Summary of the Opinion of the European Data Protection Supervisor on the proposal for an Interoperable Europe Act 2023/C 60/12 (The full text of this Opinion can be found in English, French and German on the EDPS website https://edps.europa.eu)
Date: 2023-02-17
Institutions: European Data Protection Supervisor
Subjects: European Interoperability Framework, cross-border cooperation, data protection, digital transformation, electronic government, exchange of information, information system, personal data, protection of privacy, public sector, public service








C_2023060EN.01001701.xml










17.2.2023   


EN


Official Journal of the European Union


C 60/17






Summary of the Opinion of the European Data Protection Supervisor on the proposal for an Interoperable Europe Act
(2023/C 60/12)


(The full text of this Opinion can be found in English, French and German on the EDPS website https://edps.europa.eu)


On 18 November 2022 the European Commission issued the proposal for a Regulation of the European Parliament and of the Council laying down measures for a high level of public sector interoperability across the Union (Interoperable Europe Act) (1) (‘the proposal’). The objective of the proposal is to promote the cross-border interoperability of network and information systems which are used to provide or manage public services in the Union by establishing common rules and a framework for coordination on public sector interoperability, with the aim of fostering the development of interoperable trans-European digital public services infrastructure.
The EDPS acknowledges the benefits that can be derived from increased interoperability in the public sector and welcomes the efforts undertaken by the Commission to organize and institutionalise the process towards this goal. However, the EDPS also recalls that interoperability of network and information systems across sectors of public administration and across all levels of administration affects one of the most fundamental principles of data protection, the principle of purpose limitation. It is therefore crucial that the risks that are being created by removing technical barriers to information exchange, are considered further in the process. For this reason, the EDPS welcomes the provision requiring the Commission to consult the EDPS prior to authorising the establishment of regulatory sandboxes in cases where no EU institution, body or agency participates in the sandbox, and proposes a change in the wording.
The proposal would create a legal basis for the processing of personal data in regulatory sandboxes provided for in Article 11 and 12 of the proposal. The comments of the EDPS therefore concentrate on these provisions.
The EDPS recommends to consider whether possible use cases for the regulatory sandboxes exist that meet the standard of necessity, and if no such uses cases can be identified, to remove the legal basis for personal data processing from the proposal. He further identifies provisions seemingly without regulatory content, and proposes to amend them so that they would bear added value. In addition, the EDPS suggests to introduce an additional safeguard to ensure that test data does not become data in the production environment again, especially not after enriching it with data from other participants. He further suggests to require participants in regulatory sandboxes to provide the necessary essential information for a data protection evaluation by the supervisory authority to be carried out, with their request to the Commission to establish a sandbox, and proposes amendments to better address situations in which several supervisory authorities are competent to assess a proposed processing in a regulatory sandbox.
1.   INTRODUCTION









1.


On 18 November 2022 the European Commission issued the proposal for a Regulation of the European Parliament and of the Council laying down measures for a high level of public sector interoperability across the Union (Interoperable Europe Act) (‘the proposal’).












2.


The objective of the proposal is to promote the cross-border interoperability of network and information systems which are used to provide or manage public services in the Union by establishing common rules and a framework for coordination on public sector interoperability, with the aim of fostering the development of interoperable trans-European digital public services infrastructure. In particular, it aims at:






—


ensuring a consistent, human-centric EU approach to interoperability from policymaking to policy implementation;










—


establishing an interoperability governance structure designed to enable public administrations from all levels and sectors, as well as private stakeholders, to work together – with a clear mandate to agree on shared interoperability solutions (e.g. frameworks, open specifications, open standards, applications, or guidelines);










—


co-creating an ecosystem of interoperability solutions for the EU’s public sector, so that public administrations at all levels in the EU and other stakeholders can contribute to and re-use such solutions, innovate together and create public value.
















3.


The need for stronger action in the field was recognised and concrete action was announced in several Commission communications, among them the Communication ‘Shaping Europe’s Digital Future’ (2), ‘A European Strategy for Data’ (3), ‘Identifying and addressing barriers to the Single Market’ (4) and ‘Digitalisation of justice in the European Union A toolbox of opportunities’ (5). In addition, the European Council called for an empowering interoperability framework in its Communication to the Delegations on the Conclusions of the Special meeting on 1 and 2 October 2020 (6). This initiative was included in the Commission work programme for 2022 (REFIT annex) (7).












4.


The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 18 November 2022, pursuant to Article 42(1) of the EUDPR (8). The EDPS welcomes the reference to this consultation in recital 40 of the proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of the EUDPR.




6.   CONCLUSIONS









27.


In light of the above, the EDPS makes the following recommendations:






(1)


to consider whether possible use cases for the regulatory sandboxes exist that meet the standard, and if no such use cases can be identified, to remove the legal basis for personal data processing from the proposal;










(2)


to further define the relevant objectives of public interest in the context of the future Regulation and to be more specific on which particular objective referred to in Article 23(1) GDPR (9) and Article 25(1) EUDPR is being pursued;










(3)


to amend Article 12(6)(f) of the proposal so that it requires the sandbox participants to provide for effective technical and organizational arrangements for the fulfilment of data subjects’ rights;










(4)


to modify Article 12(6) as to prohibit any subsequent change of purpose, to ensure that test data does not become data in a production environment again, especially not after enriching it with data from other participants;










(5)


to amend Article 11(5) in a way that the purpose of the processing, the actors involved, their roles, the categories of data concerned, their source(s) and the envisaged retention period must be specified in the request within the meaning of Article 11(5) of the proposal, and that a data protection impact assessment should be underway or completed.









Brussels, 13 January 2023.

Wojciech Rafał WIEWIÓROWSKI




(1)  COM(2022) 720 final.

(2)  Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions - Shaping Europe’s digital future (COM(2020) 67 final).

(3)  Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions - A European strategy for data, 19 February 2020 (COM(2020) 66 final).

(4)  Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions - Identifying and addressing barriers to the Single Market (COM(2020) 93 final).

(5)  Commission Communication on the Digitalisation of justice in the European Union - A toolbox of opportunities (COM (2020) 710 final).

(6)  Communication from the General Secretariat of the Council to the Delegations on the Conclusions of the Special meeting of the European Council (1 and 2 October 2020) (EUCO 13/20).

(7)  Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions - Commission work programme 2022 Making Europe stronger together (COM(2021) 645 final).

(8)  Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

(9)  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).