EDPS Opinion 36/2023 on the Proposal for a Regulation on compulsory licensing for crisis management

28 July 2023

Opinion 36/2023

on the Proposal for a Regulation on compulsory licensing for crisis management

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to Proposal for a Regulation of the European Parliament and of the Council on compulsory licensing for crisis management and amending Regulation (EC) 816/2006 .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 27 April 2023, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on compulsory licensing for crisis management and amending Regulation (EC) 816/2006.

The Proposal aims to enable the European Union to rely on compulsory licensing in the context of the EU crisis instruments. Moreover, it would introduce a compulsory licensing scheme which would allow for a rapid and appropriate response to crises, while guaranteeing the supply and the free movement of crisis-critical products subject to compulsory licensing in the internal market.

Regarding the procedure for the granting of a Union compulsory license, the EDPS considers that the Proposal lacks clarity as to whether the notice to be published under Article 7(5) of the Proposal would include information that may amount to personal data. Should this be the intention, it should be duly justified and clearly stated in Article 7(5) of the Proposal, as such specification of the information to be published would also increase legal certainty.

The Proposal would require the Commission to publish decisions on fines and periodic penalty payments, including the names of the parties concerned. The EDPS considers that the publication of information related to persons who are involved in the decisions on fines and periodic penalty payments should only occur in duly justified exceptional cases. The EDPS therefore recommends amending the Proposal to ensure that publication of personal data remains the exception, with the option by competent authorities to publish personal data in cases of serious infringements and where strong dissuasive effects are needed.

Lastly, with regards to the reporting on national compulsory licenses, the EDPS notes that the Proposal does not specify the respective roles and responsibilities of the Commission and the Member States within the meaning of data protection legislation. As the information provided may include personal data, the EDPS recommends to specify the roles and responsibilities of the Commission and the Member States within the meaning of data protection law with regards to the processing of personal data of licensees.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 27 April 2023, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on compulsory licensing for crisis management and amending Regulation (EC) 816/2006 (‘the Proposal’).

2. According to its Explanatory Memorandum, the objective of the Proposal is twofold. First, it aims to enable the European Union to rely on compulsory licensing in the context of the EU crisis instruments. Secondly, it would introduce a compulsory licensing scheme which would for allow a rapid and appropriate response to crises, while guaranteeing the supply and the free movement of crisis-critical products subject to compulsory licensing in the internal market .

3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 5 June 2023, pursuant to Article 42(1) of EUDPR.

2. General remarks

4. The EDPS welcomes the objectives of the Proposal to establish a compulsory licence for crisis or emergency management at Union level. Under this system, the Commission would be empowered to grant a compulsory licence, valid throughout the Union, allowing the manufacturing and distribution of products necessary to address a crisis or emergency in the Union (‘Union compulsory licence’) .

5. The EDPS understands that the Proposal would entail processing of personal data, both by national competent authorities and by the European Commission. The EDPS therefore recommends including a recital in the Proposal recalling that the EUDPR and the General Data Protection Regulation (‘GDPR’) apply to any processing of personal data carried out under the Proposal.

6. In the chapters below, the Opinion provides specific comments and recommendations on the processing of personal data by national competent authorities and the Commission, in particular with regards to the procedure for granting a Union compulsory licence , the 8 9 publication of decisions and the reporting on national compulsory licenses .

7. Lastly, the EDPS notes that the Proposal does not contain any recital referring to this consultation. Therefore, the EDPS recommends that a recital be added to the Proposal containing specific reference to the consultation of the EDPS under Article 42(1) EUDPR.

3. Procedure for granting a Union compulsory license

8. Article 8 of the Proposal specifies the content of a Union compulsory license. In particular, Article 8(1)(c)(2) and 8(1)(c)(3) of the Proposal states that, among others, the information about the licensee will include the contact details and the unique identification number in the country where the licensee is established. The EDPS understands that, in the vast majority of cases, licensees under the Proposal would be legal and not natural persons.

9. In this regard, the EDPS recalls that Article 4(1) GDPR defines personal data as ‘any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, or to one or more factors specific to the identity of that natural person’. In some cases, also data concerning legal persons may be considered as personal data, as clarified by the Court of Justice of the European Union (‘CJEU’) . In these cases, the determining factor is whether the information ‘relates to’ an ‘identifiable’ natural person.

10. The EDPS also notes that Article 7(5) of the Proposal specifies that, when granting a Union compulsory license, the Commission “(...) will publish a notice to inform the public about the initiation of the procedure (...)”. Moreover, “[t]he notice shall be published in the Official Journal of the European Union”.

11. The EDPS understands that the notice to be published under Article 7(5) of the Proposal would not necessarily include all of the elements listed in Article 8(1) of the Proposal. That being said, the EDPS considers that the Proposal lacks clarity as to whether the notice would include information that may amount to personal data. Should this be the intention, it should be duly justified and clearly stated in Article 7(5) of the Proposal. Further specification of the information to be published would also increase legal certainty.

4. Publication of decisions

12. Article 20(1) of the Proposal states that the Commission will publish the adopted decisions on fines and periodic penalty payments and that “[s]uch publication shall state the names of the parties and the main content of the decision, including any fines or penalties imposed."

13. The EDPS considers that the publication of information related to persons who are involved in the decisions on fines and periodic penalty payments should only occur in duly justified exceptional cases, as making such data available to the general public could be considered as a serious interference with their fundamental rights enshrined in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’). The EDPS therefore recommends amending the Proposal to ensure that publication of personal data remains the exception, with the option by competent authorities to publish personal data in cases of serious infringements and where strong dissuasive effects are needed.

5. Reporting on national compulsory licenses

14. Article 22 of the Proposal states that, where a national compulsory licence has been granted for the purpose of addressing a national crisis or emergency, the Member State will notify the Commission of the granting of the licence and of the specific conditions attached to it. The information to be provided would include, among others, the name and address of the licensee.

15. The EDPS notes that the Proposal does not specify the respective roles and responsibilities of the Commission and the Member States within the meaning of data protection legislation. A clear allocation of roles and responsibilities between EU institutions and the national authorities is important, in particular with a view of ensuring transparency and the exercise of data subject’s rights. As the information provided may include personal data, the EDPS recommends to specify the roles and responsibilities of the Commission and the Member States within the meaning of data protection law with regards to the processing of personal data of licensees.

6. Conclusions

16. In light of the above, the EDPS makes the following recommendations: (1) to include a recital in the Proposal recalling the applicability of the EUDPR and the GDPR to any processing of personal data carried out under the Proposal; (2) to further clarify what categories of information on the Union compulsory license procedure would be published by the Commission under Article 7(5) of the Proposal; (3) to ensure that information related to persons who are involved in the decisions on fines and periodic penalty payments is only made publically available in duly justified cases following a case-by-case assessment; (4) to specify the roles of the Commission and the Member States within the meaning of data protection law with regards to any processing of personal data under Article 22 of the Proposal. Brussels, 28 July 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7