Summary of the Opinion of the European Data Protection Supervisor on safeguards and derogations under Article 89 GDPR in the context of a proposal for a Regulation on integrated farm statistics

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2018/C 14/06)

The draft Regulation on integrated farm statistics, as proposed by the European Commission, after consultation of the European Data Protection Supervisor, raises few data protection issues in and of itself. However, the amendments proposed in the context of discussions in the Council raise new issues not initially present in the Commission proposal. Notably, if these amendments were to be included in the final text, the draft Regulation would become the first EU legislative instrument that would provide for a derogation from the rights of access, rectification, as well as from the right of restriction and the right to object for the processing of personal data for statistical purposes pursuant to Article 89 of the General Data Protection Regulation. The EDPS therefore welcomes that the Council consulted him on this new development, thus providing the opportunity to the EDPS to issue an Opinion at this stage of the procedure.

This Opinion focuses on the necessity test for derogations under Article 89 of the GDPR read in the light of the Charter. The EDPS emphasises, in particular, that the rights of access and rectification are set out in Article 8(2) of the Charter itself, and are considered as essential components of the right to the protection of personal data. Any derogation to these rights must not go beyond what is strictly necessary to achieve its objective and must meet the high standards required by Article 52(1) of the Charter of Fundamental Rights of the European Union and Article 89 of the GDPR.

In addition to highlighting the need for a thorough assessment of necessity, the Opinion also points out to the need to minimise the scope of any restrictions, and discusses the nature of the safeguards required. The Opinion also discusses Article 11 of the GDPR, which may potentially help address some of the concerns of national statistical institutes raised by the Council, without the need for any derogations under Article 89 of the GDPR. In particular, in accordance with Article 11, in cases where a controller is able to demonstrate that it is not in a position to identify the data subject, the rights of the data subjects under Articles 15 to 20 would not apply.

In light of the foregoing, the EDPS recommends that the Council reassess the necessity for the proposed derogations in the light of the standard established under Article 89 of the GDPR read in the light of the Charter. Unless the EU legislator can provide further justifications for the need for such derogations, and tailor the scope of the provisions more narrowly, the EDPS recommends instead considering to what extent Article 11 of the GDPR may help address legitimate concerns of national statistical institutes. It may be relevant at stages of the data processing when the keys connecting the individuals to the datasets about them have already been deleted, and other technical and organisational measures have been taken to ensure that the individuals can no longer be reidentified by the statistical institutes or by any other party.

The EDPS emphasises, however, that for the initial period often necessary for the preparation of statistics during which the individuals must remain directly or indirectly identifiable, the general rules set forth in the GDPR continue to apply. The fact that putting in place technical and organisational measures to provide access and other rights to individuals may require financial and human resources is by itself not a valid justification to derogate from the rights of individuals under the GDPR. This is true for all data subject rights under the GDPR, and especially crucial for rights of access and rectifications explicitly required under the Charter, which constitute essential components of the fundamental right to the protection of personal data.

1.   INTRODUCTION AND BACKGROUND

On 9 December 2016, the European Commission (‘Commission’) adopted a Proposal for a Regulation of the European Parliament and of the Council on integrated farm statistics and repealing Regulations (EC) No 1166/2008 and (EU) No 1337/2011 (‘Proposal’) (1). The aim of the Proposal is to create a more coherent, flexible, and interlinked system of farm statistics, and provide the legislative framework for a programme of farm surveys starting with an agricultural census to run in 2020.

The draft Regulation itself, as proposed by the Commission, after consultation of the European Data Protection Supervisor (‘EDPS’), raised only few data protection issues, and these have been appropriately dealt with in the Proposal. Indeed, the EDPS welcomes that he has been consulted by the Commission prior to the adoption of the Proposal and that his informal comments have been taken into account. In particular, he supports the references, in recital 16, to the applicable data protection legislation, Directive 95/46/EC of the European Parliament and of the Council (2) and its national implementing provisions, as well as Regulation (EC) No 45/2001 of the European Parliament and of the Council (3), as the case may be. He also welcomes the reference, in recital 26, to the fact that the EDPS has been consulted. As the Proposal, as published on 9 December 2016, raised no significant outstanding data protection concerns, the EDPS decided at that stage not to issue a formal Opinion.

However, some of the amendments discussed in the context of negotiations in the Council of the European Union (‘Council’) during the legislative process raise new issues not initially present in the Commission Proposal. If these amendments were to be included in the final text, the draft Regulation would become the first EU instrument that would explicitly provide a derogation from the rights of access and rectification, as well as from the right of restriction and the right to object pursuant to Article 89 of the General Data Protection Regulation (‘GDPR’).

This significant new element justifies an Opinion of the EDPS at this stage of the procedure. The EDPS therefore welcomes that the Council decided to consult him on this new development and — on 26 September 2017 — specifically requested the EDPS to look into these amendments proposed in the context of the negotiations in the Council (4).

The purpose of this Opinion is to provide specific recommendations on the draft Regulation focusing on the relevant draft amendments under discussion in the Council. The focus of this Opinion, under Section 2, is to discuss and help assess whether or not the proposed derogations meet the necessity test for derogations for statistical purposes under Article 89 of the GDPR and under Article 52(1) of the Charter of Fundamental Rights of the European Union (‘Charter’). Additionally, in Section 3, the EDPS provides recommendations regarding the proposed provisions on the safeguards.

4.   CONCLUSIONS

If the proposed amendments were to be included in the final text, the draft Regulation would become the first EU legislative instrument that would provide a derogation from the rights of access, rectification, as well as from the right of restriction and the right to object for the processing of personal data for statistical purposes pursuant to Article 89 of the GDPR. Given the novelty and importance of this subject, the EDPS welcomes and appreciates the Council’s consultation and concerns for the impact this Proposal may have on the protection of personal data.

Should the necessity for specific derogations be justified at the later stage, the EDPS would offer the following additional recommendations regarding Article 12a related to the conditions and safeguards:

(1)  COM(2016) 786 final — 2016/0389 (COD).

(2)  Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31).

(3)  Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1).

(4)  See Note from the Presidency to delegations on ‘recital 16a and Article 12a in the Presidency text (data protection)’ (ref No 12351/17) dated Brussels, 21 September 2017. This document is also publicly available in the Council’s register under http://data.consilium.europa.eu/doc/document/ST-12351-2017-INIT/en/pdf