EDPS Opinion 41/2023 on the Proposal for a Regulation on European Union labour market statistics on businesses

25 September 2023

Opinion 41/2023

on the Proposal for a Regulation on European Union labour market statistics on businesses

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on European Union labour market statistics on businesses, repealing Council Regulation (EC) No 530/1999 and Regulations (EC) No 450/2003 and (EC) No 453/2008 of the European Parliament and of the Council .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 28 July 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on European Union labour market statistics on businesses, repealing Council Regulation (EC) No 530/1999 and Regulations (EC) No 450/2003 and (EC) No 453/2008 of the European Parliament and of the Council (‘the Proposal’). The EDPS welcomes the objectives of the Proposal of improving the labour market statistics on businesses (‘LMB’) by covering the whole economy, enhancing its timeliness, filling information gaps and simplifying the framework.

The EDPS observes that data transmitted by Member States to the Commission (Eurostat) for the purpose of LMB may constitute personal data of identifiable employees. The EDPS recalls that any processing of personal data should be limited to what is necessary and proportionate in relation to the purpose for which they are processed and considers that the future Regulation should clarify that the data should normally be aggregated to such a degree that individuals cannot be identified.

The EDPS recognises that new innovative approaches can bring promises for statistics and research. However, the EDPS has concerns regarding the indication that information relating to specific persons might be obtained from ‘other sources’, which is defined broadly. He considers that the relevant sources for the required data may already be anticipated and he believes it necessary that they are specified.

The EDPS also has serious concerns regarding the indication that information relating to specific persons might be obtained from private records. The EDPS considers that collection of personal data from such sources may not be necessary and proportionate to the aims pursued, having regard to the potential risks for the rights and freedoms of data subjects. The EDPS recalls his recommendations in Opinion 40/2023 in this regard that only non-personal (anonymised) data will be requested from private data holders. Insofar as the Proposal seeks to provide a legal basis to request personal data from private data holders, it should provide a clear and comprehensive overview of the privately held data sources from which data may be obtained. Further, the EDPS recommends that sharing of personal data by private data holders shall make use of privacyenhancing technologies and take place using a secure infrastructure.

As regards the use of web scraping techniques as an innovative way to process data, the EDPS cautions against the use thereof to collect personal data. There is a risk that individuals lose control of their personal data. The EDPS considers that such processing may not be necessary and proportionate to the aims pursued. He recommends clarifying whether web craping techniques may be used to achieve the envisaged aims under the Proposal, and if this were to be the case, to limit such use to non-personal data.

Lastly, concerning the envisaged pilot studies, the EDPS recommends that the future Regulation clarifies that such studies will not allow for data collection beyond the data categories foreseen by the Proposal. He considers further that the roles and responsibilities within the meaning of data protection law of the actors performing such studies should be specified.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 28 July 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on European Union labour market statistics on businesses, repealing Council Regulation (EC) No 530/1999 and Regulations (EC) No 450/2003 and (EC) No 453/2008 of the European Parliament and of the Council (‘the Proposal’) .

2. The Proposal lays down a common legal framework for the development, production and dissemination of labour market statistics on businesses (‘LMB’) in the Union and aims at addressing limitations of LMB under the current legal framework by providing for coverage of the whole economy to improve the accuracy of some statistics. It regulates the collection of annual gender pay gap data to ensure future data transmissions and improve its quality. In addition, it aims at improving the timeliness of some LMB datasets and filling in some existing information gaps. Lastly, it also provides for simplification with greater use of administrative data and innovative sources .

3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 28 July 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 13 of the Proposal.

2. General remarks

4. The EDPS welcomes the objective of the Proposal of improving the LMB statistics by covering the whole economy, enhancing its timeliness, filling information gaps and simplifying the legal framework. The EDPS recognises the usefulness of LMB for the design, implementation and evaluation of EU policies, in particular the coordination of economic and employment policies (Article 2(3) TFEU), monetary policy (Article 3(1c) TFEU), social policy (Article 4(2b) TFEU), and economic, social and territorial cohesion (Article 4(2c) TFEU), as well as equal pay for male and female workers (Article 157(1) TFEU) .

5. The EDPS notes that one of the goals of this regulatory reform is to allow the use of innovative sources for statistical information. New innovative approaches can bring promises for statistics and research, but may also pose risks and raise challenges, thus requiring the co-legislators to ensure that any potential benefits never come at the expense of individuals’ rights. To provide effective protection for the right of privacy and the right to the protection of personal data, the co-legislators should anticipate the potential risks and challenges that these promising approaches may bring and provide for appropriate safeguards . Especially where an instrument aims to be as broad as possible to encompass the use of (future) innovative data and sources, the framework should be specific enough in its safeguards to meaningfully off-set the various risk areas that may arise.

6. The EDPS understands that, pursuant to Article 4(5) of the Proposal, for the purpose of LMB, data shall be transmitted to the Commission (Eurostat) in the form of aggregated data. An exception applies for the topic ‘structure of earnings’, referred to in Article 4(1), point (a)(i) of the Proposal, for which microdata shall be transmitted for individual employees and local units. Article 2(13) of the Proposal provides that “‘aggregated data’ means data concerning a set of several statistical units”. According to Article 2(12) of the Proposal, “‘microdata’ means data concerning only one statistical unit without a direct identifier”. Article 2(1) of the Proposal provides that “‘statistical unit’ “means the entity on which the data are collected or compiled”. It follows from Article 6(1)(a) to (c) of the Proposal that such statistical units may be enterprises, local units or employees.

7. The EDPS observes that it is not excluded that ‘aggregated data’ and ‘microdata’ transmitted to the Commission (Eurostat) as referred to in Article 4(5) of the Proposal, for the purpose of LMB, may constitute personal data of employees. More particularly, it is not excluded that such information may relate to an identifiable data subject considering that 1) microdata related to structure of earnings information concerns, among others, data related to individual employees (without a direct identifier) ; and 2) according to Article 6(2), (3) and (5) of the Proposal, the statistical population shall consist of enterprises and/or local units with more than one employee. This would mean that, in some cases, the population could be limited, thus increasing the possibility of (re-)identification of employees, including for aggregated data.

8. The EDPS underlines that any processing of personal data under the Proposal must comply with the requirements of the GDPR . He recalls that any processing of personal data should be limited to what is necessary and proportionate in relation to the purpose for which they are processed. Personal data must be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes . Further processing of personal data for statistical purposes is not considered to be incompatible with the original processing purposes, provided the conditions in Article 89(1) GDPR and Article 13 EUDPR are satisfied. In particular, these provisions stipulate that, when personal data are (further) processed for statistical purposes, those data shall in principle be rendered anonymous (or alternatively pseudonymous), provided that the statistical purpose be fulfilled in this manner .

9. Taken into account the above, the EDPS considers that the future Regulation should clarify that the data that Member States transmit to the Commission under the future Regulation should normally be aggregated to such a degree that individuals cannot be identified . For the sake of legal certainty, the EDPS recommends making specific reference to compliance with the safeguards relating to processing of personal data for statistical purposes under Article 89 GDPR and Article 13 EUDPR, in particular that the data shall in principle be rendered anonymous.

3. Data sources

10. Article 3(1) of the Proposal provides that Member States shall use or reuse one or a combination of the following sources: (a) survey data; (b) administrative records; (c) other sources. Article 2(20) of the Proposal states that “‘other sources’ means data generated by a non-administrative entity including private records, websites and databases, the main aim of which is not the provision of official statistics”. Recital 9 of the Proposal provides that national statistical authorities should consider administrative and innovative sources, the main aim of which is not the provision of statistics, as a substitute for or a complement to statistical surveys, subject to the quality requirements for official statistics. It also states that the latest technological and digital developments can contribute to this objective. To this end, the Explanatory Memorandum to the Proposal gives as examples of modern digital techniques web scraping and the automatically transferring of payroll data from the payroll systems of companies .

3.1. Lawfulness of processing

11. Insofar as data stemming from the sources under Article 3(1) of the Proposal concerns personal data, the EDPS recalls that a necessary condition for the lawfulness of the processing of personal data stemming from these sources is the existence of a legal basis under Article 6 GDPR and/or Article 5 EUDPR. In case of processing of special categories of data, regard must also be had to the general prohibition included in Article 9 GDPR and Article 10 EUDPR and the respective exceptions.

12. In addition, the EDPS recalls that data concerning the use of publicly available electronic communications services and public electronic communications networks, as well as the accessing or storing of information in the end-user’s terminal equipment, is subject to specific rules under the ePrivacy Directive . Such data and information may encompass both personal and non-personal data. The EDPS recalls that the ePrivacy Directive imposes specific limits on the processing of the data and information in scope of the Directive. Therefore, the EDPS considers it necessary to clarify that any processing of data stemming from ‘other sources’ under Article 3(1)(c) of the future Regulation shall be without prejudice to the ePrivacy Directive.

3.2. Specification of data sources

13. The EDPS further notes that, as currently defined in the Proposal, ‘other sources’ may consist of a multitude of sources, containing various types of personal data and potentially also including special categories of personal data and other sensitive data that would enable to draw even more intimate inferences on the data subject's’ life and could thus represent a significant risk for their rights and freedoms. By providing two relatively demarcated types of sources, followed by the category ‘other sources’ under Article 3(1)(c), Article 3(1) contains a potentially infinite list of sources of data generated by a non-administrative entity. The EDPS therefore considers that Article 3(1) of the Proposal does not adequately provide a list of sources limited to what is necessary and proportionate to achieve the envisaged purposes.

14. The EDPS considers that the relevant sources for the required 'topics' and 'detailed topics' as specified in the Annex to the Proposal may already be anticipated (indeed the EDPS notes that the Annex to the Proposal sets out the required data to be collected under the domains “earnings; labour costs; labour demand”). Therefore, in order to improve clarity and avoid disproportionate processing of personal data, the EDPS considers it necessary that the future Regulation specifies from which ‘other sources’ data may be collected and transmitted.

3.3. Privately held data

15. Insofar ‘other sources’ under the Proposal refer to privately held data, the EDPS recalls his Opinion 40/2023 . In that Opinion, the EDPS stressed that he understands that privately held data have the potential to help producers of official statistics to provide more accurate statistics that reflect topics of interest to users at a faster pace. He also pointed out that privately held data can be diverse. The EDPS considered that the collection of personal data from privately held data may not be necessary and proportionate to the aims pursued, having regard to the potential risks for the rights and freedoms of data subjects. The EDPS welcomed with regard to privately held data Article 17c(2) of the proposal for a Regulation amending Regulation (EC) No 223/2009 on European statistics, which provides that the requests for data by the national statistical institutes (‘NSIs’) and the Commission (Eurostat) shall follow the principle of data minimisation, be proportionate to the statistical need and concern, insofar as possible, non-personal data. He considered that only anonymised data should be requested and used for statistical purposes where privately held data are concerned . Therefore, the EDPS recommended in his Opinion 40/2023 deleting the wording "insofar as possible" from Article 17c(2) of the proposal for a Regulation amending Regulation (EC) No 223/2009 on European statistics to ensure that only nonpersonal (anonymised) data will be requested from private data holders. This recommendation remains valid, also for the current Proposal, as the EDPS understands that Article17c(2) of the proposal for Regulation amending Regulation (EC) No 223/2009 on European statistics provides the framework for the processing of privately held data stemming from ‘other sources’ under Article 3(1)(c) of the Proposal.

16. For the sake of completeness, the EDPS recalls that he did not suggest in his Opinion 40/2023 that privately held personal data can never be used for the purpose of creating official statistics. However, the EDPS recalled that the mere reduction of the response burden for private data holders (by not requiring them to anonymise the data) cannot outweigh the potential impact on the fundamental rights and freedoms of the persons concerned. The EDPS believes this consideration to be relevant for this Proposal as well, since the use of modern digital techniques, including use thereof to obtain data from private records, is considered to play a role in mitigating the burden on enterprises . The EDPS further reiterates that due regard must be had to the sensitivity of the data at issue, taking into account the principles of necessity and proportionality . As particularly relevant for this Proposal, the EDPS recalls that Opinion 40/2023 provided that the types of (privately held data) sources from which categories of data may be obtained should be clearly set out in the legislation. Lastly, the EDPS recommended that sharing of personal data by private data holders shall make use of privacy-enhancing technologies and shall take place using a secure infrastructure .

3.4. Web scraping

17. In addition, as already mentioned above, the EDPS observes that the Explanatory Memorandum to the Proposal refers to web scraping as a modern digital technique. The EDPS understands that such technique could possibly be used to collect data from ‘other sources’ mentioned under Article 3(1(c) of the Proposal. The EDPS also understands that, in the context of the Proposal, such technique may be considered for e.g. extracting job advertisements from the internet , and he presumes that it would be used to collect nonpersonal data. The EDPS cautions against the use of web scraping techniques to collect personal data, through which individuals may lose control of their personal information when this is collected without their knowledge, against their expectations and for purposes that are different from those of the original publication. He stresses that the processing of personal data that is publicly available remains subject to EU data protection legislation.

18. The EDPS is of the view that collection of personal data via web scraping may not be necessary for and proportionate to the aims pursued, having regard to the potential risks for the rights and freedoms of data subjects. Furthermore, the use of web scraping techniques to collect data from websites, for their usual nature of an unstructured search on what is public on the internet, might not comply with the data protection principle of accuracy insofar as there is no assessment on the reliability of the sources. The same quality requirements for official statistics (e.g. the principle of statistical accuracy and reliability of source data) might be affected. Therefore, the EDPS considers it necessary that the colegislators clarify whether web scraping techniques may be used to process data from websites as ‘other source’. If this were to be the case, he considers that the use of web scraping techniques should be limited to non-personal data.

3.5. Quality reports

19. Finally, the EDPS notes the mechanism outlined in Article 8(4) of the Proposal, which relates to the submission of quality reports on the sources and methods employed alongside the data, serves as a safeguard to monitor the sources used by Member States. This appears particular relevant for the use of ‘other sources’ under Article 3(1)(c) of the Proposal. Although Article 8(5) specifies that these quality reports will adhere to a format further defined by the Commission through an implementing act, the Proposal does not offer additional guidance on how sources categorised as 'low quality' and the data collected through them should be managed. The EDPS recommends including such guidance.

4. Relationship to Regulation (EC) No 223/2009

20. Recital 11 of the Proposal states that Regulation (EC) No 223/2009 constitutes the reference framework for the Proposal, including as regards the protection of confidential data. Article 3(7) of the latter states that “‘confidential data’ means data which allow statistical units to be identified, either directly or indirectly, thereby disclosing individual information” . According to Article 6(6) of Regulation (EC) No 223/2009, a ‘statistical unit’ includes as basic observation unit a natural person referred to by the data. Based on these definitions, the EDPS understands that confidential data under Regulation (EC) No 223/2009 includes personal data as defined under the GDPR. Accordingly, in addition to the GDPR, Regulation (EC) No 223/2009 also provides the reference framework as regards the protection of personal data in the context of any processing of personal data for statistical purposes under the Proposal.

21. The EDPS recalls that any processing of personal data under the Proposal must comply with the requirements of the GDPR. Therefore, he recommends the co-legislators to make explicit reference to the applicability of the GDPR and EUDPR to the processing of personal data under the future Regulation, similar as in recital 14 of the Commission's recent Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EC) No 223/2009 on European statistics .

22. The EDPS recommends the co-legislators to clarify in the enacting terms of the future Regulation the interplay between the future Regulation and Regulation (EC) No 223/2009, including the recently proposed amendments to that Regulation , with regard to the processing of personal data under the Regulation. Currently, recital 10 of the Proposal refers to the application of Article 17a(1) of the Proposal for a Regulation amending Regulation (EC) No 223/2009 regarding the use of national administrative records. The EDPS understands that this relates to the use of administrative data sources as provided under Article 3(1)(b) of the Proposal. However, for other provisions, no explanation on the relationship between the legal instruments is provided. Such general explanation is among others relevant to address: a. Whether the Proposal would serve as sectoral statistical legislation of the Union referred to in Article 17b(1) of the proposal for a Regulation amending Regulation (EC) No 223/2009; c. Whether Article 17f of the Proposal for a Regulation amending Regulation (EC) No 223/2009, including the secure infrastructure to facilitate data sharing to be set up by the Commission (Eurostat) pursuant to paragraph 3 of that provision, applies to data sharing between Member States and the Commission (Eurostat) under the Proposal; and d. How the definitions of ‘statistical unit’ in the different Regulations relate to each other, considering that the definition under Article 6(1) of the Proposal is different from the definition of ‘statistical unit’ under Article 3(6) of Regulation (EC) No 223/2009. The EDPS considers that the use of the same term with a different definition in two related Regulations may create legal uncertainty and therefore recommends clarifying such point. For the sake of completeness, the EDPS also notes that Article 6(1) of the Proposal provides that “[s]tatistics under this Regulation shall be compiled for one or more of the following statistical units: (a) enterprises; (b) local units; (c) employees.” However, under Article 2(1) of the Proposal, ‘statistical unit’ is defined as “(...) the entity on which the data are collected or compiled”, thus excluding employees from the definition. Therefore, the EDPS recommends ensuring that the definition encompasses all the persons concerned.

23. The EDPS recommends that the co-legislators also consult his Opinion 40/2023 on the proposal for a Regulation amending Regulation (EC) No 223/2009 (‘Opinion 40/2023’) when clarifying the relationship between Regulation (EC) No 223/2009 and the future Regulation, in order to ensure a coherent legal framework for the processing of personal data for statistical purposes, and to provide for adequate safeguards for the rights and freedoms of the data subjects concerned.

5. Pilot Studies

24. The EDPS notes that Article 9 of the Proposal allows for the initiation of feasibility and pilot studies by the Commission, among others to implement new features to respond to user needs, improve integration between surveys and other data sources, and reduce the burden on respondents. According to the Article, “(...) such studies shall take into account technological and digital developments”. In addition, Article 9(2) of the Proposal states that Member States may participate in those studies on a voluntary basis.

25. The EDPS considers that future Regulation should provide how data obtained through the pilot projects will (a) be further used for LMB and (b) potentially be integrated as permanent solutions. In this respect, the EDPS recalls the provisions on Data Protection Impact Assessments (DPIA), which would allow to evaluate the impact of the pilot project on data subjects and ensure data protection by design in any future collection of personal data built upon the foundation of the pilot project.

26. In case data from the pilot projects is further used for the creation of LMB, the EDPS considers that the future Regulation should clarify that such studies would not allow for data collection beyond the 'topics' and 'detailed topics' listed in Article 4(1) and specified within the Annex to the Proposal.

27. Moreover, the EDPS notes that the Proposal does not specify the roles and responsibilities within the meaning of data protection law of the actors performing such studies, namely the Commission (Eurostat) and the Member States, insofar processing of personal data takes place for the purpose of the studies. Ensuring clarity of the role of each actor involved in the processing of personal data is important to promote transparency of processing and the effective exercise of data subject rights. While detailed arrangement to ensure compliance with data protection requirements may be specified by way of an implementing act, the EDPS considers that the roles of the various actors involved as controller, joint controller or processor should be clearly specified in the enacting terms of the future Regulation .

6. Implementing and Delegated Acts

28. Article 4(1) of the Proposal lists the domains and topics to be covered by LMB in relation to earnings, labour costs and labour demands. Moreover, Article 4(7) of the Proposal provides that the Commission shall adopt implementing acts specifying certain elements for each topics.

29. In this regard, when specifying the categories of data, the EDPS recalls first and foremost compliance with the data minimisation principle , which provide that personal data must be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed". As previously indicated, the collection of special categories of personal data or otherwise sensitive data that would enable drawing intimate inferences on the data subject’s life may not be proportionate to the aims pursued.

30. More in general, the EDPS notes that, according to Articles 4(3), 4(7), 7(1), 7(3) and 8(5) of the Proposal, the Commission would be empowered to adopt delegated and implementing acts to supplement the Proposal. In this regard, the EDPS recalls that, when a proposal for legislation has a possible impact on the protection of personal data, the European Commission has to submit it to the EDPS for consultation.

7. Conclusions

31. In light of the above, the EDPS makes the following recommendations: (1) clarify that the data that Member States transmit to the Commission under the future Regulation should normally be aggregated to such a degree that individuals cannot be identified; (2) make specific reference to compliance with the safeguards relating to processing of personal data for statistical purposes under Article 89 GDPR and Article 13 EUDPR, in particular that the data shall in principle be rendered anonymous; (3) make explicit reference to the applicability of the GDPR and EUDPR to the processing of personal data under the future Regulation; (4) clarify that any processing of data stemming from ‘other sources’ under Article 3(1)(c) of the future Regulation shall be without prejudice to the ePrivacy Directive; (6) ensure that only non-personal (anonymised) data will be requested from private data holders; (7) clarify whether web scraping techniques may be used to process data from websites. If this were to be the case, limit the use of web scraping techniques to non-personal data; (8) provide guidance on how sources categorised as 'low quality' in the quality report under Article 8(4) of the Proposal and the data collected through them should be managed; (9) clarify in the enacting part of the future Regulation the relationship of the future Regulation to Regulation (EC) No 223/2009, including the recently proposed amendments in the proposal for a Regulation amending Regulation (EC) No 223/2009, with regard to the processing of personal data; (10) provide how data obtained through the pilot projects will (a) be further used for LMB and (b) potentially be integrated as permanent solutions; (11) clarify that pilot studies should not allow for data collection beyond the 'topics' and 'detailed topics' listed in Article 4(1) and specified within the Annex to the Proposal; and (12) specify the roles and responsibilities within the meaning of data protection law of the Commission (Eurostat) and the Member States regarding the pilot studies, insofar processing of personal data takes place for the purpose of the studies. Brussels, 25 September 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 13