EDPS Opinion 48/2023 on the Proposal for a Directive on European cross-border associations and the Proposal for a Regulation amending Regulations 1024/2012 and 2018/1724

31 October 2023

Opinion 48/2023

on the Proposal for a Directive on European cross-border associations and the Proposal for a Regulation amending Regulations 1024/2012 and 2018/1724

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Directive of the European Parliament and of the Council on European cross-border associations and the Proposal for a Regulation of the European Parliament and of the Council amending Regulations (EU) No 1024/2012 and (EU) 2018/1724 as regards the use of the Internal Market Information System and the Single Digital Gateway for the purposes of certain requirements laid down by Directive (EU) .../... of the European Parliament and of the Council on European cross-border associations (COM(2023)516) . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposals that are relevant from a data protection perspective.

Executive Summary

On 5 September 2023, the European Commission issued the Proposal for a Directive of the European Parliament and of the Council on European cross-border associations and the Proposal for a Regulation of the European Parliament and of the Council amending Regulations (EU) No 1024/2012 and (EU) 2018/1724 as regards the use of the Internal Market Information System and the Single Digital Gateway for the purposes of certain requirements laid down by Directive (EU) .../... of the European Parliament and of the Council on European cross-border associations (COM(2023)516).

The EDPS welcomes the aim of this legislative initiative to regulate conditions for non-profit associations to operate cross-border in the internal market. In addition, the EDPS welcomes recital 42 of the Proposal for a Directive on European cross-border associations emphasising that GDPR and EUDPR apply to the processing of personal data carried out in the context of that Directive.

However, the EDPS made several recommendations. In particular, he recommended to align the wording of Article 20(6) and recital 41 of the Proposal for a Directive on European cross-border associations and to explain why 2 years is found an appropriate retention period of personal data after the dissolution of an European cross-border association.

Finally, the EDPS referred to his Opinion 1/2023 on the Proposal for an Interoperable Europe Act.

2

3

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 5 September 2023, the European Commission issued the Proposal for a Directive of the European Parliament and of the Council on European cross-border associations (‘the Proposal for a Directive’) and the Proposal for a Regulation of the European Parliament and of the Council amending Regulations (EU) No 1024/2012 and (EU) 2018/1724 as regards the use of the Internal Market Information System and the Single Digital Gateway for the purposes of certain requirements laid down by Directive (EU) .../... of the European Parliament and of the Council on European cross-border associations (COM(2023)516) (‘the Proposal for a Regulation’).

2. The objective of the Proposal for a Directive is to facilitate the exercise of non-profit associations’ right of establishment and the effective exercise of free movement rights by laying down measures coordinating the conditions for establishing and operating European cross-border associations (ECBAs), thereby providing inter alia for automatic recognition of their legal personality by Member States, ensuring they are subject to a single registration obligation and providing for harmonised rules on mobility (i.e. transfer of registered office) . The Proposal for a Regulation aims at amending Regulation (EU) No 1024/2012 which established the Internal Market Information System (IMI) in order to ensure that Member States’ competent authorities cooperate and exchange information through the IMI when they apply the national rules implemented in accordance with the provisions of the proposal. It also aims at amending Regulation (EU) 2018/1724 which established the Single Digital Gateway to ensure that Member States give online access to information relevant to the ECBAs and non-profit associations and facilitate the exchange of evidence between competent authorities during the procedures concerning ECBAs, as laid down by the Proposal for a Directive. The Regulation is the appropriate instrument for such changes in view of the principle of parallelism of form .

3. The Proposals stem from the European Parliament resolution of 17 February 2022, aiming to promote associations and other non-profit organisations in the EU in completing the internal market, protecting their fundamental rights and fostering an EU democratic space .

4. The Proposal for a Directive is included in the 2023 Commission Work Programme as part of the Social Economy framework under the Commission’s headline ambition of “An economy that works for people”, contributing to the objective of ʽan economy that can fully respond to the needs of EU citizens thereby ensuring social fairness and prosperityʼ. In this sense, it interlinks with measures announced in the Social Economy Action Plan 1314 and forms together with them the “Social Economy framework” .

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 5 September 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in recital 51 of the Proposal for a Directive.

2. General remarks

6. The Explanatory Memorandum of the Proposal for a Directive emphasises that non-profit associations represent the predominant legal form among non-profit organisations in the European Union. However, non-profit associations and their activities are regulated by specific legislation in 24 Member States in a different manner, creating legal uncertainty and giving rise to different administrative procedures and requirements. Moreover, a very large majority of Member States do not recognise associations from other Member States seeking to engage in cross-border activities.

7. The EDPS fully supports the aim of the Proposals to fill in this legislative gap by regulating conditions for non-profit associations to operate cross-border in the internal market. However, the EDPS would like to remind that every proposal for a legislative act, which has an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data, must comply with the applicable data protection legislation. In that regard, the EDPS welcomes recital 42 of the Proposal for a Directive emphasising that Regulation 2016/679 (‘GDPR’) and EUDPR apply to the processing of personal data carried out in the context of that Directive.

3. Retention of personal data

8. An important principle of the GDPR is storage of personal data which prohibits personal data to be kept in a form permitting identification of data subjects for longer than is necessary for the purposes for which the personal data are processed. In that regard, the EDPS welcomes that the Proposal for a Directive provides for a limitation of retention of personal data . However, when reading together recital 41 (ʽ...all data retained and stored in the register should be kept for 2 years after dissolution.ʼ) and Article 20(6) of the Proposal for a Directive (ʽMember States shall ensure that personal data are not retained in the register after the dissolution of an ECBA for longer than 2 years.ʼ) it is unclear whether personal data must be retained for 2 years or whether 2 years is the maximum period the data can be retained. In addition, the Proposal for a Directive does not contain an explanation justifying the necessity to retain the personal data for 2 years. The EDPS therefore suggests clarifying these issues in order to be fully compliant with the storage limitation principle.

4. Public sector interoperability

9. The EDPS notes recital 41 of the Proposal for a Directive, stating: ʽThe interoperability solutions developed as part of the implementation of the Proposal for a Regulation of the European Parliament and of the Council laying down measures for a high level of public sector interoperability across the Union can further support Member States to move towards cross-border interoperability of their registersʼ.

10. In that regard, the EDPS would like to recall that EDPS issued an Opinion on this Proposal as well. In particular, the EDPS emphasised that interoperability of network and information systems across sectors of public administration and across all levels of administration affects one of the most fundamental principles of data protection, the principle of purpose limitation. The EDPS encouraged the development of interoperability solutions which do not go over the head of the persons concerned, but actively involve them, thus giving them better control over what data to share for which purposes e.g. in a process of authorizing the exchange between administrations and electronically checking the data to be exchanged.

5. Other specific comments

11. As already stated in the introduction, the EDPS welcomes the reference to this consultation in recital 51 of the Proposal for a Directive. However, he notes that the date of the EDPS Opinion is not correct. In addition, the EDPS suggests adding a similar recital in the Proposal for a Regulation.

12. Finally, when it comes to the Proposal for a Regulation, the EDPS notes that its recital 2 invokes Article 30(2) instead of Article 28(2) of the Proposal for a Directive related to administrative cooperation between the competent authorities of Member States. He suggests correcting this clerical error.

6. Conclusions

13. In light of the above, the EDPS makes the following recommendations: (1) to align the wording of Article 20(6) and recital 41 of the Proposal for a Directive and to explain why 2 years are found an appropriate retention period for personal data after the dissolution of a European cross-border association; (2) to correct the date of the EDPS Opinion in recital 51 of the Proposal for a Directive and to insert a reference to this consultation in the Proposal for a Regulation; Brussels, 31 October 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8