—

an explicit reference to applicable EU data protection law should be inserted in both Proposals in a substantive and dedicated provision, mentioning in particular Directive 95/46/EC and the national laws implementing Directive 95/46/EC, and Regulation (EC) No 45/2001 as concerns the processing of personal data by EU institutions and bodies; this provision should also clearly state that the Proposals are without prejudice to the applicable data protection laws; the reference in recital 33 to Council Framework Decision 2008/977/JHA of 27 November 2008 should be deleted;

—

a definition of ‘competent authorities’ and ‘FIUs’ should be added in the proposed Directive; this definition should guarantee that ‘competent authorities’ are not to be considered as ‘competent authorities’ within the meaning of Article 2(h) of the Framework Decision 2008/977/JHA.

—

it should be clarified in recital 32 that the legal ground for the processing would be the necessity to comply with a legal obligation by the obliged entities, competent authorities and FIUs (Article 7(c) of Directive 95/46/EC);

—

it should be recalled that the sole purpose of the processing must be the prevention of money laundering and terrorist financing, and that data must not be further processed for incompatible purposes;

—

the specific prohibition to process data for commercial purposes, which is currently mentioned in recital 31 of the proposed Directive and recital 7 of the proposed Regulation, should be laid down in a substantive provision;

—

a dedicated recital should be added to clarify that the fight against tax evasion is only inserted as predicate offences;

—

as to international transfers, dedicated substantive provisions on the transfers of personal data should be added, which provides for an appropriate legal basis for the intra-group/PSP to PSP transfers that would respect the text and interpretation of Article 26 of Directive 95/46/EC, as supported by the Article 29 Working Party of European data protection authorities. The EDPS recommends that the proportionality of requiring the mass transfer of personal and sensitive information to foreign countries for the purpose of fighting AML/TF is re-assessed and that a more proportionate approach is favoured;

—

regarding the publication of sanctions, the EDPS recommends evaluating alternative and less intrusive options to the general publication obligation and, in any case, specifying in the proposed Directive:

—

as to data retention, a substantive provision should be added that sets forth a maximum retention period that must be respected by Member States, with additional specifications.

—

add a specific provision to recall the principle of providing data subjects with information about the processing of their personal data (in accordance with Articles 10 and 11 of Directive 95/46/EC) and to specify who will be responsible for such data subjects' information;

—

respect the proportionality principle when limiting data subjects' rights and, as a consequence, add a specific provision to specify the conditions under which the data subjects' rights may be limited;

—

clearly state whether or not risk assessments carried out by the designated authority and by obliged entities may involve the processing of personal data; if so, the proposed Directive should require the introduction of the necessary data protection safeguards;

—

add a precise list of the information that should and should not be taken into account in carrying out the Customer Due Diligence; clarify whether or not sensitive data within the meaning of Article 8(1) of Directive 95/46/EC should be collected for this purpose; if such a processing were to be necessary, Member States should ensure that it is carried out under the control of an official authority and that suitable specific safeguards are provided under national law;

—

amend Article 21 to limit more clearly the situations in which the risks are so substantial that they justify enhanced due diligence and to provide for procedural safeguards against abuse;

—

amend Article 42 to include a reference to confidentiality, which should be respected by all employees involved in the CDD procedures;

—

list in a substantive provision the types of identification data to be collected on the beneficial owner, also when no trust is involved.

—

refrain from using the national identity number as a reference without specific restrictions and/or safeguards, but to use the transaction number instead;

—

recall the importance of respecting the principle of data accuracy, set forth in Article 6(d) of Directive 95/46/EC, in the context of AML procedures;

—

add a provision stating that ‘the information should only be accessible to designated persons or classes of persons’;

—

add a provision regarding the respect of confidentiality and data protection obligations by employees dealing with personal information on the payer and the payee;

—

clarify in Article 15 that no other external authorities or parties that have no interest in combating money laundering or terrorist financing should access the data stored;

—

complete Article 21 by specifying to which authority the breaches of the Regulation will be reported and by requiring that appropriate technical and organisational measures are implemented to protect data against accidental or unlawful destruction, accidental loss, alteration, or unlawful disclosure.