EDPS Opinion 34/2023 on the Proposal for a Directive amending Directives (EU) 2009/65/EC, 2009/138/EC, 2011/61/EU, 2014/65/EU and (EU) 2016/97 as regards the Union retail investor protection rules.

18 July 2023

Opinion 34/2023 on the Proposal for a Directive amending Directives (EU) 2009/65/EC, 2009/138/EC, 2011/61/EU, 2014/65/EU and (EU) 2016/97 as regards the Union retail investor protection rules

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to Proposal for a Directive of the European Parliament and of the Council amending Directives (EU) 2009/65/EC, 2009/138/EC, 2011/61/EU, 2014/65/EU and (EU) 2016/97 as regards the Union retail investor protection rules .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 24 May 2023, the European Commission issued a Proposal for a Directive of the European Parliament and of the Council amending Directives (EU) 2009/65/EC, 2009/138/EC, 2011/61/EU, 2014/65/EU and 2016/97/EU of the European Parliament and of the Council as regards the strengthening of Union retail investor protection rules (‘the Proposal’). The objective of the Proposal is to strengthen the legislative framework to ensure that retail investors are empowered to take more informed investments decisions that better correspond to their needs and objectives and are adequately protected in the single market.

The EDPS acknowledges that the use of influencers, social media and behavioural data to advertise financial products and services impacts the protection of consumers and, consequently, recognises the need to better protect retail investors. In this respect, the EDPS welcomes the introduction of the obligation on investments firms, insurance undertakings and insurance distributors to keep records on all marketing communications carried out by them or by third parties on their behalf, including information related to selected targeted retail client/customer segment(s) or profiling determinants as well as the identity of any third party involved in the dissemination of the marketing communication.

Profiling can pose significant risks for individuals’ rights and freedoms, particularly where it is used to advertise riskier financial products to vulnerable consumers. Investment firms, insurance undertakings or distributors carrying out profiling for the purpose of tailoring marketing communications should fully comply with the GDPR, including its rules on the principles relating to the processing of personal data, lawful basis, transparency, data subject rights and automated decision-making.

As regards the retention of the records of marketing communications to be held by investment firms, insurance undertakings and insurance intermediaries, the EDPS recommends further justifying the proposed retention periods.

Finally, the EDPS understands that the exchange of information in the context of the collaboration platforms to be set up by the European Securities and Markets Authorities (ESMA) and the European Insurance and Occupational Pensions Authority (EIOPA) would not involve processing of personal data. Should these platforms be meant to enable the processing of personal data, then such processing should be made explicit, together with the relevant categories of personal data, purpose(s) of processing, relevant retention period and roles and responsibilities, according to data protection law.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 24 May 2023, the European Commission issued a Proposal for a Directive of the European Parliament and of the Council amending Directives (EU) 2009/65/EC, 2009/138/EC, 2011/61/EU, 2014/65/EU and 2016/97/EU of the European Parliament and of the Council as regards the strengthening of Union retail investor protection rules (‘the Proposal’).

2. The objective of the Proposal is to ensure that the legal framework for retail investments sufficiently empowers consumers, encourages improved and fairer market outcomes and ultimately creates the necessary conditions to grow retail investor participation in capital markets. The Proposal aims to increase consumers’ trust in capital markets by empowering them to take more informed investment decisions that better correspond to their needs and objectives and adequately protect them in the single market by a coherent regulatory framework .

3. The Proposal is in line with the new Capital Markets Union action plan issued by the Commission in September 2020. In this context, the Commission announced its intention to put forward a strategy for retail investments in Europe, aimed at ensuring that retail investors can take full advantage of capital markets and that they are supported by rules 4 that are coherent across all relevant legal instruments. The Proposal is also in line with the European Commission’s objective of “an economy that works for people” .

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 25 May 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 39 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to Recital 60 of EUDPR in relation to a draft version of the Proposal.

2. General remarks

5. The EDPS welcomes the objective of the Proposal, which aims to ensure a sufficient degree of investor protection as well as fairness, integrity and efficiency in the provision of investment and insurance-based investment services to retail investors. These objectives are in line with those of existing legislation governing retail investor protection at EU level, which consists of the Markets in financial instruments Directive (MiFID ) and the Insurance 8 9 Distribution Directive (IDD ) . In particular, given its focus on the increasing digitalisation of investment services and marketing, the Proposal is aligned with the Commission’s work on consumer protection in the context of digital finance , which aims at ensuring that consumers enjoy the benefits of digitalisation while being sufficiently protected from the risks arising from it. The Proposal is also relevant in context of the Proposal on financial data sharing as it provides a standardised report on suitability or appropriateness assessment, which should promote data sharing and re-use of such information by other firms selected by the client .

6. The EDPS welcomes the reference to the applicability of the GDPR and the EUDPR to all personal data processing pursuant to the Proposal in Recital 40. As the communications and marketing practices mentioned in the Proposal should also abide by the rules on unsolicited communications and confidentiality of communications contained Directive 2002/58/EC on privacy and electronic communications (‘ePrivacy Directive) , the EDPS also welcomes the reference to the ePrivacy Directive in Recital 40 of the Proposal. 5

3. Marketing communications and practices

7. The EDPS acknowledges that the use of influencers, social media and behavioral data to bolster and tailor advertising of financial products and services impacts advertising and the protection of consumers. Consequently, the EDPS recognises the need to address the changes brought by such practices to better protect retail investors, as highlighted by the Proposal .

8. The EDPS welcomes that the Proposal would introduce an obligation for Member States to ensure that “[...] marketing practices are developed and used in a manner that is fair and not misleading [...]” for recipients, and that they are also appropriate for the target audience .

9. The EDPS also welcomes the introduction of the obligation on investments firms , insurance undertakings and insurance distributors to keep records on all marketing communications carried out not only by them, but also by any third party remunerated or incentivised through non-monetary compensation by the investment firm. In particular, the EDPS welcomes the requirement to keep records of information related to targeted retail client/customer segment(s) or profiling determinants, as well as the identity of any third party involved in the dissemination of the marketing communication. The requirement to make such records available upon request to the competent supervisory authority could enhance the transparency and accountability of investments firms’ marketing practices towards competent supervisory authorities.

10. While transparency and accountability are basic principles of data protection, compliance with Article 1(3) of the Proposal does not equal compliance with the GDPR. The EDPS recognises that companies may wish to rely on profiling to segment markets and tailor services and products to align with individual needs. Profiling can, however, pose significant risks for individuals’ rights and freedoms, particularly where it is used to advertise riskier financial products to vulnerable consumers . From a data protection perspective, many risks relate to the possible lack of transparency and effective control of individuals regarding the processing of their personal data, as the underlying processing of personal data resulting in the delivery of a targeted marketing message, pricing or contractual conditions is often opaque . Therefore, the EDPS recalls that investment firms, insurance undertakings or distributors carrying out profiling of individuals for the purpose of tailoring marketing communications should fully comply with the GDPR, including its 6 rules on the principles relating to the processing of personal data, lawful basis, transparency, data subject rights and automated decision-making.

11. Additionally, the EDPS welcomes that Article 1(13) of the draft Proposal - which would introduce a new Article 24c(7) to Directive 2014/65/EU - and Article 2(42) - which would introduce a new Article 26a(7) to Directive 2016/97 (IDD) - proposes a maximum retention period to be applied to investment firms, insurance undertakings and insurance intermediaries’ records of marketing communications .

12. The EDPS acknowledges the attempt to justify this retention period in Recital 32, which refers to the fact that “[...] issues with financial products and services may arise several years after the investment”. At the same time, the EDPS recalls that one of the basic principles of data protection is that personal data is not kept in a form that permits identification of data subjects for longer than necessary for the purpose(s) for which the data were collected . In accordance with the Court of Justice of the European Union (CJEU) case law, the determination of the storage duration must be based on objective criteria, in order to ensure that it is limited to what is strictly necessary . In this regard, the EDPS is of the view that the justification for the chosen retention period, which refers in a broad manner to the fact that issues may arise several years after the investment, is not sufficiently precise and, therefore, recommends further substantiating it.

4. Publication of administrative decisions containing personal data

13. Article 1(4) and 2(24) of the Proposal, which would introduce respectively a new Article 5a MiFID and Article 35a IDD, would require the European supervisory authorities (ESMA) and the European Insurance and Occupational Pensions Authority (EIOPA) to publish on their websites warning lists in the form of decisions about unauthorised investment services or activities which would include the description of the natural or legal persons concerned . The provisions further specify that “As regards natural persons, this list shall not lead to the publication of more personal data of those natural persons than that published by the competent authority pursuant to the first subparagraph, and in accordance with Article 71(1) [of Directive 2014/65/EU].” 7

14. As stated in Recital 23 of the Proposal, “[...] When those actions concern a natural person, the publication of the decision made by the competent authority should remain subject to the case-by-case assessment of the proportionality of the publication of personal data provided under Article 71(1)”. The same Recital further specifies that “[...] to avoid the disclosure of personal information deemed disproportionate by a competent authority when publishing the consolidated list of all decisions issued by competent authorities, ESMA and EIOPA should abstain from disclosing any additional information compared to that disclosed by the competent authority itself”.

15. The EDPS welcomes this limitation, as he considers that the publication of personal data with the decisions of competent authorities should indeed be the exception, to be decided following a case-by-case assessment as prescribed in Article 1(4) and 2(24) of the Proposal. This would leave the option, following such assessment, to competent authorities to publish said personal data in cases of serious infringements and where strong dissuasive effects are needed. The EDPS notes that the publication of personal data of persons involved in European supervisory authorities’ decisions about unauthorised investment services or activities should only occur in duly justified exceptional cases, as making such types of personal data available to the general public could be considered as a serious interference with their fundamental rights enshrined in Articles 7 and 8 of the Charter.

5. Collaboration platforms by the European Securities and Markets Authorities (ESMA) and the European Insurance and Occupational Pensions Authority (EIOPA)

16. Articles 1(21) and 2(7) of the Proposal would introduce the new Article 87a MiFID and Article 12b IDD, with the possibility for - respectively - the ESMA and EIOPA to set up and coordinate a collaboration platform, to strengthen the exchange of information and to enhance collaboration between the relevant supervisory authorities.

17. The EDPS understands, based on the text of the Proposal, that the exchange of information that would take place in the context of this platform would not entail processing of personal data. If, however, the platforms in question are meant to allow European supervisory authorities to exchange personal data, the EDPS advises the co-legislators to specify explicitly whether personal data would be processed and if so, to define the relevant categories of personal data, the purpose(s) for which such personal data would be processed, the relevant retention period, as well as roles and responsibilities according to data protection law of the actors involved. 8

6. Conclusions

18. In light of the above, the EDPS makes the following recommendations: (1) to further justify the retention period for the records of marketing communications to be held by investment firms, insurance undertakings and insurance intermediaries, in line with the principle of storage limitation enshrined in Article 5(1)(e) GDPR; and (2) to the extent that the collaboration platforms to be set up by ESMA and EIOPA would entail the processing of personal data, to define the categories of personal data to be processed in this context together with the relevant purpose(s), retention period, as well as the roles and responsibilities of the actors involved. Brussels, 18 July 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 9