Key-words: EDPS - Guidelines - proportionality - privacy - data protection At the end of 2019, on Thursday, 19 December, the European Data Protection Supervisor (EDPS) published the new Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data, following the Guidelines already known as the “Necessity Toolkit”, published on 2017, which they complete. The aim of the newly published Guidelines, in the words of the European Data Protection Supervisor Wojciech Wiewiórowski, is «to make the assessment of necessity and proportionality quicker and easier for policymakers, helping them to ensure that all new EU proposals respect the fundamental right to personal data protection». The EDPS Guidelines, framed in the so-called “soft law”, not being a kind of binding regulation, have the only purpose to help EU institutions and lawmakers to assess the compliance of new measures with the protection of personal data, guaranteed by the Charter of Fundamental Rights, articles 7 and 8, and the GDPR (Reg. 2016/679/EU). The Guidelines consolidate prior check Opinions and consultations by the same EDPS, as well as Article 29 Working Party Opinions and European Data Protection Board (EDPB) Guidelines, and of course the case law of the European Courts (not only from the Court of Justice of the European Union but also from the European Court of Human Rights). As for the case law, which is not secondary, the methodology used by the EDBS refers to examples of CJEU and ECtHR judgments, inserted in grey boxes to be separated from the regulation itself, to explain the “step-by-step” procedure to assure the respect of proportionality. Coming from the EDBS, which is the independent supervisory authority in the European Union, whose primary objective, according to Reg. 1725/2018/EU, is to ensure that European institutions and bodies respect the right to privacy and data protection also when they develop new policies, we can easily understand the importance that these Guidelines will have in the legislative procedures, especially in the European institutions. The Guidelines, together with the “Necessity Toolkit”, will play for sure a significant role in simplifying the challenges faced by policymakers, as the Supervisor himself hopes. That said, it does not seem that the effectiveness of the measures is really guaranteed. The Supervisor himself seems to be aware of this in one passage: «The EDPS would underline the responsibility of the legislator to assess the proportionality of a measure. The present Guidelines, therefore, do not intend to provide, nor can they provide, a definitive assessment as to whether any specific proposed measure might be deemed proportionate. Rather, they offer a practical, step-by-step methodology for assessing the proportionality of new legislative measures, providing explanations and concrete examples. They respond to requests from EU institutions for guidance on the particular requirements stemming from Article 52(1) of the Charter». So, it is clear that the definitive assessment is up to the lawmakers, offering the Guidelines only a practical methodology, and that any effective regulation should come by an EU Regulation, that means “hard law” and not “soft law”. In fact, the only purpose of the Guidelines is to offer a practical “step-by-step” methodology for assessing the proportionality, being a complement to the 2017 Guidelines (“Necessity Toolkit”): both Guidelines have the purpose to clarify when the limitation to the right of the protection of personal data complies with the requirements laid down in article 52 of the Charter of Fundamental Rights. The right to the protection of personal data, according to the Charter, articles 8 and 52, is not absolute and may be limited. To be lawful, any limitation should comply with the criteria laid down in the Charter, article 52, including the necessity of the measure (the focus of the 2017 Guidelines) and the proportionality of the measure (the focus of the 2019 Guidelines). The previous Guidelines defined what we should intend, according to the Charter of Fundamental Rights, article 52, with the word “necessity”, clarifying when a legislative measure entailing a limitation on the fundamental rights to privacy and the protection of personal data is really “necessary”. That’s why the same EDPS calls those Guidelines “Necessity Toolkit”. Only if a measure is considered “necessary”, having satisfied the “necessity test” provided by the 2017 “Necessity Toolkit”, it is possible to test the proportionality of the envisaged measure with the “proportionality test” carried out with the 2019 Guidelines. Providing a practical “step-by-step” procedure to satisfy the “proportionality” of the measure we can refer to these 2019 Guidelines as a “Proportionality Toolkit”.
Source: European Data Protection Supervisor. » View: document (EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data 19.12.2010) To read the PDF click here. |