EDPS Opinion 33/2023 on the Proposal for a Regulation in matters relating to the protection of adults

18 July 2023

Opinion 33/2023

on the Proposal for a Regulation in matters relating to the protection of adults

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation on the European Parliament and of the Council on jurisdiction, applicable law, recognition and enforcement of measures and cooperation in matters relating to the protection of adults .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 31 May 2023, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on jurisdiction, applicable law, recognition and enforcement of measures, authentic instruments and powers of representation and cooperation in civil matters relating to the protection of adults, which, in addition to providing for the application of some of the rules of the Convention of 13 January 2000 on the International Protection of Adults in Member States, lays down complementary rules to facilitate an even closer intra EU cooperation in this area.

The Proposal is part of a package together with the Commission Proposal for a Council Decision authorising Member States to become or remain parties, in the interest of the European Union, to the Convention of 13 January 2000 on the International Protection of Adults.

While supporting the objective of the Proposal, the EDPS still recommends clarifying under Article 48(2) of the Proposal that access by requesting authorities to information recorded in a protection register shall be provided only where necessary for one or several of the purposes (to be determined) listed in Article 53(1) in relation to the vulnerable adult concerned by the ongoing proceedings before the requesting authorities.

Finally, he recommends clarifying under Article 49(2) of the Proposal that any other means of communication may be used only ʽwhere the use of the decentralised IT system is not appropriate in view of the specific circumstances of the communication in questionʼ.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 31 May 2023, the European Commission issued a Proposal for a Regulation on the European Parliament and of the Council on jurisdiction, applicable law, recognition and enforcement of measures and cooperation in matters relating to the protection of adults (‘the Proposal’).

2. The objective of the Proposal is to adopt the first legal instrument at Union level governing judicial cooperation between the Member States in cross-border cases in the field of the protection of adults who, by reason of an impairment or insufficiency of their personal faculties, are not in a position to protect their interests .

3. The Proposal builds on the Hague Convention of 13 January 2000 on the International Protection of Adults and on the Commission Proposal on digitalisation of judicial cooperation (ʽfuture Digitalisation Regulationʼ) .

4. In particular, the Proposal aims at harmonising the Member States’ rules in cross-border situations, on jurisdiction, applicable law, recognition and enforcement of protection measures and acceptance of authentic instruments. It would also set out rules giving effect to powers of representation in all Member States and create a European Certificate of Representation, to allow representatives to easily demonstrate the nature and extent of their powers across borders .

5. The Proposal would simplify and modernise the cooperation between Member States and strives to improve the provision of information concerning the protection of an adult to competent authorities within the Union with a view to ensuring that measures taken in another Member State or powers of representation granted by the adults in another Member State are respected within the Union. The objective is to ensure that the protection of adults is continuous in cross-border cases, and that their fundamental right to self-determination is respected when they move within the Union. The Proposal would therefore require Member States to establish one or more register(s) of protection measures taken by their authorities to protect an adult and of powers of representation where their national law provides for the confirmation of such powers by their authorities. The Proposal would also provide for the mandatory information concerning these powers and measures to be recorded in these registers and in electronic registers provided under national law recording information concerning other powers of representation which are registered by a competent authority, and where national law does not provide for the confirmation of such powers of representation (Articles 45 and 46). The Proposal would not preclude Member States from including additional documents or information in their protection registers, such as the name of the representative or the nature and extent of the representation (Article 45(4)).

6. In order to facilitate access by Member States’ authorities, the Proposal would then require the interconnection of the registers. The decentralised system for the interconnection would be composed of the Member States’ protection registers and of a central electronic access point to the information and provide a search service in all the official languages of the Union (Article 47). The information that would be accessed are both the mandatory information defined in Article 45(2) of the Proposal and any other documents or information included in the registers which the Member States would choose to make available through the system of interconnection (Article 47(2)). Access to the information would not be public but would be provided only to the authorities of the Member States, which also have access under their national law to the mandatory information defined in the Proposal and ʽhave a legitimate interest in accessing this informationʼ (Article 48(2)). Member States would have to communicate to the Commission the authorities having such access (Article 69(1)(m)).

7. As far as written communication between authorities is concerned, the Proposal would additionally provide for the use, as a rule, of electronic communications via a secure and reliable decentralised IT system to be established by the Commission, while allowing, for direct communication between authorities , the use of any other means of communication (Articles 49 and 60).

8. The Proposal would also provide for the optional use of electronic communication between natural and legal persons and competent authorities and issuing authorities, through the European electronic access point established on the European e-Justice Portal pursuant to the future Digitalisation Regulation (Article 50) .

9. The Commission would be responsible for the creation, maintenance and development of a reference implementation software which Member States may choose to apply as their back-end system (instead of a national IT system) for the purposes of the electronic communications (Article 61).

10. Implementing powers would be conferred on the Commission to ensure uniform conditions for the implementation of the future Regulation as regards the establishment of the decentralised IT system and the interconnection system for registers (Article 60). According to recital 48, the access points of the decentralised IT system should be based on the e- CODEX system established by Regulation (EU) 2022/850 .

11. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 1 June 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in recital 59 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

2. General remarks

12. The EDPS welcomes the clear references to Regulation (EU) 2016/679 (‘the GDPR’), the EUDPR and the Directive 2002/58/EC in recitals 53 and 56 of the Proposal.

13. He also welcomes the specifications of the purposes of the processing of personal data and the roles and responsibilities of Member States’ authorities and the Commission regarding the processing of personal data . In particular, the EDPS notes that both Member States' competent authorities and Central Authorities would process personal data for the purposes set out in the Proposal and that they are all regarded as controllers in Article 53(3) of the Proposal, while, under Article 53(4) of the Proposal, the Commission is deemed the controller with respect to personal data processing by the European electronic access point pursuant to Article 50 for the purposes of providing for electronic communications means with Member States’ competent authorities that natural and legal persons may use in connection with specific proceedings and applications under the future Regulation.

14. Additionally, it is clear from the Proposal that, in order to fulfil their tasks, national authorities would inevitably need to process personal data, including special categories of personal data, in particular health data of the adults concerned by the Proposal . The EDPS would like to recall in this regard that the GDPR and the EUDPR in principle prohibit the processing of special categories of personal data except where the processing takes place in accordance with Article 9(2) GDPR or Article 10(2) EUDPR. Even in the cases covered under Article 9(2)(f) and (g) GDPR or 10(2)(f) or (g) EUDPR, the processing of such categories of personal data has to be necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity or for reasons of substantial public interest. With regard to the latter, such processing must be carried out on the basis of Union or Member State law, which must be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. The EDPS therefore welcomes recitals 56 and 57, which clarify that, on the one hand, the future Regulation should provide for the legal basis for processing of personal data by Member States’ competent authorities and Central Authorities under Article 6(1) and (3) GDPR as well as by the Commission pursuant to Article 5(1) and (2) EUDPR and on the other hand, that such special category of data will be processed in conformity with Article 9(2)(f) or (g) GDPR and Article 10(2)(f) or (g) EUPR.

15. He also welcomes that recitals 57 and 58 clarify the special category of personal data within the meaning of the GDPR and the EUDPR that may be processed on the basis of the Proposal as well as the measures to safeguard the fundamental rights and the interests of the data subject required in Article 9(2)(g) GDPR and Article 10(2)(g) EUDPR.

16. Finally, the EDPS notes that under Article 47 of the Proposal, the Commission must establish a system for the interconnection of the national registers by means of implementing acts, composed of the registers and of a central electronic access point to the information in the system. He welcomes that it is clarified in recital 46 that the Proposal should provide legal basis for that interconnection.

3. Purposes of the processing of personal data by national authorities

17. While the EDPS acknowledges that Article 53(2) of the Proposal recalls that the processing of personal data under the future Regulation must be limited to the extent necessary for its purposes, he recommends introducing a similar clarification in Article 48(2) on the access by requesting authorities to information recorded in a protection register: instead of referring to the ‘legitimate interest’ of the authority - which might then lead to confusion with the GDPR legal basis under Article 6(f) - the provision should state that access shall be provided only where necessary for one or several of the purposes (to be determined) listed in Article 53(1) in relation to the vulnerable adult concerned by the ongoing proceedings before the requesting authorities.

4. Direct communications between authorities

18. It stems from Article 49(2) that for direct communications between authorities, any other means of communication may be used instead of the decentralised IT system. Recital 50 explains that in certain cross-border procedures for the protection of adults, other means of communication than communication through the decentralised IT system could be more appropriate, in particular where direct personal communication is needed so that less formal communication means, such as email, could be used.

19. The EDPS notes in this regard that Article 49(1) does not make the use of decentralised IT system mandatory for any communications but only for written ones. As far as the latter are concerned, the EDPS recommends, to both ensure the security of the data and take account of the potential needs on the ground, that the enacting terms of the Proposal better reflect the subsidiary nature of these other means of communications, for instance by using the 7 following wording: ʽWhere the use of the decentralised IT system is not appropriate in view of the specific circumstances of the communication in question, any other means of communication may be usedʼʼ.

5. Conclusions

20. In light of the above, the EDPS makes the following recommendations: (1) to clarify under Article 48(2) of the Proposal that access by requesting authorities to information recorded in a protection register shall be provided only where necessary for one or several of the purposes (to be determined) listed in Article 53(1) in relation to the vulnerable adult concerned by the ongoing proceedings before the requesting authorities; (2) to clarify under Article 49(2) of the Proposal that any other means of communication may be used only ʽwhere the use of the decentralised IT system is not appropriate in view of the specific circumstances of the communication in questionʼ. Brussels, 18 July 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8