Summary of the Opinion of the European Data Protection Supervisor on the Proposal for a Regulation of the European Parliament and of the Council on the financial rules applicable to the general budget of the Union

(2022/C 288/05)

(The full text of this Opinion can be found in English, French and German on the EDPS website https://edps.europa.eu)

On 16 May 2022, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on the financial rules applicable to the general budget of the Union, amending the Financial Regulation. The EDPS notes that the Proposal aims to improve the quality and interoperability of data on recipients of Union funding and on those ultimately benefitting, directly or indirectly, from Union funding in order to effectively prevent, detect, investigate and correct frauds or remedy irregularities.

The EDPS fully supports the goals of the Proposal, including the increased use of digitalisation to better protect EU financial interests and to combat fraud and other irregularities. While processing of personal data may be necessary to achieve this goal, it is incumbent upon the EU legislator to ensure that any interference with the right to data protection remain limited to what is strictly necessary and proportionate to the objectives pursued.

The EDPS welcomes that the Proposal aims to establish the categories of data that will be processed in order to achieve the Proposal’s objectives. The EDPS understands, however, that the process of data-mining and risk-scoring will not be limited to the data explicitly identified by the Proposal and that those data would be compared with data from other sources. The EDPS considers it necessary to explicitly identify all the categories of personal data to be processed, as well as the sources of those data. Appropriate safeguards to ensure the quality and accuracy of those data should also be put in place, particularly in circumstances where those other data would be collected from third parties.

The EDPS observes that no additional information in the Proposal is provided as regards to the IT system itself. Therefore, he recommends clarifying the type of the IT system to be used, in particular whether the Commission plans to base the system on the already existing IT system ‘Arachne’ or to create a completely new IT system. Regardless of the use of existing structures, the EDPS would like to remind that appropriate safeguards need to be established and introduced in the architecture of this IT system, in line with the general data protection rules applicable to the processing of personal data. This should be well reflected upon in the design and development phase of the IT system, in line with the requirement of data protection by design.

The EDPS also strongly recommends the co-legislator to clearly define the maximum duration for which personal data referred to may be stored and made available in the single integrated IT system for data-mining and risk-scoring provided by the Commission.

Regarding publication of relevant information concerning all recipients of funds financed from the EU budget, the EDPS positively notes the efforts to made to balance the principle of transparency against the interference with the right of the recipients concerned to respect for their private life in general and to the protection of their personal data by exempting recipients from publication of their personal data if certain conditions would be met (threshold in terms of the amount of aid received, nature of the measure, risks for the rights and freedoms etc.).

1.   INTRODUCTION

1.

On 16 May 2022, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on the financial rules applicable to the general budget of the Union (recast) (‘the Proposal’), amending the Financial Regulation (1).

2.

The objective of the Proposal is to align the Financial Regulation with the 2021-2027 Multiannual Financial Framework (MFF) package, to maintain a ‘single rule book’ governing the expenditure of the Union, meaning that all general financial rules are included in the Financial Regulation. In addition, the Proposal includes targeted improvements and simplifications which have been identified since the entry into force of the 2018 Financial Regulation. The Proposal also aims to increase the use of digitalisation to better protect EU financial interests, to better contribute to the achievement of the EU policy objectives and to achieve additional simplification for recipients of Union funds (2).

3.

The present EDPS Opinion is issued in response to a consultation by the European Commission of 16 May 2022, pursuant to Article 42(1) of EUDPR (3). The EDPS welcomes the reference to this consultation in Recital 257 of the Proposal. In this regard, the EDPS also positively notes that he had been informally consulted pursuant to recital 60 EUDPR.

5.   CONCLUSIONS

26.

In light of the above, the EDPS makes the following recommendations: (1) to clarify the role of all entities that would be using and accessing any personal data processed by the single integrated IT system for data-mining and risk-scoring. (2) to clarify the type of the IT system to be used, in particular whether the Commission plans to base the system on the already existing IT system ‘Arachne’ or to create a completely new IT system. (3) to explicitly identify all the categories of data concerned, i.e. which data will be processed/brought into connection with the identification data mentioned in Article 36 paragraph 6 of the Proposal, as well as the sources of those data. (4) introduce appropriate safeguards to ensure the quality and accuracy of data, particularly in case those other data would be collected from third parties. (5) regardless of whether the Commission intends to make use of existing structures, to include in the Proposal itself a high level description of the IT tool, including data protection roles and responsibilities and relevant applicable safeguards. (6) to apply additional safeguards for the non-published types of data. For instance, pseudonymisation of data should be considered. (7) to clarify whether electronic recording and storage of data would be done within the IT system for data-mining and risk-scoring or the IT system would only have access to data stored elsewhere. (8) to clearly define the maximum duration for which the data referred to in Article 36 of the Proposal may be stored and made available in the single integrated IT system for data-mining and risk-scoring provided by the Commission.

---

(1)  Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable to the general budget of the Union, amending Regulations (EU) No 1296/2013, (EU) No 1301/2013, (EU) No 1303/2013, (EU) No 1304/2013, (EU) No 1309/2013, (EU) No 1316/2013, (EU) No 223/2014, (EU) No 283/2014, and Decision No 541/2014/EU and repealing Regulation (EU, Euratom) No 966/2012 (OJ L 193, 30.7.2018, p. 1).

(2)  See COM(2022) 223 final, p. 1.

(3)  Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).