investment in media services, increasing regulatory cooperation and convergence, facilitating the provision of quality media services and ensuring a transparent and fair allocation of economic resources in the internal media market.

The EDPS welcomes the aim of the Proposal to protect media freedom and pluralism, as a precondition for the functioning of the EU internal market for media services and, equally important, a key enabler for the rule of law and democratic accountability in the Union.

However, the EDPS recommends to first clarify the scope of the future Regulation, both personal and material. In particular, he notes that, despite the intention of the Commission, clearly expressed in the Proposal, to lay down rules ensuring the protection at EU level of the sources of journalists including freelancers, the scope of the Proposal as currently defined only includes media service providers and does not encompass all journalists. The EDPS recommends adding an explicit reference to journalists to the relevant provisions of the future Regulation, so as to clarify that any journalist, including free-lance or self-employed, would fall within the scope of the future Regulation and thus could also be able to rely on a robust protection of journalistic sources and communication. In addition he recommends clarifying the criteria for determining when a journalist falls within the jurisdiction of a Member State. The EDPS also recommends to horizontally clarify that the future Regulation is without prejudice to and does not affect the EU legislation on personal data protection and privacy, in particular the General Data Protection Regulation, the ePrivacy Directive and the Law Enforcement Directive.

Secondly, while the EDPS fully supports the objective of the Proposal to provide specific guarantees for media freedom and pluralism, he has doubts about how effective the proposed measures would be in practice to achieve the objective pursued. In particular, the EDPS considers that, as it stands, Article 4(2)(b) and (c) of the Proposal, in particular regarding the exceptions to the prohibition of intercepting, subject to surveillance media service providers, including by deploying spyware on their devices, do not provide enough safeguards and lack legal clarity. The EDPS invites the colegislators to further define and restrict the possibility to waive the protection of journalistic sources and communications, in line with the principles of strict necessity and proportionality as interpreted in the case law of the CJEU and the ECtHR. In particular, he remains convinced that the only viable and effective option to protect the fundamental rights and freedoms in the Union, including media freedom, against highly advanced military-grade spyware is a general ban on its development and deployment with very limited and exhaustively defined exceptions, complemented by robust safeguards, such as those suggested in the EDPS Preliminary remarks on modern spyware.

Thirdly, with regard to the national independent authority or body in charge of handling complaints in relation to breaches of Article 4(2)(b) and (c) of the Proposal, the EDPS recommends 2

ensuring that the future Regulation explicitly set out specific guarantees of independence and provide for an explicit legal basis for cooperation between the relevant supervisory authorities, each acting within their respective areas of competence. In addition, the EDPS recommends that the future Regulation require a structured cooperation between the competent supervisory authorities, including data protection authorities and make explicit reference to the national competent supervisory authorities involved in the cooperation and identify the circumstances in which cooperation should take place. In particular, the EDPS recommends ensuring that the independent competent authorities designated under the future Regulation have the power and duty to consult with the relevant other national competent supervisory authorities, including data protection authorities, in the context of their investigations and compliance assessments. With regard to national data protection authorities, the EDPS specifically recommends clarifying that competent independent authorities under the future Regulation should be able to provide to the competent supervisory authorities under the GDPR and the LED, upon request or on their own initiative, any information obtained in the context of any audits and investigations that relate to the processing of personal data and to include an explicit legal basis to that effect.

Moreover, regarding the publication of information concerning the media service providers and in particular their owners and beneficial owners, the EDPS recommends explicitly specifying in the Proposal the objective(s) of public interest pursued and ensuring that the list of categories of information to be made available under Article 6(1) of the Proposal be clearly defined and explicitly listed in the future Regulation.

Lastly, the EDPS recommends clarifying whether any personal data would be processed throughout the cooperation or mutual assistance between national regulatory authorities or bodies set out in the Proposal and, if so, to explicitly lay down the purposes of the processing, the specific categories of personal data to be processed, the data retention period and the identification of the roles and responsibilities of the national regulatory authorities and bodies within the meaning of data protection law.

3

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 16 September 2022 the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council establishing a common framework for media services in the internal market (European Media Freedom Act) and amending Directive 2010/13/EU (‘the Proposal’) .

2. The Proposal is articulated around four specific objectives, namely: 1) fostering cross-border activity and investment in media services by harmonising certain elements of the diverging national media pluralism frameworks, in particular to facilitate cross-border service provision; 2) increasing regulatory cooperation and convergence through cross-border coordination tools and EU-level opinions and guidelines; 3) facilitating the provision of quality media services by mitigating the risk of undue public and private interference in editorial freedom and 4) ensuring a transparent and fair allocation of economic resources in the internal media market by enhancing transparency and fairness in audience measurement and allocation of state advertising .

3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 16 September 2022, pursuant to Article 42(1) of the EUDPR. The EDPS welcomes the reference to this consultation in recital 54 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of the EUDPR.

2. General remarks

4. According to the Explanatory Memorandum to the Proposal, the media sector is not only an important economic sector, but also essential for a healthy civic sphere and for economic freedoms and fundamental rights . Moreover, the independent media and news media particularly have a crucial role in preserving the integrity of the European information space and are key to the functioning of democratic societies and economies .

5. However, as reflected in the Explanatory Memorandum to the Proposal, media independence and pluralism are increasingly faced with various challenges which affect the ability to provide quality media services, such as interference in the editorial decisions, uneven guarantees of independence for public service media, opaque and unfair allocation of state advertising, rogue media service providers financially or editorially controlled by certain third countries . Furthermore, in the light of the revelations about the unprecedented risks posed by the modern surveillance technologies on fundamental rights , the Proposal aims to add ‛targeted safeguards against deployment of spyware in the devices used by the media service providers or journalists’ .

6. In addition, recital 4 of the Proposal underlines the challenges raised by some providers which systematically engage in disinformation, including information manipulation and interference. In this regard, the EDPS recalls the risks created by online manipulation, often powered by modern technologies like artificial intelligence. In his 2018 Opinion on Online Manipulation, the EDPS recalled that “[o]nline manipulation poses a threat to society because filter bubbles and walled communities make it harder for people to understand each other and share experiences” and that “[t]he weakening of this ‘social glue’ may undermine democracy as well as several other fundamental rights and freedoms” . In the Opinion, the EDPS also highlighted that part of the solution to tackle the issue of online manipulation not only consists in enforcing existing rules, but also in tandem with other norms for elections and media pluralism .

7. The EDPS firmly believes that the protection of media freedom and pluralism is not only a fundamental right enshrined in the Charter and a condition for the functioning of the EU internal market for media services but, equally important, a key enabler for the rule of law and democratic accountability in the Union, as evidenced by Commission 2022 Rule of Law Report .

8. Therefore, the EDPS welcomes the aim of the Proposal to address the abovementioned challenges and to provide additional safeguards for media freedom and pluralism.

9. Against this background, the comments and the recommendations in the current Opinion strive to promote, as far as the fundamental rights to privacy and data protection are impacted, on the one hand, additional legal clarity and certainty of the future Regulation, and on the other hand, the effectiveness of the proposed measures for enhancing the fundamental right to freedom of expression and information, democracy and rule of law through independent and pluralistic media in the EU.

3. Specific remarks

3.1. Subject matter and scope

10. The EDPS notes that the personal and the material scope of the Proposal are not clearly defined and may lead to different interpretations, thus affecting the legal certainty. This observation relates more specifically to the status of self-employed journalists and the relationship with the EU legal framework on personal data and privacy.

11. According to recital 16 of the Proposal, journalists and editors are considered the main actors in the production and provision of trustworthy media content. Moreover, the same recital underlines the need for a robust protection of journalistic sources and communications, including against deployment of surveillance technologies, for media service providers and journalists. In this context, the Proposal clarifies that the notion of ‘journalist’ includes also those operating in non-standard forms of employment, such as freelancers. The EDPS fully supports this approach, which corresponds also to the interpretation in recital 153 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (‛the GDPR’), last sentence: “[i]n order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary to interpret notions relating to that freedom, such as journalism, broadly”.

12. However, the EDPS notes that, while Article 2 of the Proposal (‘Definitions’) in points (1), (2) and (3) defines media service, media service provider and public media service provider respectively, thus clearly including them within the scope of the Proposal, no such definition is provided for ‘journalist’.

13. Despite the statement in recital 16, the main body of the Proposal does not seem to include all journalists, and in particular, does not explicitly clarify the situation of journalists in non-standard forms of employment (such as freelance or self-employed investigative journalists) . This omission is particularly problematic in the context of Article 4(2)(b) and (c) of the Proposal, where the proposed specific safeguards against interception and surveillance and against deployment of spyware are afforded only to “media service providers or, if applicable, their family members, their employees or their family members”. As the personal scope of these measures seems exhaustively defined, it may be interpreted as excluding self-employed/freelance journalists.

14. In this regard, the EDPS recommends clarifying in the main body of the future Regulation that all journalists, including free-lance or self-employed, would fall within the scope of the future Regulation and thus could also be able to rely on a robust protection of journalistic sources and communication. To this end, an explicit reference to journalists should be added to the relevant provisions of the future Regulation, and not only to media service providers.

15. Furthermore, the EDPS notes that, contrary to Directive 2010/13/EU of the European Parliament and of the Council of 10 March 2010 on the coordination of certain provisions laid down by law, regulation or administrative action in Member States concerning the provision of audiovisual media services (Audiovisual Media Services Directive) , the Proposal does not contain any provision establishing the criteria for determining the journalists falling within the jurisdiction of the Member States. The EDPS recommends clarifying such criteria in the future Regulation.

16. Additionally, pursuant to Article 1(2) of the Proposal, the proposed Regulation should not affect the rules laid down in a number of related Directives and Regulations therein. However, the EU legal framework on personal data protection and GDPR, Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (‘ePrivacy Directive’) and Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (‘LED’) are not included in the list.

17. The EDPS recalls that the rules on data protection and privacy and the rules on freedom of expression and information may sometimes lead to tension, therefore, Article 85 GDPR explicitly obliges the Member States to “reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes”. The EDPS welcomes Article 23(2) of the Proposal, according to which the right to data protection and privacy would not be affected by the obligation set out under this provision on providers of proprietary audience measurement systems to provide, without undue delay, to the affected third parties with a legitimate economic interest, accurate, detailed, comprehensive, intelligible and up-to-date information on the methodology used by their audience measurement systems.

18. However, in the absence of any horizontal reference to the respect of data protection and privacy rights and obligations, other than the aforementioned provision, the EDPS considers that there is no sufficient clarity about the relationship of the Proposal with the EU legal framework on personal data and privacy.

19. In this regard, also in the light of the Explanatory Memorandum to the Proposal , the EDPS recommends that the future Regulation horizontally clarifies that it is without prejudice to and does not affect the data protection and privacy rights and obligations under EU law, in particular the GDPR, the ePrivacy Directive and the LED.

3.2. Deployment of surveillance technologies

20. Under the specific policy objective of ‛[f]acilitating provision of quality media services’ , the Proposal lays down targeted safeguards for media service providers, their family members, their employees or their family members against interference by public authorities and bodies, including, inter alia, protection against interception and surveillance (Article 4(2)(b) of the Proposal) and against deployment of spyware (Article 4(2)(c) of the Proposal).

21. The EDPS fully supports the objective of the Proposal to provide specific guarantees for media freedom and pluralism. However, he has doubts on how effective the proposed measures would be in practice in achieving the objective pursued to protect the fundamental rights of the targeted individuals, including their right to data protection and privacy.

22. First of all, the EDPS notes with regret that such a complex and sensitive matter like the protection of journalistic sources and communication against interception and surveillance is only barely mentioned in the Impact Assessment Report accompanying the Proposal without any proper assessment of the necessity and proportionality of the envisaged measures. Even more deplorable is the fact that the issue of spyware, despite its political and media prominence in the EU and globally, is not referred to and analysed at all in the Impact Assessment.

23. The EDPS welcomes the call in recital 17 of the Proposal for harmonisation and further strengthening at Union level of the protection of journalistic sources and communications and the related provision under Article 4(2)(b) of the Proposal prohibiting Members States, including their national regulatory authorities or bodies, “to detain, sanction, intercept, subject to surveillance or search and seizure, or inspect media service providers or, if applicable, their family members, their employees or their family members, or their corporate and private premises, on the ground that they refuse to disclose information on their source”’.

24. The EDPS also understands that such prohibition cannot be absolute and unconditional and thus exceptions could be justified by an “overriding requirement in the public interest, in accordance with Article 52(1) of the Charter and in compliance with other Union law” . At the same time, the lack of further legal details framing such limitations and adducing safeguards in relation to the fundamental rights of the affected individuals actually could undermine the added value of the provision of Article 4(2)(b). Given the heterogeneous regulatory frameworks on the protection of journalistic sources at national level at the moment , it is not clear whether an ‘overriding requirement in the public interest’ should be understood narrowly, e.g. investigation of a serious crime or prevention of an imminent threat, or broadly, i.e. including also administrative inquiries. Therefore, the EDPS considers that, as it stands, the provision of Article 4(2)(b) of the Proposal does not provide enough safeguards and lacks legal clarity. In this regard, he invites the legislators to further define and restrict the possibility to waive the protection of journalistic sources and communications, in line with the principles of strict necessity and proportionality, taking into account the case law of the Court of Justice of the European Union and of the European Court of Human Rights.

25. With regard to the measures against spyware in Article 4(2)(c) of the Proposal, in addition to the above mentioned considerations, the EDPS would like to draw the attention on other important open questions and potential risks for the effective protection of the fundamental rights journalists and media service providers, including the right to personal data and privacy.

26. The EDPS recalls that, as already stated in his Preliminary remarks on modern spyware , highly advanced spyware (such as Pegasus) has the potential of causing unprecedented risks and damages not only to fundamental rights and the freedoms of individuals but also to democracy and the rule of law. Moreover, in his Preliminary remarks, the EDPS recommended a ban on the development and deployment of such spywares in the EU in order to effectively protect the fundamental rights and freedoms of citizens in the EU. Therefore, the EDPS strongly supports the Proposal’s aim to forbid the deployment of spyware in any device or machine used by media service providers or journalists.

27. At the same time, the EDPS considers that it is necessary to make a clear distinction between the ‘traditional’ interception and surveillance measures referred in Article 4(2)(b) of the Proposal and the deployment of spyware pursuant to Article 4(2)(c) of the Proposal.

28. The EDPS notes that, according to the definition of Article 2(16) of the Proposal, the term spyware is introduced as a 'product with digital elements specially designed to exploit vulnerabilities in other products with digital elements', while other publicly available definitions of spyware mostly focus on its nature as a type of malicious software (or malware), intended to perform harmful and undesirable operations such as the ones already described in the current definition . Furthermore, in his Preliminary remarks on modern spyware, the EDPS highlighted a number of other features of hacking tools like Pegasus which make them ‘a paradigm shift’ in terms of access to private communications and devices, able to affect the very essence of our fundamental rights, especially the right to privacy. In particular, the EDPS underlined the ability of such tools to grant complete and unrestricted access to the targeted device, to be deployed via “zero-click” attack, i.e. a hacking attack that does not require any action by the user to be triggered, and the difficulty to detect them .

29. In addition, as reflected in his Preliminary remarks on modern spyware , the EDPS considers that if such spyware tools are nevertheless used, such cases must be of an exceptional nature in order to be compatible with the EU legal order, such as the prevention of imminent terrorist attacks. However, despite the effort in Article 4(2)(c) of the Proposal to limit the exceptions to the prohibition of spyware, the EDPS is not convinced that the legal provision sufficiently defines the exceptional nature of any possible use of such highly intrusive technology and is able to prevent its wider or systematic deployment. Therefore, the EDPS considers that, as it stands, the provision of Article 4(2)(c) of the Proposal lacks precision, does not provide enough safeguards and thus could even be counterproductive to its objective by actually regularising the use of highly intrusive spyware technology beyond a very limited number of exceptional cases.

30. The EDPS remains convinced that the only viable and effective option to protect the fundamental rights and freedoms in the Union, including media freedom, against highly advanced military-grade spyware is a general ban on its development and deployment with very limited and exhaustively defined exceptions, complemented by robust safeguards, such as those suggested in the EDPS Preliminary remarks on modern spyware .

3.3. Independent oversight and cooperation between supervisory authorities

31. The EDPS notes that Article 4(3) of the Proposal provides for as an additional safeguard an obligation for Member States to designate an independent authority or body to handle complaints for breaches of Article 4, (2), points (b) and (c).

32. However, the EDPS considers that the Proposal lacks clarity as to how such designated independent authorities or bodies would differ from and/or relate to the already-existing national audio-visual regulators (provided for in Directive 2010/13/EU and whose tasks and powers are extended under the Proposal ) and the relevant national data protection authorities or other national authorities .

33. Furthermore, the EDPS notes that, while the Proposal provides for the designation of such national independent authorities or bodies, it does not set out any form of guarantee of independence of such authorities or bodies (including specific independence criteria) in order to reconcile the various interests and rights at stake. Therefore, the EDPS strongly recommends that the future Regulation explicitly set out specific independence guarantees of the designated authorities or bodies under Article 4(3), such as protection against direct or indirect external influence, sufficient resources, etc. .

34. In addition, the EDPS would like to remind the inherent challenges, both legal and practical, for the effective supervision of surveillance measures, especially when carried out for national security purposes by intelligence agencies. In this regard, the EU Fundamental Rights Agency (‘FRA’), building on its research, highlighted several specific aspects, directly related to the ability of an oversight or supervisory body to investigate the complaints, such as the access to classified information and the relevant expertise of the staff of the supervisory authority, given the highly technical nature and sophistication of the surveillance measures . These elements, in addition to the requirements for independence, should be taken into account when Member States are designating the respective national authority or body.

35. The EDPS considers it necessary to ensure effective cooperation and complementarity with already-existing national supervisory authorities, this being necessary to also increase transparency and accountability of the actors regulated by the Proposal. In this regard, the EDPS strongly recommends that the future Regulation: (1) provide for an explicit legal basis for cooperation between the relevant supervisory authorities, each acting within their respective areas of competence; (2) require a structured cooperation between the competent supervisory authorities, including data protection authorities; (3) make explicit reference to the national competent supervisory authorities involved in the cooperation and identify the circumstances in which cooperation should take place.

36. In addition, the EDPS also recommends ensuring that the independent competent authorities designated under the future Regulation have the power and duty to consult with the relevant other national competent supervisory authorities, including data protection authorities, in the context of their investigations and compliance assessments. With regards to national data protection authorities, the EDPS also recommends clarifying that competent independent authorities under the future Regulation should be able to provide to the competent supervisory authorities under the GDPR and the LED, upon request or on their own initiative, any information obtained in the context of any audits and investigations that relate to the processing of personal data and to include an explicit legal basis to that this effect.

37. In any event, the EDPS stresses the need to avoid possible interference or other conflict by the designated authority or body under 4(3) of the Proposal with the activities of the existing supervisory authorities, in particular those competent under the GDPR, the LED, and the ePrivacy Directive.

38. Lastly, the EDPS notes a potential gap in the scope of the supervision of the various obligations envisaged in the Proposal. The independent authority or body designated pursuant to Article 4(3) of the Proposal would be only competent to handle complaints about regarding breaches of paragraph 2, points (b) and (c) of that Article. At the same time, according to Article 7 of the Proposal, the national regulatory authorities or bodies referred to in Article 30 of Directive 2010/13/EU would only be responsible for the application of Chapter III of the future Regulation. Thus it seems that no national authority or body would actually be competent for the supervision of enforcement of important rules in the Proposal, in particular the prohibition to interfere in or try to influence in any way, directly or indirectly, editorial policies and decisions by media service providers pursuant to Article 4(2)(a) of the Proposal or the transparency obligations pursuant to Article 6(1) of the Proposal.

3.4. Publication of personal data of beneficial owners

39. The EDPS notes that Article 6(1) of the Proposal provides that “[m]edia service providers providing news and current affairs content shall make easily, directly and permanently accessible to the recipients of their services at least the following information: a) their legal name and contact details, b) the name(s) of their direct or indirect owner(s) with shareholdings enabling them to exercise influence on the operation and strategic decision making and c) the name(s) of beneficial owners within the meaning of Article 3(6) of Directive (EU) 2015/849” (‘the anti-money laundering Directive’). It stems from the impact assessment report accompanying the Proposal, that the rationale for such access by recipients of media services is to ensure transparency on the factors that can influence editorial decisions and media accountability vis-à-vis their audiences. The EDPS understands and welcomes the obligation to make certain categories of personal data public in order to achieve transparency and specific objectives of public interest. However, given the interference to the fundamental rights to privacy and data protection stemming from the publication of such personal data, the EDPS recommends specifying explicitly in the future Regulation the objective(s) of public interest pursued with this provision.

40. Such access would enhance the effects of Commission Recommendation (EU) 2022/1634 of 16 September 2022 on internal safeguards for editorial independence and ownership transparency in the media sector, as per its section III on media ownership transparency . It would also enhance the effects of the revised AVMSD by establishing an obligation to make such information accessible and by expanding both its personal scope (it would apply to any media company and not only audiovisual) and material scope (it would ensure the availability of information on the interests and activities of media companies’ owners in other media or non-media economic sectors). Additionally, it would complement the horizontal instruments, which do not require the disclosure of such information . 13

41. However, the EDPS understands that, as Article 6(1) of the Proposal refers to ‘at least the following information’ with reference to the categories of information to be made available, the list may not be exhaustive. In this regard, the EDPS notes that the categories of personal data to be made publicly available should be clearly and exhaustively defined as well, taking into account the principles of necessity and proportionality . To this end, for the sake of clarity and foreseeability of provisions laying down limitations to fundamental rights the EDPS recommends ensuring that the list of categories of information to be made available be clearly defined and explicitly outlined in the future Regulation.

3.5. Exchange of information between national regulatory authorities or bodies

42. The EDPS notes that Article 13(1) of the Proposal provides, within the section on regulatory cooperation and convergence, that ‛[a] national regulatory authority or body may request (‘requesting authority’) cooperation or mutual assistance at any time from one or more national regulatory authorities or bodies (‘requested authorities’) for the purposes of exchange of information or taking measures relevant for the consistent and effective application of this Regulation or the national measures implementing Directive 2010/13/EU. .

43. In this regard, the EDPS understands that, due to the nature and purpose of such cooperation between two (or more) national regulatory authorities or bodies, personal data may also be processed. However, the EDPS notes that no reference is made to the categories of information that would be processed within the cooperation, including personal data.

44. Moreover, the EDPS also underlines that, should any personal data be processed throughout the cooperation or mutual assistance mechanism, this would require specific clarification as to the roles and responsibilities within the meaning of data protection law between the national regulatory authorities and bodies involved. This is also particularly relevant in order to ensure that the data subjects can fully exercise their rights under the GDPR.

45. Consequently, the EDPS considers that the future Regulation should explicitly clarify whether any personal data would be processed. If so, the Proposal should also specify the purpose for processing, the specific categories of personal data to be processed, the data retention period and the identification of the roles and responsibilities of the national regulatory authorities and bodies within the meaning of data protection law.

4. Conclusions

46. In light of the above, the EDPS makes the following recommendations: (1) to add an explicit reference to ‘journalists’ to the relevant provisions of the future Regulation, so as to any journalist, including free-lance or self-employed, would fall within the scope of the future Regulation and thus could also be able to rely on a robust protection of journalistic sources and communication and to clarify the criteria for determining when a journalist falls within the jurisdiction of a Member State; (2) to horizontally clarify that the future Regulation is without prejudice to and does not affect the EU legislation on personal data protection and privacy, in particular the GDPR, the ePrivacy Directive and the LED; (3) to further define and restrict the possibility to waive the protection of journalistic sources and communications under Article 4(b) and(c) of the Proposal, in line with the principles of strict necessity and proportionality. In particular, the EDPS remains convinced that the only viable and effective option to protect the fundamental rights and freedoms in the Union, including media freedom, against highly advanced military-grade spyware is a general ban on its development and deployment with very limited and exhaustively defined exceptions, complemented by robust safeguards, such as those suggested in the EDPS Preliminary remarks on modern spyware ; (4) to ensure that future Regulation explicitly set out specific guarantees of independence for the authorities or bodies in charge of handling complaints in relation to breaches of Article 4(2)(b) and (c) of the Proposal; (5) to ensure that the future Regulation: (1) provide for an explicit legal basis for cooperation between the relevant supervisory authorities, each acting within their respective areas of competence; (2) require a structured cooperation between the competent supervisory authorities, including data protection authorities; (3) make explicit reference to the national competent supervisory authorities involved in the cooperation and identify the circumstances in which cooperation should take place. In particular, the EDPS recommends ensuring that the independent competent authorities designated under the future Regulation have the power and duty to consult with the relevant other national competent supervisory authorities, including data protection authorities, in the context of their investigations and compliance assessments. With regard to national data protection authorities, the EDPS also recommends clarifying that competent independent authorities under the future Regulation should be able to provide to the competent supervisory authorities under the GDPR and the LED, upon request or on their own initiative, any information obtained in the context of any audits and investigations that relate to the processing of personal data and to include an explicit legal basis to that effect; (6) to specify explicitly in the future Regulation the objective(s) of public interest pursued with Article 6(1) on the information that media service providers should make accessible concerning their owners and beneficial owners and to ensure that the list of categories of information to be made available under Article 6(1) of the Proposal be clearly defined and explicitly listed in the future Regulation; and (7) to explicitly clarify whether any personal data would be processed in the context of the cooperation between national regulatory bodies under Article 13 of the Proposal and, if so, to also specify the purpose for processing, the specific categories of personal data to be processed, the data retention period and the identification of the roles and responsibilities of the national regulatory authorities and bodies within the meaning of data protection law. Brussels, 11 November 2022 (e-signed) Wojciech Rafał WIEWIÓROWSKI 16