2023 0879 006 Redacted.pdf

The  European  Data  Protection  Supervisor  (EDPS)  is  an  independent  institution  of  the  EU,
responsible  under  Article  41(2)  of  Regulation  45/2001  ‘With  respect  to  the  processing  of
personal data… for ensuring that the fundamental rights and freedoms of natural persons, and
in particular their right to privacy, are respected by the Community institutions and bodies’,
and  ‘…for  advising  Community  institutions  and  bodies  and  data  subjects  on  all  matters
concerning the processing of personal data’. Under Article 28(2) of Regulation 45/2001, the
Commission is required, ‘when adopting a legislative Proposal relating to the protection of
individuals’ rights and freedoms with regard to the processing of personal data...’, to consult
the EDPS.
He was appointed in December 2014 together with the Assistant Supervisor with the specific
remit  of  being  constructive  and  proactive.  The  EDPS  published  in  March  2015  a  five-year
strategy setting out how he intends to implement this remit, and to be accountable for doing
so.
This Opinion relates to the EDPS' mission to advise the EU institutions on the data protection
implications of their policies and foster accountable policymaking - in line with Action 9 of the
EDPS  Strategy:  'Facilitating  responsible  and  informed  policymaking'.  While  the  EDPS
supports  the  objectives  to  of  combatting  the  dissemination  of  terrorist  content  online,  thus
contributing  to  a  more  secure  Union  overall,  he  considers  that  the  Proposal  should  be
improved in certain key aspects to ensure compliance with data protection principles.

2 | P a g e

THE EUROPEAN DATA PROTECTION SUPERVISOR,
Having regard to the Treaty on the Functioning of the European Union, and in particular Article
16 thereof,
Having regard to the Charter of Fundamental Rights of the European Union, and in particular
Articles 7 and 8 thereof,
Having  regard  to  Directive  95/46/EC  of  the  European  Parliament  and  of  the  Council  of  24
October 1995 on the protection of individuals with regard to the processing of personal data
and on the free movement of such data1, and to  Regulation (EU) 2016/679 of the European
Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard
to  the  processing  of  personal  data  and  on  the  free  movement  of  such  data,  and  repealing
Directive 95/46/EC (General Data Protection Regulation)2,
Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council
of 18 December 2000 on the protection of individuals with regard to the processing of personal
data by the Community institutions and bodies and on the free movement of such data3, and in
particular Articles 28(2), 41(2) and 46(d) thereof,
Having regard to Council Framework Decision 2008/977/JHA of 27 November 2008 on the
protection of personal data processed in the framework of police and judicial cooperation in
criminal  matters4,  and  to  Directive  (EU)  2016/680  of  the  European  Parliament  and  of  the
Council of 27 April 2016 on the protection of natural persons with regard to the processing of
personal  data  by  competent  authorities  for  the  purposes  of  the  prevention,  investigation,
detection or prosecution of criminal offences or the execution of criminal penalties, and on the
free movement of such data, and repealing Council Framework Decision 2008/977/JHA (Law
Enforcement Directive)5,

HAS ADOPTED THE FOLLOWING OPINION:

1.    INTRODUCTION AND BACKGROUND
1.1
Context of the Proposal
1.  On 12 September 2018, the European Commission published a Proposal for a Regulation
on preventing the dissemination of terrorist content online1 (hereinafter “the Proposal”).

2.  The  aim  of  the  Proposal  is  to  establish  uniform  rules  for  hosting  service  providers
(hereinafter  “HSPs”),  such  as  social  media  platforms,  video  streaming  services,  video,
image and audio sharing services, but also file sharing and other cloud services that make
information available to third parties as well as websites where users can make comments
or  post  reviews,  who  offer  their  services  within  the  Union  -  regardless  of  their  place  of
establishment - to prevent the dissemination of terrorist content through their services and
to ensure, where necessary, its swift removal.


1 COM (2018) 640 final, Proposal for a Regulation of the European Parliament and of the Council on preventing
the dissemination of terrorist content online
5 | P a g e

3.  The  Proposal  builds  on  HSPs’  obligation  pursuant  to  Directive  2000/31/EC2  to  remove
illegal content that they  store  and can be  seen as  part  of a  series of  regulatory and non-
regulatory initiatives to combat illegal content online3 and also as part of the anti-terrorism
package4.

4.  In this regard, the EDPS takes notice that Member States are already obliged by Article 21
of Directive (EU) 2017/541 to ensure the prompt removal of online content that constitutes
public  provocation  to  commit  terrorist  offences  and  that  the  revised  Audiovisual  Media
Services Directive5 will also require Member States to ensure that video-sharing platforms
take  appropriate  measures  to  protect  the  public  from  public  provocations  to  commit  a
terrorist offence.

5.  Moreover,  the  EDPS  observes  that  the  Proposal  shares  relevant  similarities  with  the
Proposal on e-evidence6 and therefore calls upon the legislator to ensure a consistent and
coherent approach7. In particular, the EDPS - taking into account his Opinion 09/2018 on
Proposals to establish European Production and Preservation Orders to gather e-evidence
in  criminal  matters  -  recommends  to  have  uniform  and  clear  definitions  (Point  4.2),  to
introduce strong security safeguards for transmissions, including authenticity  certificates
for removal orders and referrals (Point 5.2.3) and to clarify that legal representatives are
not  representatives  in  the  meaning  of  GDPR  and  the  Law  EnforcementPolice  Directive
(Point 5.2.4).

1.2
Content of the Proposal
6.  In tThe Explanatory Memorandum it is stresseds that terrorists misuse the internet for the
purposes of grooming and recruiting supporters, preparing and facilitating terrorist activity,
glorifying their  atrocities  and urging others to  follow  suit.8  Even though  Member States
and  HSPs  have  established  voluntary  partnerships  and  frameworks  to  reduce  the
accessibility  to  terrorist  content,  it  is  argued  that  these  measures  are  not  sufficient  to

2 Directive 2000/31/EC of the European Parliament and of the Council of 8 Jun e 2000 on certain legal aspects of
information society services, in particular electronic commerce, in the Internal Market ('Directive on electronic
commerce'), OJ L 178, 17 7 2000, p  1–16
3 These initiatives include inter alia Directive 2011/92/EU of the European Parliament and of the Council of 13
December 2011 on combating the sexual abuse and sexual exploitation of children and child pornography, and
replacing Council Framework Decision 2004/68/JHA, OJ L 335, 17 12 2011, p  1 –14; Directive (EU) 2017/541
of the European Parliament and of the Council of 15 March 2017 on combating terrorism and replacing Council
Framework Decision 2002/475/JHA and amending Council Decision 2005/671/JHA, OJ L 88, 31 3 2017, p  6 –
21; COM (2016) 593 final, Proposal for Directive of the European Parliament and of the Council on copyright in
the Digital Single Market and most recent COM (2018) 1177 final, Commission Recommendation of 1 3 2018 on
measures to effectively tackle illegal content online
4  Directive  (EU)  2017/541  of  the  European  Parliament  and  of  the  Council  of  15  March  2017  on  combating
terrorism  and  replacing  Council  Framework  Decision  2002/475/JHA  and  amending  Council  Decision
2005/671/JHA, OJ L 88, 31 3 2017, p  6–21
5  COM(2016)  287  final  Proposal  for  a  Directive  of  the  European  Parliament  and  of  the  Council  amending
Directive 2010/13/EU on the coordination of certain provisions laid down by law, regulation or administrative
action  in  Member  States  concerning  the  provision  of  audiovisual  media  services  in  view  of  changing  market
realities
6 COM(2018) 225 final, Proposal for a Regulation of the European Parliament and of the Council  on European
Production and Preservation Orders for electronic evidence in criminal matters
7 The EDPS observes in particular that Recital 32 of the Proposal already refers to the e-evidence Proposal
8 In the Impact Assessment it is stated that the terrorist group Daesh produced in the years 2015 -2017 an average
of 1200 new propaganda items every month (cf  Impact Assessment, p  7)
6 | P a g e

and  data  protection11,  nor  does  it  assess  the  effectiveness  of  already  existing  tools.  The
EDPS emphasises that an impact assessment is not only an important condition element of
the  Commissions’  policy  of  better  regulation12  but  also  an  essential  prerequisite  when
fundamental rights are at stake13.

10. The EDPS notes that he was neither consulted by the Commission during the inter-service
consultation stage, nor immediately after the adoption of the Proposal. However, due to the
serious impact of the Proposal on the rights to privacy and the protection of personal data,
the EDPS has decided to issue this Opinion.

2.
COMMENTS AND RECOMMENDATIONS
2.1
Preliminary remarks
11. The EDPS observes that the Proposal is based on Article 114 TFEU which provides for the
establishment of measures to ensure the functioning of the Internal Market. As the objective
of the Proposal is clearly linked to the prevention, detection and investigation of criminal
offences, in particular the prevention and combatting of terrorism, the Proposal seems to
fall into the scope of Title V of the TFEU. Consequently, Tthe EDPS recommends to re-
assess whether Article 114 TFEU is the appropriate legal basis for the Proposal.

12. The  EDPS  takes  notice  note  that  the  Proposal  stresses  in  several  provisions  that  it  will
ensure the protection of the fundamental rights at stake and that HSPs should always take
into account the fundamental rights of the users and also the importance of these rights.14
In this respect, the EDPS observes that Recital 7 of the Proposal explicitly stresses that the
Regulation will ensure the rights to respect for private life and to the protection of personal
data.

13. However,  the EDPS notes that the Proposal contains no reference to  the  applicable data
protection  legislation,  i.e.  the  General  Data  Protection  Regulation  (EU)  2016/67915
(hereinafter  “the  GDPR”)  and  the  Directive  (EU)  2016/68016  (hereinafter  “the  Police
Directive”).  Therefore,  and  for  the  sake  of  clarity  and  legal  certainty,  the  EDPS
recommends  to  insert  in  the  Proposal  a  specific  reference  to  provision  confirming  the
applicability of the aforementioned legal acts.

11 The Impact Assessment merely states that the Proposal will interfere with the right to the protection of personal
data, and hence any future instrument should have sufficient guarantees to effectively protect personal data  (Cf
Impact Assessment p  43)
12 Communication from the Commission to The European Parliament, the Council, The European Economic and
Social Committee and The Committee of the Regions Better regulation for better results  - An EU agenda and
Interinstitutional  Agreement  between  the  European  Parliament,  the  Council  of  the  European  Union  and  the
European Commission on Better Law-Making
13 EDPS, Opinion 9/2017 on the Proposal for a Regulation on the eu-LISA
14 For instance Recital 7 and 17 or Article 3 and 6 of the Proposal
15 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
natural persons with regard to the processing of personal data and on the free movement of such data, and repealing
Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4 5 2016, p  1–88
16 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of
natural persons with regard to the processing of personal data by competent authorities for the purposes of the
prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and
on  the  free  movement  of  such  data,  and  repealing  Council  Framework  Decision  2008/977/JHA ,  OJ  L  119,
4 5 2016, p  89–131
8 | P a g e

about  the  second  purpose  of  necessity  and  proportionality  of  establishing  the  data
repository for the second purpose, i.e. to retain content and related data for the purpose of
prevention, detection, investigation or prosecution of terrorist offences.

36. The imposition of such a data retention obligation on HSPs would amount to a situation
where private entities are required to retain personal data relating to criminal offences for
law enforcement purposes for the period of six months.29 In this respect the EDPS recalls
that  pursuant  to  Article  10  GDPR  the  processing  of  personal  data  relating  to  criminal
offences  should  be  carried  out  only  under  the  control  of  official  authority  or  when  the
processing  is  authorised  by  Union  or  Member  State  law  providing  for  appropriate
safeguards for the rights and freedoms of data subjects.

37. Against the background of Article 10 GDPR, and as the relevant preservation is not under
the  control  of  official  authority,  the  provided  safeguards  have  to  be  appropriate  for  the
rights and freedoms of data subjects. The EDPS observes that Article 7(3) of the Proposal
provides  that  HSPS  should  “ensure  that  the  terrorist  content  and  related  data  [...]  are
subject to appropriate technical and organisational safeguards” and that these “technical
and organisational safeguards shall ensure that the preserved terrorist content and related
data  is  only  accessed  and  processed  for  the  [relevant]  purposes  [...]  and ensure  a  high
level of security of the personal data concerned.”

38. The EPDS recalls that Article 7 of the later repealed Directive 2006/2430 provided in this
respect  that  “the  data  shall  be  subject  to  appropriate  technical  and  organisational
measures to protect the data against accidental or unlawful destruction, accidental loss or
alteration, or unauthorised or unlawful storage, processing, access or disclosure”; and that
“the data shall be subject to appropriate technical and organisational measures to ensure
that  they  can  be  accessed  by  specially  authorised  personnel  only”.  However,  the  CJEU
concluded in Digital Rights Ireland Ltd, that the provided safeguards are not sufficient to
ensure effective protection of the retained data against the risk of abuse, unlawful access
and subsequent use of that data.31

39. Moreover,  the  EDPS  takes  notice  that  the  Proposal  does  not  lay  down  contain  any
substantive and procedural conditions relating to the access and the subsequent use of the
preserved  data  by  “competent  authorities”,  as  it  was  required  by  the  CJEU  in  the
aforementioned judgment.32 The mere reference in Recital 23 of the Proposal, according to
which  the  Regulation  “does  not  affect  the  procedural  guarantees  and  procedural

29 In particular Recital 22 of the Proposal provides: “To ensure proportionality, the period of preservation should
be limited to six months to allow the content providers sufficient time to initiate the review process  and to enable
law enforcement access to relevant data for the investigation and prosecution of terrorist offences . However, this
period may be prolonged for the period that is necessary in case the review proceedings are initiated but not
finalised within the six months period upon request by the authority carrying out the review. This duration should
be sufficient to allow law enforcement authorities to preserve the necessary evidence in relation to investigations,
while ensuring the balance with the fundamental rights concerned” (Emphasis added)
30 Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data
generated or processed in connection with the provision of publicly available electronic communications services
or  of  public  communications  networks  and  amending  Directive  2002/58/EC,  OJ  L  105,  13 4 2006,  p   54–63,
repealed by Judgment of the Court (Grand Chamber), 8 April 2014, Joined Cases C‑293/12 and C‑594/12, Digital
Rights  Ireland  Ltd  v  Minister  for  Communications,  Marine  and  Natural  Resources  and  Others  and  Kärntner
Landesregierung and Others
31 Joined Cases C-293/12 and C-594/12, Digital Rights Ireland Ltd, para  54 - 55 and 65 - 67
32 SeeCf  Digital Rights Ireland Ltd, para  61 - 62
14 | P a g e

-  HSPs should be obliged to perform a risk assessment on their level of exposure to
terrorism content and to draw up a remedial action plan to tackle terrorist content
proportionate to the level of risk identified (Article 6);

-  HSPs  should  fully  respect  the  fundamental  rights  of  its  users,  when  establishing
proactive measures (Article 6);

-  HSPs should take into account the concept of privacy by design and by default when
creating  automated  tools  and  should  at  least  conduct  a  data  protection  impact
assessment (Article 6);

-  HSPs  should  in  any  case  give  data  subjects  a  meaningful  explanation  of  the
functioning  of  their  implemented  proactive  measures  including  the  use  of
automated tools (Article 6);

-  a HSPs’ decision based on automated tools should in any case be subject to human
oversight and human verification (Article 6)

-  HSPs  should  provide  competent  authorities  with  all  necessary  information  on
automated tools to allow a thorough analysis of these tools, in particular to ensure
that no discriminatory, untargeted, unspecific or unjustified results are produced;

-  the proposed derogation from Article 15(1) of Directive 2000/31/EC, which would
enable  the  imposition  of  a  general  monitoring  obligation  on  HSPs,  should  be
reconsidered (Article 6);

-  with  regard  to  HSPs  obligation  to  preserve  terrorist  content  and  related  data,  the
term “related data” needs to be precisely circumscribed (Article 7);

-  the obligation for HSPs to preserve terrorist content and related data for the purpose
of prevention, detection, investigation or prosecution of terrorist offences should be
reconsidered in the light of the requirement set out by the case law of the Court of
Justice of the European Union (Article 7);

-  the decision of a HSP on the complaint brought by the content provider has to be
subject to the control by an independent authority (Article 10);

-  a  legal  remedy  has  to  be  introduced  for  cases  where  HSPs  do  not  react  to  the
complaint of the content provider (Article 10).

45. The EDPS remains available to provide further advice on the Proposal.

Brussels, xx November 2018

Giovanni BUTTARELLI

16 | P a g e

Notes


1 OJ L 281, 23 11 1995, p  31
2 OJ L 119, 4 5 2016, p  1
3 OJ L 8, 12 1 2001, p  1
4 OJ L 350, 30 12 2008, p  60
5 OJ L 119, 4 5 2016, p  89
17 | P a g e