Executive summary of the Opinion of the European Data Protection Supervisor on the Commission Regulation establishing a Union Registry for the trading period commencing on 1 January 2013 , and subsequent trading periods, of the Union emissions trading scheme
Date: 2012-11-01
Institutions: European Data Protection Supervisor
Subjects: database, exchange of information, greenhouse gas, information system, personal data, reduction of gas emissions, tradeable emission permit








C_2012335EN.01001001.xml










1.11.2012   


EN


Official Journal of the European Union


C 335/10





Executive summary of the Opinion of the European Data Protection Supervisor on the Commission Regulation establishing a Union Registry for the trading period commencing on 1 January 2013, and subsequent trading periods, of the Union emissions trading scheme
(The full text of this Opinion can be found in English, French and German on the EDPS website: http://www.edps.europa.eu)
2012/C 335/07
1.   Introduction

1.1.   Background







1.


On 18 November 2011, the Commission adopted Commission Regulation (EU) No 1193/2011 establishing a Union Registry for the trading period commencing on 1 January 2013, and subsequent trading periods, of the Union emissions trading scheme pursuant to Directive 2003/87/EC of the European Parliament and of the Council and Decision No 280/2004/EC of the European Parliament and of the Council and amending Commission Regulations (EC) No 2216/2004 and (EU) No 920/2010 (the ‘Regulation’) (1). The Regulation was sent to the EDPS for consultation on the same date.










2.


Already before the adoption of the Regulation, the EDPS was given the possibility to provide informal comments. Some of these comments have been taken into account in the Regulation, and the EDPS notes that the data protections safeguards have been strengthened as a result.










3.


The EDPS welcomes the fact that he is formally consulted by the Commission and that a reference to the present Opinion is included in the preamble of the instrument adopted.




1.2.   Objectives and scope of the Regulation







4.


The EU Emissions Trading System (‘ETS’) is one of the policies introduced across the European Union (‘EU’) to help meet EU greenhouse gas emissions reduction targets under the Kyoto Protocol. The ETS creates a compliance regime for operators and aims at ensuring that emissions are effectively capped across the EU (2).










5.


The Regulation amends and will replace as of 1 January 2013 earlier Commission Regulations on the subject, in particular, Commission Regulations (EC) No 2216/2004 and (EU) No 920/2010 (3), both adopted to provide the rules ‘for a standardised and secured system of registries’.










6.


One of the key novelties introduced via the Regulation is the establishment, as of 2012, of a centralised, Union Registry, instead of the previous system of a combination of national registries.










7.


The Union Registry and the so-called European Union Transaction Log (or ‘EUTL’), which has already been in place at the EU level, are two sub-systems hosted and operated by the European Commission. They have two different functions but are complementary systems.










8.


The Union Registry holds the accounts of actors involved in the ETS (e.g. operator holding accounts, aircraft operating holding accounts, trading accounts, auction accounts) and records transactions performed between accounts. The Union Registry, thus, is a central electronic registry at EU level to support emission trading by account holders within and across Member States.










9.


The EUTL, in turn, records the allocations, transfer and cancellation of CO2 emission allowances in the EU and checks the consistency and coherence of certain operations.




2.   Objectives and structure of the EDPS opinion







10.


While the main objective of the Regulation is not the processing of personal data, the Regulation nevertheless requires the processing of personal data, including criminal record information and information on suspected criminal activities. These data are processed in order to ensure that the accounts will not be misused for criminal activities.










11.


The personal data may relate to individuals acting on behalf of the account-holders such as their ‘directors’ and authorised representatives. In addition, account-holders themselves may also be natural persons. If so, their personal data may also be processed. Further, some data are also collected about beneficial owners of the account-holders, who may also be individuals (4).










12.


In light of the — often sensitive — personal data that are required to be processed under the Regulation, the EDPS recommends that adequate data protection safeguards should be established in the Regulation.










13.


Considering that the Regulation has already been adopted, the primary objective of this Opinion is to help ensure that the EDPS recommendations will be taken into account when the Regulation will be amended, which is foreseen for the end of 2012.










14.


In addition, the recommendations provided in the Opinion may also serve to guide the Commission and national administrators when implementing the necessary data protection safeguards at the practical level. For more detail on practical implementation, see paragraphs 41-43 calling for the preparation of a comprehensive data protection policy, paragraph 36 on other practical measures such as help menus and warning messages in the Union Registry, and training materials, and paragraph 40 on system documentation and publication of information on the Union Registry website.










15.


Section 3 of this Opinion briefly outlines what personal data are required to be processed pursuant to the Regulation, focusing on sensitive data. This description is necessary in order to put into context the recommendations provided in Sections 4-12 of this Opinion. Section 4 calls for further clarifications on what personal data are processed under the Regulation, who processes such data and where the data are stored, focusing, again, on sensitive data. Sections 5-12 contain the remaining recommendations of the EDPS, while Section 13 outlines his conclusions.




13.   Conclusions







77.


The EDPS recommends that the Regulation should, when it will be amended, as foreseen, later in 2012:






—


clarify further what personal data are to be processed under the Regulation, and what personal data are stored and processed in the Union Registry and the EUTL. The EDPS would in particular welcome a general provision in the Regulation that no special categories of personal data shall be recorded in the EUTL and the Union Registry (Section 4),










—


establish clearly whether the central administrator will be part of the European Commission, will be another EU institution/agency/body, or an entity organised under the laws of one of the Member States (Section 5),










—


require the adoption of a data protection policy to allocate tasks and responsibilities (Section 6),










—


define more specifically the purposes of access to data by third parties, including Europol, and provide adequate safeguards for anonymisation in case of data mining (Section 7),










—


prohibit publication of sensitive data (Section 8),










—


be amended with regard to retention periods to ensure that the data retention requirements are in accordance with EU data protection legislation (Section 9),










—


ensure that adequate notice should be provided to data subjects about the fact that they have been blacklisted and that a mechanism is available to ensure rights of access of data subjects and that the information contained in the blacklist is accurate and up-to-date; ensure adequate retention periods, limits on access and limits on the purposes for which the black-list may be used (Section 10),










—


prohibit transfers of sensitive personal data outside the European Union, in particular, to the International Transaction Log (Section 11), and










—


provide additional clarifications on security and accountability (audits) (Section 12).














78.


In addition, the EDPS recommends that his comments be taken into account by the Commission and Member States when implementing the necessary data protection safeguards at the practical level. This may include adoption of a data protection policy, provision of information on the Union Registry website, other practical measures such as help menus and warning messages in the Union Registry, and provision of training materials.





Done at Brussels, 11 May 2012.

Giovanni BUTTARELLI

Assistant European Data Protection Supervisor





(1)  OJ L 315, 29.11.2011, p. 1.

(2)  For further information on the ETS, see: http://ec.europa.eu/clima/publications/docs/ets_en.pdf

(3)  OJ L 386, 29.12.2004, p. 1 and OJ L 270, 14.10.2010, p. 1.

(4)  See Section 3 below for more detail on the categories of data, including sensitive data, processed under the Regulation.