EDPS Opinion 35/2023 on the Proposal for a Directive on ship-source pollution and on the introduction of penalties, including criminal penalties, for pollution offences

25 July 2023

Opinion 35/2023 on the Proposal for a Directive on ship-source pollution and on the introduction of penalties, including criminal penalties, for pollution offences

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Directive of the European Parliament and of the Council amending Directive 2005/35/EC on ship-source pollution and on the introduction of penalties, including criminal penalties, for pollution offences .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 1 June 2023, the European Commission issued the Proposal for a Directive of the European Parliament and of the Council amending Directive 2005/35/EC on ship-source pollution and on the introduction of penalties, including criminal penalties, for pollution offences.

The EDPS welcomes that the Proposal would require Member States to anonymise information relating to penalties when reporting on actions undertaken by their competent authorities. As other categories of reporting information listed in the Proposal might also contain personal data, the EDPS recommends extending the obligation to anonymise personal data to those additional categories.

As regard the reporting of potential infringements, the EDPS welcomes the fact that the Proposal would require the Commission to ensure the protection of the whistle-blowers when putting in place a centralised online external reporting channel.

While the Proposal does not explicitly state that the Commission acts as a controller for the processing of personal data, this follows implicitly from the competence and tasks of the Commission as regards the centralised online external reporting channel. The EDPS recommends explicitly clarifying in the Proposal that the Commission acts as a controller in relation the centralised online external reporting channel. In addition, he recommends establishing the maximum storage period for any personal data collected.

The Proposal states that the Commission may restrict the application of data subject rights in relation to data subjects who are part of or mentioned in the report submitted through the centralised online external reporting channel and who are not the data subjects submitting this report. In this regard, the EDPS recalls that certain data subject rights and EUI obligations may be restricted only when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society, aim to safeguard one of the objectives specifically listed in Article 25 EUDPR, and be in line with other requirements laid down in that provision. Against this background, the EDPS recommends re-assessing certain restrictions envisaged by the Proposal and ensuring that those restrictions are limited to what is both necessary and proportionate.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 1 June 2023, the European Commission issued the Proposal for a Directive of the European Parliament and of the Council amending Directive 2005/35/EC on ship-source pollution and on the introduction of penalties, including criminal penalties, for pollution offences (‘the Proposal’).

2. According to its Explanatory Memorandum, the general objective of the Proposal is to ensure that persons responsible for discharges of polluting substances into sea are subject to effective, proportionate and dissuasive penalties, in order to improve maritime safety and to enhance protection of the marine environment from pollution by ships.

3. The specific objectives of the Proposal are to: • incorporate international standards into EU law by aligning the Directive with Marpol Annexes on discharges into the sea; • support Member States by building their capacity to detect pollution incidents, verify, collect evidence and effectively penalise identified offenders in a timely and harmonised manner; • ensure that persons (natural and legal) responsible for illegal discharges from ships are subject to effective, proportionate and dissuasive penalties; and • ensure simplified and effective reporting on ship-source pollution incidents and follow-up activities.

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 1 June 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 20 of the Proposal.

2. General remarks

5. The EDPS welcomes the objectives of the Proposal, namely ensuring that persons responsible for discharges of polluting substances into sea are subject to effective, proportionate and dissuasive penalties, in order to improve maritime safety and to enhance protection of the marine environment from pollution by ships.

6. The EDPS notes that the Proposal would entail processing of personal data, notably personal data relating to reports of potential infringements as well as relating to the electronic reporting tool.

7. Having this in mind, the EDPS welcomes Recital 23 of the Proposal stating:“[t]his Directive respects the fundamental rights and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union, including the protection of personal data (...)”. The EDPS recommends including an additional recital in the Proposal recalling that the EUDPR and the General Data Protection Regulation (‘GDPR’) apply to any processing of personal data carried out under the Proposal.

3. Anonymisation of personal data

8. According to Article 10a(1) of the Proposal, the Commission shall establish an electronic reporting tool, for the purposes of collection and exchange of information between the Member States and the Commission on the implementation of the enforcement system provided by the Proposal. Paragraph 2 of the same Article lists the information that should be reported by the Members States through the electronic reporting tool.

9. The EDPS welcomes Article 10a(2)(d) of the Proposal providing for the anonymisation of information relating to penalties that include personal data. As the other categories reporting information listed in the Proposal might also contain personal data, the EDPS recommends extending the obligation to anonymise personal data to those additional categories.

4. Protection of persons who report potential infringements

10. Article 10d of the Proposal would require the Commission to make available a confidential online external reporting channel for receiving reports on potential illegal discharges and to relay such reports to the Member State or Member States concerned . The centralised reporting channel, which would complement existing reporting channels provided at national level, should ensure the protection of the confidentiality of the identity of reporting persons in accordance with Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (‘Directive (EU) 2019/1937’).

11. The EDPS welcomes that the Proposal would require the Commission to ensure the protection of the whistle-blowers . At the same time, the EDPS recalls that personal data must not be kept in a form which permits identification of data subjects for longer than is necessary for the purposes for which the data are collected and/or further processed . Therefore, the EDPS recommends establishing the maximum storage period for processing of personal data in the Proposal.

12. While the Proposal does not explicitly state that the Commission acts as a controller for the processing of personal data, this follows implicitly from the competence and tasks of the Commission in relation to the centralised online external reporting channel. Therefore, the EDPS recommends specifying in the Proposal that the Commission acts as controller in relation the centralised online external reporting channel .

13. Pursuant to Article 10d(3), the Commission may restrict the application of Articles 14 to 22, 35, and 36, as well as Article 4 EUDPR for the data subjects who are part of or mentioned in the report submitted through the centralised online external reporting channel and who are not the data subjects submitting this report. According to recital 19 of the Proposal, the restrictions are meant to ensure the protection of the confidentiality of the identity of reporting persons as well as to prevent and address attempts to hinder reporting or to impede, frustrate or slow down follow-up of investigations.

14. The EDPS recalls that data subject rights and EUI obligations that may be restricted under Article 25(1) are exclusively those provided by Articles 14 to 22 EUDPR as well as Articles 35 and 36 EUDPR and Article 4 EUDPR (in so far as its provisions correspond to the rights and obligations provided for in Articles 14 to 22), when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society and aim to safeguard one of the objectives specifically listed under the EUDPR . As a result, restrictions to data protection rights need to be duly justified and targeted, following a necessity and proportionality test .

15. The EDPS recommends re-assessing the restrictions mentioned in Article 10d(3) and ensuring that any restrictions to data subject rights are both necessary and proportionate. For example, Article 10d(3) indicates that the Commission may restrict the application of Article 15 EUDPR. Article 15 EUDPR concerns information to be provided where personal data are collected from the data subject. As Article 10d(3) of the Proposals relates to personal data regarding individuals "who are not the data subjects submitting this report", Article 15 EUDPR would in any event not be applicable and therefore no restriction should be provided for.

16. In addition, the EDPS recalls that restrictions on data subject rights should as a general rule be provided for by legal acts and it is only in these matters and in absence of such legal act that restrictions may be provided for by internal rules . Consequently, the EDPS is of the view that restrictions on data subject rights, to the extent they are demonstrably necessary and proportionate, should be provided by the Proposal itself. The EDPS recalls that, in line with Article 25(2) EUDPR, such clauses restricting data subject rights must contain specific provisions including the specification of the controller (or categories of controllers), the categories of personal data and the relevant storage periods . Each of these elements should be clearly set out in the enacting terms of the Proposal.

5. Other specific comments

17. The EDPS notes that, under Article 10a(3) of the Proposal, the Commission would be empowered to adopt implementing acts laying down detailed rules on the procedure for reporting the information mentioned in paragraph 2 of this Article.

18. In this regard, the EDPS recalls that such draft implementing act can be expected to have an impact on the protection of personal data, and are therefore subject to the consultation obligation set out in Article 42(1) EUDPR.

6. Conclusions

19. In light of the above, the EDPS makes the following recommendations: (1) to include a recital in the Proposal recalling the applicability of the EUDPR and the GDPR to any processing of personal data carried out under the Proposal; (2) to extend the obligation to anonymise personal data to letters a), b) and c) of Article 10a (2); (3) to establish the maximum storage period for processing of personal data in the Proposal under Article 10d; (4) to specify the role of the Commission as controller regarding the centralised online external reporting channel under Article 10d; (5) to ensure that the restrictions envisaged in Article 10d (3) are limited to what is necessary and proportionate and to specify, in the enacting terms of the Proposal, each of the relevant elements listed in Article 25(2) EUDPR. Brussels, 25 July 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8