Summary of the Opinion of the European Data Protection Supervisor on the proposal for a Regulation of the European Parliament and of the Council on European statistics on population and housing 2023/C 123/09 (The full text of this Opinion can be found in English, French and German on the EDPS website https://edps.europa.eu)
Date: 2023-04-05
Institutions: European Data Protection Supervisor
Subjects: EU statistics, census, data collection, data protection, family, household, personal data, population census, population statistics, protection of privacy








C_2023123EN.01000901.xml










5.4.2023   


EN


Official Journal of the European Union


C 123/9






Summary of the Opinion of the European Data Protection Supervisor on the proposal for a Regulation of the European Parliament and of the Council on European statistics on population and housing
(2023/C 123/09)


(The full text of this Opinion can be found in English, French and German on the EDPS website https://edps.europa.eu)


On 20 January 2023, the European Commission issued a proposal of the European Parliament and of the Council on European statistics on population and housing, amending Regulation (EC) No 862/2007 and repealing Regulations (EC) No 763/2008 and (EU) No 1260/2013 (1).
The proposal contains provisions aiming to facilitate access to available data sources that will improve the production processes and general quality of social statistics. In this context, the EDPS considers that the recitals of the proposal should make specific reference to compliance with the safeguards relating to processing for statistical purposes under Article 89 of the GDPR (2) and Article 13 of the EUDPR (3). In addition, the proposal should clarify that in principle only anonymised or pseudonymised data will be used and shared for statistical purposes.
High quality statistics are necessary to support the design, implementation and evaluation of Union policies, including fundamental rights policies. The EDPS also recognises that new innovative approaches can bring promises for statistics and research. However, the EDPS has serious concerns regarding the indication that information relating to specific persons might be obtained from any source, including digital traces relating to specific persons. The EDPS therefore considers that the last sentence of Article 2(3) of the proposal, which refers to the use of any appropriate source or combination of them, including digital traces relating to the person, should be deleted.
In addition, the EDPS considers that further clarification is needed regarding the sources and categories of data that will be accessed and used by the Member States and the Commission (Eurostat), in particular as regards administrative data sources and privately held data. Privately held data can be diverse, as it is understood to encompass a vast amount of data held by business, including data gathered through mobile phone records, location data, social media data, but also through the Internet of Things (IoT) and provision of digital services. The EDPS considers that collection of personal data from such sources may not be proportionate to the aims pursued, having regard to the potential risks for the rights and freedoms of data subjects. Insofar as the proposal seeks to provide a legal basis for the processing of personal data by the Member States or the Commission, it is necessary to provide a clear and comprehensive overview of the categories of personal data that may be processed under the proposal, taking into account the requirements of necessity and proportionality. Moreover, the sources from which those categories of personal data may be obtained should be clearly set out in the proposal itself.
As regards the collection of statistics from the Large-Scale IT systems (LSITs) in the Area of Freedom, Security and Justice, the EDPS that Article 10 of the proposal should be amended. In particular, the proposal should clarify that statistics for LSITs shall be gathered (exclusively) from the central repository for reporting and statistics (CRRS). In case the Commission would like to foresee transitional measures until the CRRS is fully operational, specific transitional measures should be introduced.
The EDPS welcomes that the proposal envisages the testing and use of privacy-enhancing technologies that implement data minimisation by design. The EDPS is aware of the potential of privacy enhancing technologies as enablers of data sharing which is both privacy friendly and socially beneficial and fully supports the use of privacy-enhancing technologies in this context. At the same time, the EDPS recalls that any sharing of personal data must in any event comply with all relevant provisions of the GDPR and EUDPR, including Article 89(1) GDPR and Article 13 EUDPR.
Finally, concerning the establishment of a secure infrastructure to facilitate such data sharing, the EDPS notes that the proposal does not specify the roles and responsibilities of the Commission (Eurostat) and the competent national authorities within the meaning of data protection law. While detailed arrangement to ensure compliance with data protection requirements may be specified by way of an implementing act, the EDPS considers that the roles of the various actors involved as controller, joint controller or processor should be clearly specified in the enacting terms of the proposal.
1.   INTRODUCTION







1.


On 20 January 2023, the European Commission (‘Commission’) issued a proposal for on European statistics on population and housing, amending Regulation (EC) No 862/2007 (4) and repealing Regulations (EC) No 763/2008 (5) and (EU) No 1260/2013 (6) (‘the proposal’).










2.


The objective of the proposal is to facilitate access to available data sources that would improve the production processes and general quality of social statistics. It also contains provisions to strengthen the links to and general consistency of all EU social statistics based on persons and households, as well as provisions aimed at developing a harmonised definition of population based on sound statistical concepts for all outputs. The proposal also contains provisions to further align population and international migration statistics with statistics on administrative and judicial events related to asylum, legal and irregular migration under Articles 4, 5, 6 and 7 of Regulation (EC) No 862/2007 (7).










3.


The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 20 January 2023, pursuant to Article 42(1) of the EUDPR. The EDPS welcomes the reference to this consultation in recital 40 of the proposal.




5.   CONCLUSIONS

In light of the above, the EDPS makes the following recommendations:






(1)


to include in a recital of the proposal a reference to compliance with the safeguards relating to processing for statistical purposes under Article 89 of the GDPR and Article 13 of the EUDPR;










(2)


to clarify in the proposal that in principle only anonymised or pseudonymised data will be used and shared for statistical purposes;










(3)


to delete the last sentence of Article 2(3) of the proposal, which refers to the use of any appropriate source or combination of them, including digital traces relating to the person;










(4)


insofar as the proposal seeks to provide a legal basis for the processing of personal data, to provide a clear and comprehensive overview of the categories of personal data that may be processed as well as the sources from which those categories of data may be obtained;










(5)


to amend Article 10 of the proposal and clarify that statistics for LSITs shall be gathered exlusviely from the central repository for reporting and statistics (CRRS) established by the relevant instruments instruments. In case the Commission would like to foresee transitional measures until the CRRS is fully operational, specific transitional measures should be introduced;










(6)


to specify the roles of the Commission and the Member States under data protection law in relation to the secure infrastructure to be established in accordance with Article 13(2) of the proposal.





Brussels, 16 March 2023.

Wojciech Rafał WIEWIÓROWSKI




(1)  COM/2023/31 final.

(2)  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).

(3)  Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

(4)  Regulation (EC) No 862/2007 of the European Parliament and of the Council of 11 July 2007 on Community statistics on migration and international protection and repealing Council Regulation (EEC) No 311/76 on the compilation of statistics on foreign workers (OJ L 199, 31.7.2007, p. 23).

(5)  Regulation (EC) No 763/2008 of the European Parliament and of the Council of 9 July 2008 on population and housing censuses (OJ L 218, 13.8.2008, p. 14).

(6)  Regulation (EU) No 1260/2013 of the European Parliament and of the Council of 20 November 2013 on European demographic statistics (OJ L 330, 10.12.2013, p. 39).

(7)  COM(2023) 31 final, p. 3.