Summary of the Opinion of the European Data Protection Supervisor on the proposal for a Directive of the European Parliament and of the Council amending Directives 2009/102/EC and (EU) 2017/1132 as regards further expanding and upgrading the use of digital tools and processes in company law 2023/C 253/05 (The full text of this Opinion can be found in English, French and German on the EDPS website https://edps.europa.eu)
Date: 2023-07-18
Institutions: European Data Protection Supervisor
Subjects: access to information, administrative cooperation, company law, cross-frontier data flow, data protection, digital transformation, digitisation, personal data, protection of privacy, registration of a company, small and medium-sized enterprises








C_2023253EN.01000801.xml










18.7.2023   


EN


Official Journal of the European Union


C 253/8






Summary of the Opinion of the European Data Protection Supervisor on the proposal for a Directive of the European Parliament and of the Council amending Directives 2009/102/EC and (EU) 2017/1132 as regards further expanding and upgrading the use of digital tools and processes in company law
(2023/C 253/05)


(The full text of this Opinion can be found in English, French and German on the EDPS website https://edps.europa.eu)


On 29 March 2023, the European Commission issued the proposal for a Directive of the European Parliament and of the Council amending Directives 2009/102/EC and (EU) 2017/1132 as regards further expanding and upgrading the use of digital tools and processes in company law (‘the proposal’).
The EDPS takes note of the overall objective of the proposal, aiming at increasing transparency and trust in the business environment, for companies, consumers and other private stakeholders as well as public authorities. According to settled case-law of the Court of Justice of the European Union, legislation providing for the public disclosure of personal data interferes with the rights to protection of personal life and to personal data. While the EDPS understands that it might be necessary to make certain categories of personal data public to achieve specific and clearly defined objectives of public interest, the objective of transparency cannot be invoked as an end in itself. To ensure compliance with Articles 7 and 8 of the Charter, the EDPS considers that the objectives of public interest justifying disclosure of personal data should be articulated more clearly in the enacting terms of the proposal. In addition, the categories of personal data to be made publicly available should be specified in an exhaustive manner, having regard to the requirements of necessity and proportionality.
Similarly, the EDPS understands that connecting the different Union level systems of interconnection of registers aims to further increase transparency. However, the establishment of connections between the system of interconnection of registers (BRIS), the beneficial ownership registers interconnection system (BORIS) and the insolvency registers interconnection system (IRI) should correspond to specific objectives, explicitly laid down in the enacting terms of the proposal.
Finally, the proposal should clarify the respective roles of Member States and the Commission, in particular in the context of the BRIS, and of the connection between the BRIS and the BORIS and IRI.
1.   INTRODUCTION









1.


On 29 March 2023, the European Commission issued the proposal for a Directive of the European Parliament and of the Council amending Directives 2009/102/EC and (EU) 2017/1132 as regards further expanding and upgrading the use of digital tools and processes in company law (1) (‘the proposal’).












2.


The overall objectives of the proposal are to enhance transparency and trust in the business environment, achieve more digitalised and connected cross-border public services for companies, and easier cross-border expansion for SMEs leading, in turn, to a more integrated and digitalised single market. To achieve this, the proposal would increase the amount of company data available in business registers and/or Business Registers Interconnection System (BRIS) and improve its reliability. It would also enable direct use of company data available in business registers when setting up cross-border branches and subsidiaries, and in other cross-border activities and situations (2).












3.


The proposal is in line with the EU digitalisation objectives set out, in particular, in the Commission Communication 2030 Digital Compass: the European way for the Digital Decade (3). It is also in line with the Commission Communications Updating the 2020 New Industrial Strategy (4) and SME Strategy for a sustainable and digital Europe (5), since it aims to address obstacles to cross-border expansion that small and medium-sized enterprises (SMEs) currently face in the single market. The proposal is included in the 2023 Commission work programme as one of the key actions under the Commission’s headline ambition of ‘Europe fit for the digital age’ (6).












4.


The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 30 March 2023, pursuant to Article 42(1) of EUDPR (7). The EDPS welcomes the reference to this consultation in recital 39 of the proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.




6.   CONCLUSIONS









26.


In light of the above, the EDPS makes the following recommendations:






(1)



to articulate the objectives of public interest justifying public disclosure more clearly, and to do so in the enacting terms of the proposal,











(2)



to specify exhaustively in the proposal all categories of personal data that are to be made publically available,











(3)



to specify what is meant by the use of the term ‘particulars’,











(4)



to specify in the enacting terms of the proposal the specific purposes of the connection between the system of interconnection of registers, the beneficial ownership registers interconnection and the insolvency registers interconnection,











(5)



to clarify the respective roles of Member States and the Commission, in particular in the context of the connections to be established between the system of interconnection of registers, the beneficial ownership registers interconnection and the insolvency registers interconnection.










Brussels, 17 May 2023.

Wojciech Rafał WIEWIÓROWSKI




(1)  COM(2023) 177 final.

(2)  COM(2023) 177 final, p. 2.

(3)  COM(2021) 118 final.

(4)  COM(2021) 350 final.

(5)  COM (2020) 103 final.

(6)  COM(2022) 548 final.

(7)  Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).