Newsletter (104)

Together with the European Data Protection Board we adopted a Joint Opinion on the European Commission’s Proposal for a Regulation on additional procedural rules for the enforcement of the GDPR, on 21 September 2023.

The proposal aims to ensure the timely completion of investigations and the delivery of swift remedies for individuals in cross-border cases, by harmonising a number of procedural differences across the EU and streamlining the cross-border cooperation procedure. The proposal follows a wish list sent by the EDPB to the European Commission in October 2022.

EDPS Supervisor, Wojciech Wiewiórowski, said: “The Commission’s proposal is a welcome attempt to address some of the challenges identified by experts and practitioners related to the governance of the One-Stop-Shop mechanism. With our Joint Opinion, we hope to further improve the future legislation and, in particular, to foster timely resolution of cross-border cases, and to ensure that procedural rights of complainants are respected, keeping in mind constraints inherent in the GDPR enforcement model. Moreover, we call on the co-legislators to use this opportunity to address practical obstacles to efficient cooperation between national data protection authorities and the EDPS.”

Read Opinion

In September, EDPS Secretary-General Leonardo Cervera Navas and EDPS Supervisor Wojciech Wiewiórowski participated in a high-level titled "Data-protection in the Western Balkans and Eastern Partnership Region", arranged by the SIGMA Programme; the Eastern Partnership Regional Fund for Public Administration; the Regional Cooperation Council and the Regional School of Public Administration.

The event gathered data protection authorities and public institutions from Albania; Armenia; Azerbaijan; Bosnia and Herzegovina; Georgia; Kosovo; Moldova; Montenegro; North-Macedonia; Serbia and Ukraine. These 11 countries shared their insights, unique perspectives, as well as the challenges and opportunities they encounter when advocating for digital rights and the protection of individuals’ personal data.

The EDPS was present to share recommendations as the independent data protection authority supervising the EU institutions, bodies, offices and agencies, and as a member of the European Data Protection Board collaborating with other data protection authorities of the EU/EEA.

The Secretary-General highlighted the importance of having data protection authorities that work closely together, and that demonstrate flexibility to keep up with the rapidly changing digital regulatory landscape, and the increasing development of technologies impacting data protection.

You can read more about his reflections and recommendations in his Blogpost, summarising the key moments of this event.

When the EDPS opened its alternative social media platforms - EU Voice to share short posts and photos, and EU Video to share videos - in April 2022, its primary aim was to give users the choice of platforms that correspond to their preferred privacy settings and policies.

With these platforms, powered by the free and open-source Mastodon and PeerTube software, we aim to provide a response to the data protection concerns that mainstream platforms raise, such as the tracking of users, and the lack of transparent and unbiased algorithms.

Now, a year and a half later, what are some of the conclusions that we can draw from using these decentralised and independent platforms? The Supervisor, Wojciech Wiewiórowski, had the opportunity to present some of his findings at the Freedom not Fear conference, held in September in Brussels.

Since the creation of their platforms, the EDPS has carried out a number of initiatives in an effort to promote their use by the EU institutions, bodies, offices and agencies (EUIs), including the organisations of workshops and trainings, demonstrations at public events, and some other logistical support. As a result, a number of large EUIs, such as the European Commission, have developed their own online presence on these platforms, amassing substantial following. In most cases, the platforms were quickly recognised as interoperable and fulfilling their promises to better protect users’ fundamental rights.

Whilst these positive aspects should be highlighted, the popularity of these platforms is often not comparable to mainstream platforms, asserted the Supervisor at the Conference. The reasons why are three-fold, in his opinion.

Firstly, and perhaps more importantly, there is a lack of a unified political will to make these type of platforms - their creation and development - a priority, which directly affects the resources - time and money - invested in them.

Secondly, alternative social media platforms may appear to be less practical because they do not offer analytical tools useful to inform communicators’ work like mainstream platforms do, although the latter come at a cost to the privacy of individuals. In essence, the development and use of alternative social media platforms means making an active choice not to compromise individuals’ privacy rights.

Thirdly, the technical challenges that using alternative platforms represent. Using social media platforms powered by free and open-source software, like Mastodon and PeerTube, generally means developing and maintaining your own service. What is more, cross-publishing on alternative platforms, which the EDPS, like other EUIs, has experience in, is more demanding, and not always smooth, as this is, in most cases, prevented by mainstream platforms.

Taking stock of the work done in this area and exchanging with data protection and technology actors during open discussions, like the Freedom not Fear conference, helps inform the EDPS’ work. As the EU institution in charge of protecting individuals’ privacy, we will continue to proactively promote communication tools that prioritise individuals’ fundamental rights to data protection and privacy.

Watch video of Wojciech Wiewiórowski at the Freedom not Fear Conference.

Follow the EDPS on EU Voice and EU Video.

More information on the EDPS’ alternative social media platforms can be found here.

On 23 August 2023, the EDPS published two Opinions: one on the proposal for a Regulation on a Financial Data Access Framework and one on the proposal for a Regulation and Directive on payment services in the EU’s internal market. Both proposals aim to foster the sharing of data to broaden the offer of financial services and products, whilst providing individuals or organisations control over the processing of their financial data.

According to the Proposals, individuals and organisations would manage access to their financial data using dashboards provided by financial institutions. This would allow individuals concerned to monitor, restrict or grant access to their information. The EDPS highlights that, to achieve this objective, individuals or organisations should be provided with complete, accurate and clear information on the provider of the financial service requesting access to their data. Information on the type of product, payment or service for which an individual’s personal data would be used and the types of data requested should also be communicated.

The EDPS welcomes the efforts made to ensure the Proposals’ consistency with the General Data Protection Regulation (GDPR).  Both Proposals should specify that the granting of ‘permissions’ to access financial data does not equate to giving consent under the GDPR. Likewise, all processing of personal data following a request to access an individual’s financial data must have an appropriate legal basis under the GDPR.

Wojciech Wiewiórowski, EDPS, said: “Increased sharing of financial data should open new opportunities for individuals, not close doors. Without clear boundaries, one could see higher prices for important financial services or the exclusion of customers with an unfavourable risk profile. Financial authorities and data protection authorities will need to cooperate closely to ensure that individuals and their fundamental rights are protected”.

Read Opinion on the proposal for a Regulation on a Financial Data Access Framework 

Read Opinion on the proposal for a Regulation and Directive on payment services in the EU’s internal market

In times of crisis, the EU aims to provide support or send supplies and products to countries and regions affected by disasters. To provide an appropriate and rapid response, the European Commission has come up with a proposed Regulation for a Compulsory Licensing Scheme to allow the free movement of supplies and products needed for crisis management. In practice, this Compulsory Licensing Scheme would allow to override temporarily the patent of certain supplies and products, such as medicinal or pharmaceutical products, for them to be manufactured and distributed to address a crisis or emergency.

Regulating a Compulsory Licensing Scheme may involve the processing of personal data, for example between EU Member States’ competent authorities and the European Commission. This is why we issued an Opinion on 28 July in which we submitted remarks on the process of enforcing the EU’s Compulsory License Scheme, and on the granting of Compulsory Licences at EU Member State level. 

In our Opinion, we take note that to enforce the EU’s Compulsory Licensing Scheme, the European Commission plans to introduce fines or periodic penalty payments. According to the Proposal, the decisions of issuing such fines or penalty payments, including to whom these are addressed to, would be made public. We recommend to only disclose the personal data of individuals involved in these fines on an exceptional and justified basis, in cases of serious infringements and if strong dissuasive measures are needed. 

In some cases, national compulsory licences may be granted for the purpose of addressing a national crisis or emergency. Should this occur, the relevant EU Member State would need to report this to the European Commission, including the name and address of the licensee, states the Proposal. In response to this foreseen measure, we advise that specific roles and responsibilities are defined for the European Commission and EU Member States alike, to ensure that the processing of personal data of licensees is done according to EU data protection law.

Read the Opinion here

Speech of European Data Protection Supervisor Wojciech Wiewiórowski at the Joint Parliamentary Scrutiny Group on Europol.

Keynote Speech by Wojciech Wiewiórowski at the Europol Data Protection Expert Network Conference.