Summary of the Opinion of the European Data Protection Supervisor on the European Commission’s action plan for a comprehensive Union policy on preventing money laundering and terrorism financing

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2020/C 322/05)

Executive summary

On 7 May 2020, the Commission issued a Communication on an action plan for a comprehensive Union policy on preventing money laundering and terrorism financing (C(2020)2800 final) which sets a route map for the achievement of its objectives on this area. This Opinion assesses the data protection implications of the initiatives laid out in the Commission’s Action Plan.

While the EDPS acknowledges the importance of the fight against money laundering and terrorism financing as an objective of general interest, we call for the legislation to strike a balance between the interference with the fundamental rights of privacy and personal data protection and the measures that are necessary to effectively achieve the general interest goals on AML/CFT (the principle of proportionality).

The EDPS recommends that the Commission monitors the effective implementation of the existing AML/CFT framework while ensuring that the GDPR and the data protection framework are respected and complied with. This is particularly relevant for the works on the interconnection of central bank account mechanisms and beneficial ownership registers that should be largely inspired by the principles of data minimisation, accuracy and privacy-by-design and by default.

The EDPS welcomes the envisaged harmonisation of the AML/CFT framework, as this will result in a more consistent application of the main rules by Member States as well as a uniform interpretation by the Court of Justice of the European Union. The EDPS invites the Commission to follow the risk-based approach when deciding on the new measures of the reinforced rulebook, since this approach is also in line with the data protection principles.

The EDPS recommends the Commission to foresee in its proposal bringing about the EU-Level AML/CFT supervisor a specific legal basis for it to process personal data as well as the necessary data protection safeguards in line with the GDPR and Regulation 2018/1725, particularly regarding information sharing and international transfers of data.

The EDPS welcomes the initiative of the Commission to boost the development of FIU.net and to find a suitable solution for its management that is in line with the GDPR and the data protection framework. Furthermore, we recommend that the proposal establishing the mechanism for the support and coordination of FIUs clarifies the conditions for access to and sharing of information on financial transactions by FIUs.

The EDPS supports the development of PPPs for the research and analysis of typologies and trends in AML/CFT, within the respect of the boundaries of the GDPR. To the contrary, and whether the EDPS does not wish to express any merit judgement on the policy purposes behind the initiative, we consider that PPPs for the sharing of operational information on intelligence suspects by law enforcement authorities to obliged entities, would result in a high risk for the rights to privacy and data protection. Furthermore, processing operations concerning information on possible offences arising from financial transactions should remain within the boundaries of competent authorities and not be shared with private entities.

The EDPS welcomes the Commission’s efforts to play a stronger role within the Financial Action Task Force and to speak with one voice. He encourages the Commission to strive to make the data protection principles part and parcel of the AML/CFT processes, when setting up international standards in this area.

Finally, the EDPS expects to be consulted, in accordance with Article 42 of Regulation 2018/1725, following the adoption of proposals for legislative acts where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data. This may include, inter alia, the future proposals for a Regulation on AML/CFT measures, establishing a support and coordination mechanism for FIUs and setting up the EU-Level supervisor.

1. INTRODUCTION AND BACKGROUND

1. On 7 May 2020, the European Commission adopted its Communication on an action plan for a comprehensive Union policy on preventing money laundering and terrorism financing (C(2020)2800 final) (the “Action Plan”). The Action Plan is an initiative foreseen in the policy objective no 21 of the Commission Work Programme 2020 “Completing the Banking Union”.

2. The Action Plan consist of six pillars, namely (1) ensuring the effective implementation of the existing EU framework for anti-money laundering and countering the financing of terrorism (“AML/CFT”), (2) establishing an EU single rule book on AML/CFT; (3) bringing about EU level AML/CFT supervision, (4) establishing a support and cooperation mechanism for FIUs, (5) enforcing Union-level criminal law provisions and information exchange and (6) strengthening the international dimension of the EU AML/CFT framework. To gather the views of citizens and stakeholders on these measures, on 7 May, the Commission launched a public consultation ( 1 ) in parallel with the adoption of the Action Plan until 29 July 2020.

3. The Action Plan concretises the pillars into a number of specific measures, including various legislative proposals concerning the EU AML/CFT single rulebook, establishing an EU level AML/CFT supervisor and developing a support and coordination mechanism for Financial Intelligence Units (“FIUs”). This Opinion follows the six pillars’ structure and expresses the views of the EDPS on selected measures of the Action Plan, and in particular, on their potential interference with the right to privacy and to data protection of individuals as guaranteed by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. This Opinion is without prejudice to the obligation of the Commission to consult the EDPS, in accordance with Article 42 of Regulation 2018/1725, on any legislative proposals that may be proposed within the framework of the Action Plan where there is an impact on the protection of individuals’ right to the protection of personal data.

4. CONCLUSIONS

In light of the above, the EDPS makes the following recommendations:

— Invites the Commission, in the legislative works, to strike a balance between the measures that are necessary to effectively achieve the general interest goals on AML/CFT and their interference with the fundamental rights of privacy and personal data protection;

— Recommends that the Commission monitors the implementation of the existing AML/CFT framework while ensuring the respect of the GDPR and the data protection framework;

— Concerning the works on the interconnection of central bank account mechanisms and beneficial ownership registers, recommends that they comply, in particular, with the principles of data minimisation, accuracy and data protection-by-design and by default;

— Suggests that the Commission keeps a risk based approach to the new AML/CFT measures of the reinforced rulebook, i.e. by applying less intrusive procedures to less risky situations, as this is also in line with the data protection principles;

— Concerning Customer Due Diligence, recommends that safeguards are maintained in the proposed legislation to guarantee the right of customers to be informed when their data is collected, and about the purpose(s) for which data is required and will be processed, as well as to ensure compliance with the principles of data minimisation, purpose limitation and data protection-by-design, and the limits of the automated individual decision-making;

— Recommends the Commission to provide in its forthcoming proposal to set up an EU-Level AML/CFT Supervisor for a legal basis for the processing of personal data as well as the necessary data protection safeguards in line with the GDPR and Regulation 2018/1725, particularly regarding the information sharing and international transfers of data;

— Recommends the Commission to clarify in the proposal for the mechanism for support and coordination of FIUs, the conditions for access to and sharing of information on financial transactions by FIUs;

— Supports the development of PPPs for the research and analysis of typologies and trends in AML/CFT, within the respect of the boundaries of the GDPR;

— Encourages the Commission to integrate data protection principles, when setting up international standards at the Financial Action Task Force.

Brussels, 23 July 2020 Wojciech Rafał WIEWIÓROWSKI

(1) https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12176-Action-Plan-on-anti-money-laundering/public-consultation