EDPS Opinion 40/2023 on the Proposal for a Regulation on European Statistics

06 September 2023

Opinion 40/2023

on the Proposal for a Regulation on European statistics

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal on the draft Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EC) No 223/2009 on European statistics . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 10 of July 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EC) No 223/2009 on European statistics (‘the Proposal’). The Proposal aims at making the legal framework governing European statistics fit for the future and improving the responsiveness of the European Statistical System to data needs.

The EDPS welcomes the objective of the Proposal, namely to make the legal framework governing European statistics fit for the future. The EDPS also recognises that new innovative approaches can bring promises for statistics and research. However, the EDPS has serious concerns regarding the indication that information relating to specific persons might be obtained from any source, including digital traces relating to specific persons held by private data holders. The EDPS considers that collection of personal data from such sources may not be necessary and proportionate to the aims pursued, having regard to the potential risks for the rights and freedoms of data subjects. Therefore, the EDPS considers it is necessary to clarify in the Proposal that only non-personal (anonymised) data will be requested from the private data holders by national statistical institutes or the Commission (Eurostat).

Insofar as the Proposal seeks to provide a legal basis to request personal data from private data holders, it should provide a clear and comprehensive overview of the categories of personal data concerned, taking into account the requirements of necessity and proportionality. Moreover, the sources from which those categories of personal data may be obtained should be clearly set out in the Proposal itself or in sectorial legislation. Further, the EDPS recommends that such sharing of personal data by private data holders shall make use of privacy-enhancing technologies and shall take place using a secure infrastructure.

As regards the collection of statistics from the Large-Scale IT systems (‘LSITs’) in the area of freedom, security and justice, the EDPS considers that the Proposal should be amended. In particular, the Proposal should clarify that LSITs statistics in the area of freedom, security and justice shall be gathered exclusively from the central repository for reporting and statistics (‘CRRS’). If necessary, the co-legislators could foresee in specific transitional measures until the CRRS is fully operational.

The EDPS welcomes that with regard to the sharing of data within the European Statistical System, the Proposal envisages the use of privacy-enhancing technologies. At the same time, the EDPS recalls that any sharing of personal data must in any event comply with all relevant provisions of the GDPR and EUDPR, including Article 89(1) GDPR and Article 13 EUDPR. The EDPS recommends introducing the use of pilot studies to test and assess the fitness of relevant privacy enhancing technologies.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 10 of July 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EC) No 223/2009 on European statistics (‘the Proposal’) .

2. Regulation No 223/2009 establishes the legal framework at Union level for the development, production and dissemination of European statistics.

3. The general objective of the Proposal is to make the legal framework governing European statistics fit for the future and to improve the responsiveness of the European Statistical System (‘ESS’) to data needs. The Proposal also seeks to provide a mechanism and tools for the ESS to react swiftly and in a collective and coordinated manner, to urgent data demands in times of crises .

4. More specifically, the Proposal seeks to allow statistical authorities to tap the full potential of digital data sources and technologies by enabling their reuse for European statistics. The Proposal would help make the ESS more efficient and effective by promoting data sharing and strengthening its coordination. The Proposal would also: (a) strictly preserve statistical confidentiality and data privacy; (b) update the tasks of ESS partners; (c) outline possible roles for using opportunities offered by digital transformation for more cost-efficient and less burdensome statistical production; and (d) specify new functions that statistical authorities could perform .

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 10 July 2023, pursuant to Article 42(1) of the EUDPR. The EDPS welcomes the reference to this consultation in recital (24) of the Proposal.

2. General remarks

6. The EDPS welcomes the objective of the Proposal, namely to make the legal framework governing European statistics fit for the future. New innovative approaches can bring promises for statistics and research, but will also pose risks and raise challenges, thus requiring the co-legislators to ensure that any potential benefits never come at the expense of individuals’ rights. To provide effective protection for the right of privacy and the right to the protection of personal data, the co-legislators should anticipate the potential risks and challenges that these promising approaches may bring and provide for appropriate safeguards .

7. The EDPS welcomes recitals (14) and (15) of the Proposal, which emphasise that the EUDPR and the GDPR apply to the processing of personal data carried out as part of the activities under the Proposal. The EDPS recalls that personal data must be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes . Under the GDPR and the EUDPR, further processing of personal data for statistical purposes is not considered to be incompatible with the original processing purposes, provided the conditions in Article 89(1) of the GDPR and Article 13 of the EUDPR are satisfied. In particular, these provisions stipulate that when personal data are (further) processed for statistical purposes, those data shall in principle be rendered anonymous (or alternatively pseudonymous), provided that the statistical purpose be fulfilled in this manner .

8. Against this background, the EDPS welcomes the clarification in recital (14) of the Proposal that the data provided under the Proposal should normally be aggregated to such a degree that individuals cannot be identified. For the sake of legal certainty, the EDPS recommends making specific reference to compliance with the safeguards relating to processing of personal data for statistical purposes under Article 89 of the GDPR and Article 13 of the EUDPR, in particular that the data should in principle be rendered anonymous.

3. New data sources and privately held data

9. Article 17b of the Proposal would allow national statistical institutes (‘NSIs’) or the Commission (Eurostat) to request a private data holder to make data and the relevant metadata available for developing and producing European statistics.

10. Article 17b and recital (9) of the Proposal specify that the possibility to request access to privately held data should be limited to the NSIs and the Commission (Eurostat) only. Further, it should be restricted to cases where the annual work programme has established the following conditions: (a) the data requested is necessary for the development and production of European statistics; and (b) the data cannot be readily obtained otherwise, or their reuse would result in a considerable reduction in the response burden on data holders and other businesses.

11. The EDPS notes that the concept of “privately held data” is not defined in the Proposal. Recital (7) indicates, however, that ‘accessing and re-using new data sources, which emerge as byproducts of digital services and the Internet of Things (IoT), is becoming vital for producing timely, suitably frequent and sufficiently detailed European statistics in a more efficient and less costly way’ . Furthermore, access to new data sources, including particularly to privately held data, has been a longstanding request by the ESS .

12. The EDPS understands that privately held data have the potential to help producers of official statistics to provide more accurate statistics that reflect topics of interest to users at a faster pace. However, he also points out that privately held data can be diverse, as it is understood to encompass a vast amount of data held by businesses, including transaction data from mobile telecom operators, sensor data from personal communication devices or from smart electricity consumption meters, road traffic loops, data obtained from the internet such as social media or web-scraped data from job vacancies' or real estate agencies' websites, scanner data, electronic reservation systems data, electronic data on credit card transactions , but also through IoT and provision of digital services.

13. The EDPS considers that collection of personal data from such sources may not be necessary and proportionate to the aims pursued, having regard to the potential risks for the rights and freedoms of data subjects. The EDPS underlines that further to offering a rich profile on individuals’ behaviour, such information could concern special categories of personal data and other sensitive data that would enable to draw even more intimate inferences on the data subjects’ life and could thus represent a significant risk for the rights and freedoms of data subjects .

14. In this regard, the EDPS welcomes Article 17c(2) of the Proposal, which provides that the requests for data by the NSIs and the Commission (Eurostat) shall follow the principle of data minimisation, be proportionate to the statistical need and concern, insofar as possible, non-personal data. However, the EDPS considers that only anonymised data should be requested and used for statistical purposes where privately held data are concerned . Therefore, the EDPS recommends deleting the wording "insofar as possible" from Article 17c(2) to ensure that only non-personal (anonymised) data will be requested from private data holders.

15. In addition, the EDPS recalls that data concerning the use of publicly available electronic communications services and public electronic communications networks, as well as the accessing or storing of information in the end-user’s terminal equipment, is subject to specific rules under the ePrivacy Directive . Such data and information may encompass both personal and non-personal data. The EDPS recalls that the ePrivacy Directive imposes specific limits on the processing of the data and information in scope of the Directive. Therefore, the EDPS considers it necessary to clarify that any processing of data pursuant a request for data under Article 17c shall be without prejudice to the ePrivacy Directive.

16. To be clear, the EDPS does not suggest that privately held personal data can never be used for the purpose of creating official statistics. However, the EDPS recalls that the mere reduction of the response burden for private data holders (by not requiring them to anonymize the data) cannot outweigh the potential impact on the fundamental rights and freedoms of the persons concerned . Moreover, due regard must be had to the sensitivity of the data at issue, taking into account the principles of necessity and proportionality. In case of processing of special categories of data, regard must also be had to the general prohibition included in Article 9 GDPR and Article 10 EUDPR.

17. To allow NSIs or the Commission (Eurostat) to request personal data from private data holders in specific circumstances, several amendments would be necessary. In particular, the Proposal should provide a clear and comprehensive overview of the categories of personal data that may be accessed and used or otherwise processed by the NSIs and the Commission (Eurostat). Moreover, the types of sources from which those categories of data may be obtained should be clearly set out. The specification of the categories of personal data and sources could be provided in the Proposal itself, or the Proposal could provide that this shall be done in sectoral statistical legislation.

18. When specifying the categories of data in the Proposal, the EDPS recalls first and foremost compliance with the data minimisation principle , which provide that personal data must be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed". As previously indicated, the processing of personal data, and in particular the processing of special categories of personal data or otherwise sensitive data that would enable drawing intimate inferences on the data subject’s life, may not be necessary and proportionate to the aims pursued.

19. Finally, the EDPS recommends adding in Article 17c that the sharing of personal data by private data holders with NSIs or the Commission (Eurostat) pursuant a request in accordance with Article 17b and 17c shall: (a) be based on technologies that are specifically designed to comply with Regulations (EU) 2016/679 and (EU) 2018/1725, particular regard to purpose limitation, data minimisation, storage limitation, integrity and confidentiality (similarly to what is provided in Article 17f(4) of the Proposal); and (b) take place using a secure infrastructure, to be set up by the requesting body, i.e., an NSI or the Commission (Eurostat) (similarly to what is provided in Article 17f(3) of the Proposal).

20. For completeness, the proposed requirement under point (b) under paragraph 19 of this Opinion should be accompanied by a provision requiring the NSIs and Commission (Eurostat) to set up a secure infrastructure to facilitate any sharing of personal data between them and private data holders.

4. Exceptional need to use the data

21. Article 17b and recital (6) of the Proposal indicate that data holders may also be obliged to make data available to an NSI or the Commission (Eurostat) based on an exceptional need, in accordance with the rules laid down in the Proposal for a Regulation on harmonised rules on fair access to and use of data (‘Data Act’) .

22. In this regard, the EDPS would like to reiterate the concerns expressed in the Joint Opinion of the EDPB and EDPS on the Data Act . The EDPB and EDPS expressed serious concerns on the lawfulness, necessity and proportionality of the obligation to make data available to public sector bodies and Union institutions, agencies or bodies in case of “exceptional need”. Any limitation on the right to personal data must be based on a legal basis that is adequately accessible and foreseeable and formulated with sufficient precision to enable individuals to understand its scope. In accordance with the principles of necessity and proportionality, the legal basis must also define the scope and manner of the exercise of their powers by the competent authorities and be accompanied by sufficient safeguards to protect individuals against arbitrary interference. In addition, the EDPB and the EDPS observed that the circumstances justifying the access are not narrowly specified and considered it necessary for the co-legislators to define much more stringently the hypotheses of emergency or exceptional need.

5. Collection of statistics from the Large-Scale IT systems (LSITs) in the Area of Freedom, Security and Justice

23. Article 17a(2a) would allow the Commission (Eurostat) to access, reuse and integrate relevant data and metadata from databases and interoperability systems maintained by Union bodies and agencies.

24. The EDPS recalls that as regards the soon to be interoperable Large Scale IT Systems (LSITs) in the area of freedom, security and justice, a repository for reporting and statistics (‘CRRS’) is to be established . It shall generate cross-system statistical data and analytical reporting for policy, operational and data quality purposes in accordance with the applicable legal instruments. This CRRS stores anonymised data extracted from the underlying EU information systems, the shared biometric matching service, the common identity repository and the multi-identity detector, in order to provide cross-system statistical reporting for policy, operational and data quality purposes. The EDPS recalls his formal comments, with several recommendations, on the CRRS .

25. The goal underpinning the establishment of the CRRS was to create a single point for retrieval of statistical information, leveraging the new possibilities of interoperability to avoid needing to retrieve statistics from the individual systems. It also plays an important role as a gateway and a filter to transform data which is stored for operational purposes (which is gathered and further processed by operational actors such as border guards and police officers), to statistical data that can be further used for general policymaking. Therefore, allowing parallel retrieval of data from any underlying system should not be pursued for the aim of (further) processing statistics – doing so would clearly undermine also the reason for existence of the CRRS in the first place.

26. With this in mind, the EDPS considers that Article 17a(2a) of the Proposal should be amended. In case the Commission (Eurostat) aims to collect LSITs statistics in the area of freedom, security and justice, the wording of Article 17a(2a) should be made more precise and clarify that for those systems statistics shall be gathered exclusively from the CRRS. The EDPS recommends that in case the co-legislators would like to provide for transitional measures until the CRRS is operational, they introduce a specific provision to this end.

6. Data sharing in the ESS

6.1. Privacy enhancing technologies

27. Article 17f of the Proposal provides that data shall be shared between NSIs and between NSIs and the Commission (Eurostat) exclusively for statistical purposes and for improving the quality of European statistics.

28. The EDPS welcomes recital (15) of the Proposal, which states that when data sharing entails processing of personal data according to the GDPR, the principles of purpose limitation, data minimisation, storage limitation and integrity and confidentiality should be applied. At the same time, the EDPS recalls that any sharing of personal data must in any event comply with all provisions of the GDPR and EUDPR , including among others also the principles of lawfulness, fairness, transparency, and accuracy. Further, the EDPS would like to specifically point out Article 89(1) GDPR and Article 13 EUDPR, which provide that when personal data are (further) processed for statistical purposes, those data shall in principle be rendered anonymous (or alternatively pseudonymous), provided that the statistical purpose be fulfilled in this manner, based on the data minimisation principle (necessity and proportionality) .

29. Article 17f(4) of the Proposal provides that the sharing of personal data shall be allowed and may take place on a voluntary basis provided, among others, it is based on privacy enhancing technologies that are specifically designed to comply with the GDPR and the EUDPR, with particular regard to purpose limitation, data minimisation, storage limitation, integrity and confidentiality .

30. The EDPS welcomes that, in order to enable effective data sharing in line with the GDPR, the Proposal sets as a condition the use of privacy-enhancing technologies. Privacyenhancing technologies are linked to the principle of data protection by design and by default . They are relevant in relation to the application of appropriate technical and organisational measures, among others to mitigate the data protection risks identified in the mandatory assessment by the controller. These measures shall be designed to implement the data protection principles effectively and integrate necessary safeguards into the data processing. Privacy-enhancing technologies address different privacy concerns, have different degrees of maturity, capacities and limitations. Therefore, the EDPS considers that controllers sharing data in this context should assess the maturity, suitability, cost and effectiveness in terms of possible impact on individuals’ fundamental rights.

31. In his Opinion on the proposal for a Regulation on European Statistics on population and housing, the EDPS welcomed that this proposal would oblige the Commission (Eurostat), in cooperation with the Member States, to: 1) evaluate the results of the pilot and feasibility studies on the uses of privacy enhancing technologies carried out; and 2) prepare reports on the findings of those studies . The EDPS believes that the use of pilot studies to test and assess the fitness of relevant privacy enhancing technologies is an approach with great potential and that its extension should be considered to all use cases of data sharing for European statistics. He therefore recommends introducing a similar obligation in the Proposal. He observes that the proposal for a Regulation on European Statistics on population and housing also provides the possibility for the Commission to adopt implementing acts laying down technical specifications for the data sharing and measures for the confidentiality and security of information, where pilot studies identify effective and secure data sharing solutions. He suggests the co-legislators to consider such option for the current Proposal as well.

6.2. Infrastructure to facilitate data sharing

32. Article 17b(4) of the Proposal provides, with regard to privately held data accessed in accordance with Article 17b(2), that “the Commission (Eurostat) may, in agreement with the NSIs, set up a secure infrastructure to facilitate the further sharing with the NSIs(...)”. Furthermore, Article 17f(3) of the Proposal provides that “[t]he Commission (Eurostat) shall set up a secure infrastructure to facilitate data sharing” and that the NSIs, and when relevant other national authorities (‘ONAs’), may use that secure data sharing infrastructure.

33. The EDPS welcomes the references to secure infrastructures in Article 17b(4) and Article 17f(3) of the Proposal. For completeness, the EDPS recalls that the use of a secure infrastructure is always an obligation when sharing personal data, in accordance with the requirements concerning security, confidentiality and integrity and data protection by design and by default as contained in the GDPR and EUDPR.

34. The EDPS notes that the Proposal does not specify the roles and responsibilities in setting up, operating and maintaining the secure infrastructure within the meaning of data protection law of the Commission (Eurostat), the NSIs and ONAs, when personal data is processed. The EDPS considers it necessary that the roles of the various actors involved as controller, joint controller or processor be clearly specified in the enacting terms of the Proposal.

6.3. Implementing acts

35. The EDPS notes that according to Article 17c(10) of the Proposal the Commission would be empowered to adopt implementing acts to supplement the Proposal by specifying the general technical arrangements for making data available for development and production of European statistics under this Article.

36. Furthermore, the Commission would be empowered to adopt the implementing acts that would set out the technical aspects of data sharing between the statistical authorities referred to in this Article 17f of the Proposal.

37. In this regard, the EDPS recalls that, when a proposal for legislation has a possible impact on the protection of personal data, the European Commission has to submit it to the EDPS for consultation.

Conclusions

In light of the above, the EDPS recommends the co-legislators to:

(1) make reference, in a recital, to compliance with the safeguards relating to processing of personal data for statistical purposes under Article 89 of the GDPR and Article 13 of the EUDPR and in particular that the data should in principle be rendered anonymous;

(2) clarify in Article 17a(2) of the Proposal that LSITs statistics in the area of freedom, security and justice shall be gathered exclusively from the CRRS. Insofar relevant, the co-legislators could provide for transitional measures until the CRRS is fully operational;

(3) clarify in Article 17c(2) of the Proposal that only non-personal (anonymised) data will be requested from private data holders, in particular by deleting the wording "insofar as possible" from Article 17c(2);

(4) clarify that any processing of data pursuant a request for data under Article 17c shall be without prejudice to the ePrivacy Directive;

(5) if the co-legislators wish to provide a framework allowing NSIs and the Commission to request personal data from private data holders in specific circumstances, to provide for:

o a clear and comprehensive overview of the categories of personal data that may be requested and of the types of sources from which those categories of personal data may

be obtained; and

o specific safeguards by requiring that sharing of data by private data holders shall be based on technologies that are specifically designed to comply with Regulations (EU) 2016/679 and (EU) 2018/1725 and shall take place using a secure infrastructure;

(6) introduce an obligation for the Commission (Eurostat) and the Member States to test and assess by means of pilot studies the fitness of relevant privacy enhancing technologies for data sharing within the ESS;

(7) consider providing the option for the Commission to adopt implementing acts laying down technical specifications for the data sharing and measures for the confidentiality and security of information, where pilot studies identify effective and secure data sharing solutions;

(8) specify, in the context of the infrastructure to facilitate data sharing, the roles of the various actors involved as controller, joint controller or processor in the enacting terms of the Proposal.

Brussels, 06 September 2023

Wojciech Rafał WIEWIÓROWSKI

[e-signed]

12