Summary of the Opinion of the European Data Protection Supervisor on the Commission Package on free and fair European elections

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2019/C 47/05)

The functioning of the Union is founded on representative democracy. Political communication is essential to the participation of citizens, political forces and candidates in democratic life and to the fundamental right to freedom of expression. These rights and freedoms are interdependent with the right to respect for private and family life, home and communications and the right the protection of personal data. Earlier this year, in his Opinion 3/2018 on online manipulation, the EDPS highlighted the risks to fundamental rights of concentrated markets.

In the context of the 2018 State of the Union speech, the Commission presented a security package focusing on free and fair European elections. This package is composed of a Communication, a Guidance document on the application of Union data protection law in the electoral context, a Recommendation and a proposal for a Regulation as regards a verification procedure related to infringements of rules on the protection of personal data in the context of elections to the European Parliament. The EDPS recognises the reference made to the role of social media platforms and on how this initiative would be coherent with the Code of Practice on online disinformation. In light of the upcoming European Parliament elections in May next year, and the numerous other national elections scheduled for 2019, the EDPS also recognises the recommendations for the setting up of national election networks and a European coordination network. He takes this opportunity to show his availability to participate in this European network. It would complement EDPS action in this area, in particular the workshop which he organises in February next year. The EDPS also recognises the recommendation to Member States to perform a comprehensive assessment of risks associated with the elections to the European Parliament with a view to identifying potential cyber incidents that could affect the integrity of the electoral process and underlines the urgency of this matter.

In general, the EDPS considers that, for further clarity, a reference could have been included to the processing of personal data by the European Parliament, the Authority for European Political Parties and European Political Foundations and the Committee of independent persons, as being within the scope of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (1) (previously, Regulation (EC) No 45/2001). In addition and more specifically, the EDPS makes several recommendations in relation to the proposed Regulation, among which clarifying the scope of the measures and the complementary aims of such sanctions, including EDPS decisions finding an infringement to Regulation (EU) 2018/1725 and a reference to the current data protection legal framework for cooperation between national data protection supervisory authorities and the EDPS as well as ensuring the confidentiality of the exchange of information in the context of the cooperation between data protection supervisory authorities and the Committee of independent persons.

1. Introduction and background

1. In the context of the 2018 State of the Union speech, the Commission presented on 12 September 2018 a security package focusing on Free and fair European elections. It is composed of a legislative proposal accompanied by 3 non-legislative measures: — a Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU, Euratom) No 1141/2014 as regards a verification procedure related to infringements of rules on the protection of personal data in the context of elections to the European Parliament (COM (2018) 636 final/2) (hereafter the ‘proposed Regulation’), — a Communication on Securing free and fair European elections (COM (2018) 637 final) (hereafter the ‘Communication’), — a Recommendation on election cooperation networks, online transparency and protection against cybersecurity incidents and fighting disinformation campaigns in the context of elections to the European Parliament (C (2018) 5949 final) (hereafter the ‘Recommendation’), and — a Guidance on the application of Union data protection law in the electoral context (COM (2018) 638 final) (hereafter the ‘Guidance’).

2. This package has been adopted with a view of securing fair and free elections to the European Parliament to be held in May 2019, taking into account the new challenges put forward by online communication and recent revelations such as the ‘Facebook/Cambridge Analytica’ case ( 2 ) . It is presented together with a proposal for a Regulation of the European parliament and of the Council establishing the European Cybersecurity Industrial, Technology and Research Competence Centre and the Network of National Coordination Centres (COM(2018) 630 final) ( 3 )

3. It is complementary to the Commission Communication of 26 April 2018‘Tackling online disinformation: a European approach’ (COM/2018/236 final), which seeks to promote a more transparent, trustworthy and accountable online environment. One of its key deliverables, the self-regulatory Code of Practice on Disinformation, was published on 26 September 2018. The Commission has also published the opinion of the Sounding board of the Multi-stakeholder forum on the Code of Practice ( 4 ) . The actions foreseen in this Communication, including this Code of Practice, complement the ongoing work of the EEAS. Following the European Council conclusions of 28 June 2018 ( 5 ) , the Commission and the High Representative of the Union for Foreign Affairs and Security Policy will present in cooperation with Member States a revised action plan to fight disinformation, by the end of the year ( 6 )

4. aims to allow financial sanctions on European political parties or foundations that use infringements of data protection rules to deliberately influence or attempt to influence the outcome of elections to the European Parliament ’ be added to the list of infringements which prevent a European political party or foundation to apply for funding from the general budget of the European Union in the year when the sanction was imposed ’ GDPR ’) to inform immediately and proactively the Authority for European Political Parties and European Political Foundations (hereafter the ‘ Authority ’) with a view to influencing elections to the European Parliament ’ apply appropriate sanctions ’ ( 12 ). The proposed Regulation ‘ ( 7 ) . In addition to financial penalties which could be imposed on European political parties or foundations, of 5 % of their annual budget ( 8 ) , a new ground would ‘ ( 9 ) . In its Recommendation, the Commission encourages national data protection supervisory authorities established under the General Data Protection Regulation (hereafter the ‘’) to inform immediately and proactively the Authority for European Political Parties and European Political Foundations (hereafter the ‘’) ( 10 ) of their decisions finding an infringement of data protection rules, where the infringement is linked to political activities by a European political party or foundation ‘ ( 11 ) . The Commission also recommends, for cases involving political parties or foundations at national and regional level, Member States to ‘

5. [t]his will enable them quickly to detect potential threats to the elections to the European Parliament and swiftly enforce existing rules, including available financial sanctions, such as reimbursement of the public contribution ’ ( 16 ). In addition, the Recommendation encourages the establishment of a national election network in each Member State as well as a European coordination network on the elections to European Parliament ( 13 ) . The latter is a follow-up to the first exchange organised by the Commission between EU countries on electoral best practices in April 2018. It would be composed of national contact points and should meet in January and April 2019 ( 14 ) . It is planned as a real time European alert process and as a forum for exchange of information. The national networks would, inter alia, aim at exchanging information on issues capable of affecting the European elections, between national authorities with competence for electoral matters and for cybersecurity as well as national data protection authorities and national audiovisual regulatory authorities or bodies. It is recommended that these national networks consult and cooperate with the relevant national law enforcement authorities in accordance with national law ( 15 ) and that where appropriate, cooperation between national law enforcement authorities at European level may be facilitated by Europol. According to the Commission, ‘

6. The Commission finally presents several recommendations ( 17 ) to facilitate transparency in political advertising ahead of the elections to the European Parliament and encourages Member States to take appropriate measures in the area of cybersecurity of the European Parliament electoral process and to engage in awareness raising activities with third parties, including online platforms and information technology providers, for better transparency and trust building in the electoral process.

7. have to make full use of their strengthened powers to address possible infringements ’ ( 18 ). The Guidance highlights the existing Union data protection framework and its application in the electoral context. According to the Commission, since it is the first time that the GDPR will be applied in the European electoral context, it is important for all actors involved in election processes to understand clearly how best to apply these rules. The Commission underlines that the national data protection authorities ‘

8. protect the Union's democratic systems and combat disinformation, including in the context of the upcoming European elections, in full respect of fundamental rights. In this respect, the measures proposed by the Commission on election cooperation networks, online transparency, protection against cybersecurity incidents, unlawful data manipulation and fighting disinformation campaigns and tightening the rules on European political party funding deserve rapid examination and operational follow-up by the competent authorities On 18 October 2018, the European Council called for measures to ‘ ( 19 ) ’.

9. the measures proposed by the Commission for securing free and fair European elections, in particular the legislative amendment to tighten up the rules on European political party funding, creating the possibility to impose financial sanctions for breaching data protection rules in order to deliberately influence the outcome of the European elections ’ and that ‘ the processing of personal data by political parties in the EU is subject to the GDPR, and that the breach of the principles, rights and obligations encompassed within this law would result in additional fines and sanctions ’. The resolution considers that ‘ election interference to be a huge risk for democracy, the tackling of which requires a joint effort involving service providers, regulators and political actors and parties ’ and welcomes this Commission package On 25 October 2018, the European Parliament adopted a resolution recalling ‘’ and that ‘’. The resolution considers that ‘’ and welcomes this Commission package ( 20 ) . On 3 December 2018, the Committee on Civil Liberties, Justice and Home Affairs of the European Parliament adopted its opinion on the proposed Regulation ( 21 ) . On 6 December 2018, the Committee on Constitutional Affairs adopted its report on the proposed Regulation ( 22 )

10. The European Data Protection Supervisor (hereafter the ‘ EDPS ’) welcomes the informal consultation by the Commission on the proposed Regulation, the Recommendation and the Guidance prior to their adoption and the fact that part of his informal comments were taken into account. He underlines however that due to the short notice, these were preliminary comments. Therefore, he makes the following formal comments. In this regard, he would like to recall that, when it adopts a legislative proposal relating to the protection of individuals' rights and freedoms with regard to the processing of personal data, as it is the case here, the Commission shall consult the EDPS.

3. Conclusion

36. The EDPS recognises political communication as essential to the participation of citizens, political forces and candidates in democratic life and to the fundamental right to freedom of expression, and that these rights and freedoms are interdependent with the right under Article 7 of the Charter to respect for private and family life, home and communications, and the right under Article 8 of the Charter to the protection of personal data.

37. He recognises the reference made, in particular in the Communication and the Guidance, to the role of social media platforms and on how this initiative would be coherent with the Code of Practice on online disinformation.

38. In light of the upcoming European Parliament elections in May next year, and the numerous other national elections scheduled for 2019, the EDPS also recognises the recommendations for the setting up of national election networks and a European coordination network. He takes this opportunity to show his availability to participate in this European network. It would complement EDPS action in this area, in particular the workshop which he organises in February next year.

39. The EDPS also recognises the recommendation to Member States to perform a comprehensive assessment of risks associated with the elections to the European Parliament with a view to identifying potential cyber incidents that could affect the integrity of the electoral process and underlines the urgency of this matter.

40. In general, the EDPS considers that, for further clarity, a reference could have been included to the processing of personal data by the European Parliament, the Authority and the Committee, as being within the scope of Regulation (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data (previously, Regulation (EC) No 45/2001).

41. In addition and more specifically, the EDPS makes several recommendations in relation to the proposed Regulation, among which: — clarifying the scope of the measures and the complementary aims of such sanctions, — including EDPS decisions finding an infringement to Regulation (EU) 2018/1725, — including a reference to the current data protection legal framework for cooperation between national data protection supervisory authorities and the EDPS, and — ensuring the confidentiality of the exchange of information in the context of the cooperation between data protection supervisory authorities and the Committee of independent persons.

Brussels, 18 December 2018. Giovanni BUTTARELLI European Data Protection Supervisor

(1) OJ L 295, 21.11.2018, p. 39.

(2) Communication, p. 2.

(3) http://europa.eu/rapid/press-release_IP-18-5681_en.htm

(4) The Code and its Annex as well as the opinion of the Sounding board are available at: https://ec.europa.eu/digital-single-market/en/news/code-practice-disinformation

(5) Available at: https://www.consilium.europa.eu/media/35936/28-euco-final-conclusions-en.pdf

(6) Communication, p. 10.

(7) Explanatory memorandum to the proposed Regulation, p. 2.

(8) See Article 27(4)(a) of Regulation (EC) No 1141/2014 and the Commission factsheet on free and fair European elections available at: https://ec.europa.eu/commission/sites/beta-political/files/soteu2018-factsheet-free-fair-elections_en.pdf

(9) Explanatory memorandum to the proposed Regulation, p. 6.

(10) This Authority was established under Regulation (EC) No 1141/2014 (Article 6).

(11) Recommendation 6. Also, in its Communication, p. 7, the Commission ‘calls also upon Member States to promote, in compliance with the applicable national and Union law, the sharing of information by the national data protection authorities to the authorities in charge of monitoring elections and political parties' activities and financing where it follows from their decisions, or where there are otherwise reasonable grounds to believe, that an infringement is linked to political activities by national political parties or foundations in the context of elections to the European Parliament ’. Emphasis added.

(12) Recommendation 11.

(13) Recommendations 1 to 5 included.

(14) Communication, p. 7 and the Commission factsheet on free and fair European elections available at: https://ec.europa.eu/commission/sites/beta-political/files/soteu2018-factsheet-free-fair-elections_en.pdf

(15) Communication, footnote 20: ‘[t]his would concern in particular cases where an election process is targeted with malicious intent, including incidents based on attacks against information systems. Depending on the circumstances, criminal investigations that may result in criminal penalties may be appropriate. As noted above, definitions of offences and minimum maximum levels of penalties for attacks against information system have been harmonised by Directive 2013/40/EU’.

(16) Communication, p. 7.

(17) Recommendations 7 to 10 included and 12 to 19 included.

(18) Communication, p. 8, point 3 ‘Applying Data protection rules in the electoral process’.

(19) Conclusions available at: https://www.consilium.europa.eu/media/36775/18-euco-final-conclusions-en.pdf

(20) See points 10 to 12 of the Resolution on the use of Facebook users' data by Cambridge Analytica and the impact on data protection P8_TA-PROV(2018)0433 (2018/2855(RSP)), available at: http://www.europarl.europa.eu/sides/getDoc.do?pubRef=-//EP//NONSGML+TA+P8-TA-2018-0433+0+DOC+PDF+V0//EN, emphasis added.

(21) Available at: http://www.europarl.europa.eu/sides/getDoc.do?type=COMPARL&reference=PE-630.530&format=PDF&language=EN&secondRef=02

(22) Available at: http://www.europarl.europa.eu/sides/getDoc.do?pubRef=-//EP//NONSGML+REPORT+A8-2018-0435+0+DOC+PDF+V0//EN