On 28 July 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on European Union labour market statistics on businesses, repealing Council Regulation (EC) No 530/1999 and Regulations (EC) No 450/2003 and (EC) No 453/2008 of the European Parliament and of the Council (‘the Proposal’). The EDPS welcomes the objectives of the Proposal of improving the labour market statistics on businesses (‘LMB’) by covering the whole economy, enhancing its timeliness, filling information gaps and simplifying the framework.

The EDPS observes that data transmitted by Member States to the Commission (Eurostat) for the purpose of LMB may constitute personal data of identifiable employees. The EDPS recalls that any processing of personal data should be limited to what is necessary and proportionate in relation to the purpose for which they are processed and considers that the future Regulation should clarify that the data should normally be aggregated to such a degree that individuals cannot be identified.

The EDPS recognises that new innovative approaches can bring promises for statistics and research. However, the EDPS has concerns regarding the indication that information relating to specific persons might be obtained from ‘other sources’, which is defined broadly. He considers that the relevant sources for the required data may already be anticipated and he believes it necessary that they are specified.

The EDPS also has serious concerns regarding the indication that information relating to specific persons might be obtained from private records. The EDPS considers that collection of personal data from such sources may not be necessary and proportionate to the aims pursued, having regard to the potential risks for the rights and freedoms of data subjects. The EDPS recalls his recommendations in Opinion 40/2023 (1) in this regard that only non-personal (anonymised) data will be requested from private data holders. Insofar as the Proposal seeks to provide a legal basis to request personal data from private data holders, it should provide a clear and comprehensive overview of the privately held data sources from which data may be obtained. Further, the EDPS recommends that sharing of personal data by private data holders shall make use of privacy-enhancing technologies and take place using a secure infrastructure.

As regards the use of web scraping techniques as an innovative way to process data, the EDPS cautions against the use thereof to collect personal data. There is a risk that individuals lose control of their personal data. The EDPS considers that such processing may not be necessary and proportionate to the aims pursued. He recommends clarifying whether web craping techniques may be used to achieve the envisaged aims under the Proposal, and if this were to be the case, to limit such use to non-personal data.

Lastly, concerning the envisaged pilot studies, the EDPS recommends that the future Regulation clarifies that such studies will not allow for data collection beyond the data categories foreseen by the Proposal. He considers further that the roles and responsibilities within the meaning of data protection law of the actors performing such studies should be specified.

1.   Introduction

1.

On 28 July 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on European Union labour market statistics on businesses, repealing Council Regulation (EC) No 530/1999 and Regulations (EC) No 450/2003 and (EC) No 453/2008 of the European Parliament and of the Council (‘the Proposal’) (2).

2.

The Proposal lays down a common legal framework for the development, production and dissemination of labour market statistics on businesses (‘LMB’) in the Union and aims at addressing limitations of LMB under the current legal framework by providing for coverage of the whole economy to improve the accuracy of some statistics. It regulates the collection of annual gender pay gap data to ensure future data transmissions and improve its quality. In addition, it aims at improving the timeliness of some LMB datasets and filling in some existing information gaps. Lastly, it also provides for simplification with greater use of administrative data and innovative sources (3).

3.

The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 28 July 2023, pursuant to Article 42(1) of EUDPR (4). The EDPS welcomes the reference to this consultation in Recital 13 of the Proposal.

7.   Conclusions

31.

In light of the above, the EDPS makes the following recommendations: (1) clarify that the data that Member States transmit to the Commission under the future Regulation should normally be aggregated to such a degree that individuals cannot be identified; (2) make specific reference to compliance with the safeguards relating to processing of personal data for statistical purposes under Article 89 GDPR (5) and Article 13 EUDPR, in particular that the data shall in principle be rendered anonymous; (3) make explicit reference to the applicability of the GDPR and EUDPR to the processing of personal data under the future Regulation; (4) clarify that any processing of data stemming from ‘other sources’ under Article 3(1)(c) of the future Regulation shall be without prejudice to the ePrivacy Directive (6); (5) specify from which ‘other sources’ referred to under Article 3(1)(c) of the Proposal data may be collected and transmitted; (6) ensure that only non-personal (anonymised) data will be requested from private data holders; (7) clarify whether web scraping techniques may be used to process data from websites. If this were to be the case, limit the use of web scraping techniques to non-personal data; (8) provide guidance on how sources categorised as 'low quality' in the quality report under Article 8(4) of the Proposal and the data collected through them should be managed; (9) clarify in the enacting part of the future Regulation the relationship of the future Regulation to Regulation (EC) No 223/2009 of the European Parliament and of the Council (7), including the recently proposed amendments in the proposal for a Regulation amending Regulation (EC) No 223/2009, with regard to the processing of personal data; (10) provide how data obtained through the pilot projects will (a) be further used for LMB and (b) potentially be integrated as permanent solutions; (11) clarify that pilot studies should not allow for data collection beyond the 'topics' and 'detailed topics' listed in Article 4(1) and specified within the Annex to the Proposal; and (12) specify the roles and responsibilities within the meaning of data protection law of the Commission (Eurostat) and the Member States regarding the pilot studies, insofar processing of personal data takes place for the purpose of the studies.

---

(1)   OJ C, C/2023/1055, 20.11.2023, ELI: http://data.europa.eu/eli/C/2023/1055/oj

(2)  COM(2023) 459 final.

(3)  COM(2023) 459 final, p. 1-2.

(4)  Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

(5)  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).

(6)  Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ L 201, 31.7.2002, p. 37).

(7)  Regulation (EC) No 223/2009 of the European Parliament and of the Council of 11 March 2009 on European statistics and repealing Regulation (EC, Euratom) No 1101/2008 of the European Parliament and of the Council on the transmission of data subject to statistical confidentiality to the Statistical Office of the European Communities, Council Regulation (EC) No 322/97 on Community Statistics, and Council Decision 89/382/EEC, Euratom establishing a Committee on the Statistical Programmes of the European Communities (OJ L 87, 31.3.2009, p. 164).