EDPS Opinion 29/2023 on the Proposal for a Directive on combating corruption

28 June 2023

Opinion 29/2023

on the Proposal for a Directive on combating corruption

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Directive of the European Parliament and of the Council on combating corruption, replacing Council Framework Decision 2003/568/JHA and the Convention on the fight against corruption involving officials of the European Communities or officials of Member States of the European Union and amending Directive (EU) 2017/1371 of the European Parliament and of the Council .

This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 3 May 2023, the European Commission issued a Proposal for a Directive of the European Parliament and of the Council on combating corruption, replacing Council Framework Decision 2003/568/JHA and the Convention on the fight against corruption involving officials of the European Commgunities or officials of Member States of the European Union and amending Directive (EU) 2017/1371 of the European Parliament and of the Council (‘the Proposal’). Its objective is to establish minimum rules concerning the definition of criminal offences and sanctions in the area of corruption, as well as measures to better prevent and fight corruption. It also aims to update the EU legislative framework, including by incorporating international standards binding on the EU, such as those of the United Nations Convention against Corruption (UNCAC).

The EDPS strongly supports the objective of the Proposal to further enhance and harmonise the legal framework on the fight against corruption in the EU. Corruption is an endemic phenomenon that takes multiple shapes and forms and may affect virtually all spheres and aspects of public life. It is highly damaging to society, to the economy and to individuals. In this regard, the EDPS shares the view of the Commission that the fight against corruption and the protection of fundamental rights are complementary, not conflicting, objectives. Nevertheless, any limitation on the exercise of fundamental rights and freedoms should be subject to the conditions set out in Article 52(1) of the Charter of Fundamental Rights, in particular the principle of proportionality. This is particularly relevant with regard to preventive measures such as publication online of conflict of interest and assets declarations.

The EDPS considers that, further to the envisaged criminal law measures (i.e. the approximation of definitions of criminal offences and alignment of criminal sanctions), the Proposal also provides an opportunity for setting common standards and thus harmonisation of the national legal frameworks of Member States in the area of prevention of corruption. To this end, the EDPS invites the Union legislators to enhance Article 3 of the Proposal in order to establish a comprehensive legal basis under Union law for the processing of personal data that is necessary to prevent corruption. In any event, the EDPS considers that the Proposal should clearly define what categories of personal data and of which categories of data subjects may be publicly disclosed as part of the measures for prevention of corruption, and under what circumstances, as well as the necessary safeguards applicable in such cases.

In addition, the EDPS recalls the applicability of the existing EU data protection legal rules in the field of prevention and fight against corruption. Finally, as regards the cooperation and exchange of information between competent national and EU authorities, the Proposal should clarify the suggested links between the Proposal and a number of other EU legal acts with very different objectives and scope, such as the passenger name record (PNR), European Travel Information and Authorisation System (ETIAS), Eurodac, and the Visa Information System (VIS).

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 3 May 2023, the European Commission issued a Proposal for a Directive of the European Parliament and of the Council on combating corruption, replacing Council Framework Decision 2003/568/JHA and the Convention on the fight against corruption involving officials of the European Communities or officials of Member States of the European Union and amending Directive (EU) 2017/1371 of the European Parliament and of the Council (‘the Proposal’).

2. The objective of the Proposal is to establish minimum rules concerning the definition of criminal offences and sanctions in the area of corruption, as well as measures to better prevent and fight corruption . It strives to update the EU legislative framework, including by incorporating international standards binding on the EU, such as those of the United Nations Convention Against Corruption (UNCAC) . The aim is to ensure that all forms of corruption are criminalised in all Member States, that legal persons may also be held responsible for such offences, and that offences incur effective, proportionate and dissuasive penalties. In addition, the Proposal lays down measures to prevent corruption and to facilitate cross-border cooperation .

3. This initiative is included in the Commission’s 2023 work programme and is related to a number of EU strategic policies and initiatives, such as the EU Security Union Strategy 8 9 (2020-2025) , the EU strategy to tackle organised crime (2021-2025) , the annual Rule of Law Report cycle, asset recovery and confiscation, anti-money laundering, protection of the Union’s financial interests, and others.

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 5 May 2023, pursuant to Article 42(1) of EUDPR. The EDPS recommends adding a reference to this consultation in recitals of the Proposal in accordance with the established practice .

2. General remarks

5. The EDPS strongly supports the objective of the Proposal to further enhance and harmonise the legal framework on the fight against corruption in the EU. Corruption is an endemic phenomenon that takes multiple shapes and forms and may affect virtually all spheres and aspects of public life, from the single market and the financial interests of the EU, through internal security, to rule of law, democracy and fundamental rights. Therefore, corruption is highly damaging to society, to the economy and to individuals.

6. The EDPS shares the view of the Commission that the fight against corruption and the protection of fundamental rights are complementary, not conflicting, objectives . Nevertheless, any limitation on the exercise of fundamental rights and freedoms should be subject to the conditions set out in Article 52(1) of the Charter of Fundamental Rights, in particular the principle of proportionality . From data protection perspective, this is specifically relevant with regard to preventive measures such as publication online of conflict of interest and assets declarations.

7. In this context, the EDPS believes that similarly to the envisaged criminal law measures, i.e. the approximation of definitions of criminal offences and alignment of criminal sanctions, the Proposal also provides an opportunity to set common standards and thus to harmonise the respective legal frameworks of Member States in the area of prevention of corruption.

3. Applicable data protection rules

8. The EDPS positively notes that Recital 38 of the Proposal, which indicates that the Proposal “respects fundamental rights and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union (the ‘Charter’) and in particular [...], the protection of personal data, [...]”. At the same time, the EDPS considers that the Proposal should be enhanced in order to ensure compliance with the Articles 7 and 8 of the Charter in the implementation the Proposal in domestic legislation (more on the topic in Section 4 of this Opinion).

9. Given the transversal and multifaceted nature of corruption, the various measures to prevent and suppress corruption fall within different policy and legal areas, such as criminal justice and law enforcement, administrative law, financial rules, public procurement, etc. This fact inevitably creates complexity and potential legal uncertainty, in particular as concerns the applicable data protection rules.

10. Personal data processing for criminal justice and law enforcement purposes must comply with the rules laid down in Directive (EU) 2016/680 (Law Enforcement Directive) . Furthermore, when operational personal data is processed by Union bodies, offices and agencies when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part Three TFEU, Chapter IX of the EUDPR applies. Processing of personal data by Europol or Eurojust, e.g. in the context of the cooperation envisaged in Article 24 of the Proposal, would therefore be subject to Chapter IX of the EUDPR, together with the specific data protection rules laid down in their respective basic acts. Adding further to the complexity, the European Public Prosecutor's Office (EPPO), which plays an essential role in the fight against corruption offences affecting the financial interests of the Union, still applies a stand-alone data protection regime.

11. At the same time, the processing of personal data in the context of administrative measures against corruption is also regulated by different data protection acts - the GDPR , if implemented by Member States authorities, and by the EUDPR, when carried out by an EU institution, body or agency.

12. The EDPS recalls that the overall intention of the Union legislator is to provide for a strong and coherent data protection framework in the Union. In this regard, Recital 5 EUDPR confirms that it is in the interest of a coherent approach to personal data protection throughout the Union, and of the free movement of personal data within the Union, to align as far as possible the data protection rules for Union institutions, bodies, offices and agencies with the data protection rules adopted for the public sector in the Member States. In the same spirit, Recital 10 EUDPR explicitly clarifies that the rules for the processing of operational personal data by Union bodies, offices or agencies should be consistent with Directive (EU) 2016/680.

13. In view of the above, in the interest of legal certainty, the EDPS recommends adding a recital clarifying the application of the various existing EU data protection legal rules in the context of the prevention and the fight against corruption.

14. On a more general note, the EDPS considers that the Proposal illustrates the need for further harmonization and consistency of Union data protection rules. Essentially, the rights and safeguards for individuals, as well as the accountability obligations throughout the EU data protection framework, should be consistent irrespective of who happens to be the data controller. The EDPS therefore reiterates his call for a comprehensive alignment of the EU data protection framework .

4. Prevention of corruption measures

15. The EDPS shares the view of the Commission that to root out corruption, repressive mechanisms alone may not be sufficient and that measures to prevent corruption, addressing in particular failings in integrity, undisclosed conflicts of interests or serious breaches of ethical rules may mitigate the need for criminal repression and may have wider benefits in promoting public trust and managing the conduct of public officials .

16. The EDPS notes that the Proposal contains one provision dedicated to the prevention of corruption, namely Article 3. Article 3 would require Member States to adopt a number of measures, including to ensure that key preventive tools such as an open access to information of public interest, effective rules for the disclosure and management of conflicts of interests in the public sector, effective rules for the disclosure and verification of assets of public officials and effective rules regulating the interaction between the private and the public sector are in place .

17. The EDPS is concerned by the relatively general language of Article 3 of the Proposal, which creates a risk of varying interpretations and divergent practices across Member States. In its current form, it is unclear what Member States must do to ensure “the highest degree of transparency” in public administration, or which measures would amount to “effective rules” for either the disclosure and management of conflicts of interests in the public sector or for the disclosure and verification of assets of public officials.

18. While transparency is undoubtedly one of the key guarantees for a democratically accountable public administration, it often has to be reconciled with the fundamental rights to privacy and data protection enshrined in Article 7 and Article 8 of the Charter. The EDPS is well aware that such balancing might be a difficult and complex exercise. At the same time, settled case law of the Court of Justice of the EU already provides important guidance to the Union and Member State legislators .

19. In particular, the CJEU judgment of 1 August 2022 in Case C-184/20 assesses, among other things, the impact on individual rights of public disclosure online of personal data included in the declarations on conflict of interests (or similar). The Court highlights that publication of such declaration has the effect of making the personal data freely accessible on the internet to the whole of the general public and, accordingly, to a potentially unlimited number of persons, with all the ensuing risks . Moreover, the publication of the content of declarations of private interests might be liable to disclose indirectly sensitive data of a natural person, which would constitute processing of special categories of personal data pursuant to Article 9(1) of the GDPR .

20. In addition, useful practical guidance can be found in Opinion 02/2016 on the publication of personal data for transparency purposes in the public sector of the former Article 29 Data Protection Working Party, succeeded by the European Data Protection Board (EDPB). In the document, the EU data protection authorities explain how to apply the data protection principles to the processing and publication of personal data for transparency purposes in the public sector, in particular when related to anti-corruption measures and the management and prevention of conflicts of interest. More specifically, when deciding whether to make information publicly available online, competent institutions should always bear in mind the consequences of doing so.

21. The EDPS invites the Union legislators to enhance Article 3 of the Proposal in order to establish a comprehensive legal basis under Union law for the processing of personal data that is necessary to prevent corruption.

22. In particular, Article 3 of the Proposal should be further developed in line with the case law of the CJEU, laying down common requirements that achieve a proper balance between the objective of general interest pursued and the fundamental rights enshrined in Articles 7 and 8 of the Charter.

23. In any event, the EDPS considers that the Proposal should clearly define what categories of personal data and belonging to which categories of data subjects (e.g. high level officials, members of law enforcement and the judiciary , etc.), may be publicly disclosed as part of the measures for prevention of corruption, and under what circumstances, as well as the necessary safeguards applicable in such cases.

5. Cooperation and exchange of information

24. The EDPS notes that the Article 24 of the Proposal envisages cooperation between Member States’ authorities, the Commission, Europol, Eurojust, the European Anti-Fraud Office (OLAF) and the European Public Prosecutor's Office (EPPO) in the fight against the criminal offences referred to in this Directive. In this respect, he notes that the scope of this cooperation is restricted to “their competence” and is "without prejudice to the rules on cross-border cooperation and mutual legal assistance in criminal matters".

25. The EDPS considers that Article 24 of the Proposal is not intended to provide any new legal basis, nor would it create any new mechanism for the exchange of operational personal data. Any processing of personal data in the context of the cooperation mentioned in Article 24 must be compliant with the relevant data protection legislation, as identified in Section 3 of this Opinion.

26. Against this background, the EDPS considers that Recital 33 of the Proposal does not accurately reflect the content of Article 24 of the Proposal. In particular, references to the passenger name record (PNR) , European Travel Information and Authorisation System

27. The EDPS therefore recommends revising Recital 33, in particular to clarify the links, if any, between the proposed Directive on combating corruption and the aforementioned legal acts, including those from the area of migration and asylum.

6. Conclusions

28. In light of the above, the EDPS makes the following recommendations: (1) to recall and clarify the applicability of the existing EU data protection legal rules in the context of the prevention and the fight against corruption; (2) to amend Article 3 of the Proposal in order to establish a comprehensive legal basis under Union law for the processing of personal data that is necessary to prevent corruption; (3) to clearly define what categories of personal data and of which categories of data subjects may publicly be disclosed as part of the measures for prevention of corruption, and under what circumstances, as well as the necessary safeguards in such cases; (4) to clarify the suggested links in Recital 33 between the proposed Directive on combating corruption and the referred legal acts, especially those from the area of migration and asylum; (5) to add a reference to this consultation with the EDPS in the recitals of the Proposal. Brussels, 28 June 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 10