1.11.2012   

EN

Official Journal of the European Union

C 335/13

1.

On 9 March 2012, the Commission adopted a Recommendation on preparations for the roll-out of smart metering systems (1) (‘the Recommendation’). The Recommendation was sent to the EDPS for consultation on 19 March 2012.

2.

Before the adoption of the Recommendation, the EDPS was given the opportunity to provide informal comments. Some of these comments have been taken into account in the Recommendation. As a result, the data protections safeguards in the Recommendation have been strengthened.

3.

The EDPS welcomes the fact that the Commission also consulted him formally and that this Opinion is referred to in the preamble of the Recommendation.

4.

The objective of the Recommendation is to give guidance to Member States on preparation for the roll-out of smart metering systems (2) in Europe. The roll-out is foreseen by 2020 for both the electricity and the gas markets and is subject to an economic assessment of costs and benefits. This assessment is to be carried out by each Member State by 3 September 2012 (3).

5.

A significant part of the Recommendation (Section I) is dedicated to data protection. Importantly, the Recommendation calls for the preparation of a template for a data protection impact assessment (4) (‘the Template’) and its submission to the Article 29 Data Protection Working Party (‘the WP29’) for advice within 12 months of the publication of the Recommendation (5).

6.

The first draft of the Template is currently under preparation by Expert Group 2 of the Commission's Task Force on Smart Grids. The Task Force has been established by the Commission prior to the adoption of the Recommendation, to give advice on smart grid issues. One of the subgroups of the Task Force, Expert Group 2, focuses on security and data protection aspects. The group comprises mainly industry representatives (with some representation of civil society and consumer groups) (6).

7.

The Commission pursues a ‘soft law’ approach combining (i) a Commission Recommendation covering data protection among other issues and (ii) further guidance to Member States in the form of a template for a data protection impact assessment, which is to be applied voluntarily by industry participants. The approach is based on the experience gained from the development and revision, following WP29 comments, of the ‘Industry Proposal for a Privacy and Data Protection Impact Assessment Framework for RFID Applications’ (7). However, the Commission has not excluded the need for legislative action at national and/or at the European level (8).

8.

While this EDPS Opinion is adopted in response to the Commission Recommendation, it is not strictly limited to the content of this Recommendation, as there are important data protection aspects of the roll-out of smart metering which are not fully addressed in the Recommendation itself. The EDPS also recalls in this context his formal comments on the Energy Efficiency Proposal (9).

9.

The EDPS Opinion has three main objectives and messages:

10.

In light of these objectives, the Opinion is structured as follows:

68.

The Europe-wide roll-out of smart metering systems may bring significant benefits, but also entails considerable risks to the protection of personal data. It enables massive collection of personal data from European households and may lead to tracking what members of a household do within the privacy of their own homes. In light of these risks, the EDPS welcomes the Commission's efforts made in the Recommendation to provide guidance to Member States on the measures that should be taken in order to ensure that smart metering and smart grid systems are designed and operated subject to adequate data protection safeguards.

69.

The EDPS appreciates the efforts of the Commission to make use of newly proposed concepts such as data protection by design and practical tools such as data protection impact assessments and security breach notifications. The EDPS, in particular, supports the Commission's plan to prepare a Template for data protection impact assessment and submit it to the WP29 for advice.

70.

The EDPS regrets that the Recommendation has not provided more specific and more practical guidance on data protection. However, he considers that some guidance can still be given in Template currently under preparation. Therefore, the Opinion provides recommendations on the Template and emphasizes that the Template must offer specific and practical guidance: a collection of best practice and ‘best available techniques’. It is also crucial for the Template to follow a sound methodology and, among others, clearly match each risk with an adequate control.

71.

In addition, the Opinion calls on the Commission to assess whether further legislative action is necessary at the EU level and provides recommendations for such possible legislative action. Some of these recommendations can already be implemented via an amendment to the Energy Efficiency Directive, which is currently before the Council and Parliament. These should include at least a mandatory requirement for controllers to conduct a data protection impact assessment and an obligation to notify personal data breaches (Section 4.7).

72.

Further, the EDPS also recommends: