PURPOSE: to prevent the misuse of personal data to influence elections to the European Parliament.

LEGISLATIVE ACT: Regulation (EU, Euratom) 2019/493 of the European Parliament and of the Council amending Regulation (EU, Euratom) No 1141/2014 as regards a verification procedure related to infringements of rules on the protection of personal data in the context of elections to the European Parliament.

CONTENT: recent events have demonstrated the potential risks associated with the illicit use of personal data in relation to electoral processes and democracy.

In order to ensure that elections to the European Parliament (EP) are conducted according to strict democratic rules and in full respect of the European values of democracy, the rule of law and respect for fundamental rights, this Regulation makes a targeted amendment to Regulation (EU, Euratom) No 1141/2014 . It aims to allow financial sanctions on European political parties or foundations that have deliberately influenced or attempted to influence the outcome of elections to the European Parliament by taking advantage of an infringement of the applicable rules on protection of personal data.

Verification procedure

The Regulation stipulates that no European political party or European political foundation shall deliberately influence, or attempt to influence, the outcome of elections to the European Parliament by taking advantage of an infringement by a natural or legal person of the applicable rules on the protection of personal data.

If the Authority is informed of a decision of a national supervisory authority finding that a natural or legal person has infringed applicable rules on the protection of personal data, and if it follows from that decision, or if there are otherwise reasonable grounds to believe, that the infringement is linked to political activities by a European political party or a European political foundation in the context of elections to the European Parliament, the Authority shall refer this matter to the committee of independent eminent persons established by this Regulation.

Sanctions

Having regard to the committee's opinion, the Authority shall decide whether to impose financial sanctions on the European political party or European political foundation concerned. The decision of the Authority shall be duly reasoned, in particular with regard to the committee's opinion, and shall be published expeditiously.

When the Authority imposes a sanction on a European political party or foundation in accordance with the verification procedure, it shall take due account of the ne bis in idem principle, whereby sanctions cannot be imposed twice for the same offence. The Authority shall also ensure that the principle of legal certainty is respected and that the European political party or European political foundation concerned has been given the opportunity to be heard.

Where a decision of the national supervisory authority has been repealed, or where a remedy against such decision has been granted, provided that all national remedies have been exhausted, the Authority shall review any sanction imposed at the request of the European political party or European political foundation concerned.

ENTRY INTO FORCE: 27.3.2019.

The European Parliament adopted by 586 votes to 55 with 24 abstentions a legislative resolution on the proposal for a regulation of the European Parliament and of the Council amending Regulation (EU, Euratom) No 1141/2014 as regards a verification procedure related to infringements of rules on the protection of personal data in the context of elections to the European Parliament.

The position of the European Parliament adopted at first reading under the ordinary legislative procedure has amended the Commission proposal as follows:

The amended text stipulates that a European political party or a European political foundation may not deliberately influence, or attempt to influence, the outcome of elections to the European Parliament by taking advantage of an infringement, committed by a natural or legal person, of the applicable rules on the protection of personal data.

If the Authority is informed of the decision of a national supervisory authority within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation) finding a breach of rules applicable to the protection of personal data and if it follows from that decision, or if there are grounds to believe that the breach is linked to the political activities of a European political party or a European political foundation in the context of the elections to the European Parliament, the authority should refer the matter to the Committee of independent eminent persons.

The authority could, if necessary, contact the national supervisory authority concerned.

The committee would then issue an opinion indicating whether the European political party or the European political foundation concerned deliberately influenced or attempted to influence the outcome of the elections to the European Parliament by taking advantage of this infringement. The authority would request the opinion without undue delay and at the latest one month after being informed of the decision of the national supervisory authority.

In the light of the Committee's opinion, the Authority would decide whether to impose financial penalties on the European political party concerned or the European political foundation concerned. The Authority's decision should be reasoned and published promptly.

When imposing a sanction, the Authority should take due account of the 'ne bis in idem' principle, according to which sanctions may not be imposed twice for the same infringement. It should also ensure that the principle of legal certainty is respected and that the European political party or the European political foundation concerned is given the opportunity to be heard.

Opinion of the European Data Protection Supervisor on the Commission Package on free and fair European elections.

In the context of the 2018 State of the Union speech, the Commission presented a security package focusing on Free and fair European elections. This package is composed of: (i) a Communication, (ii) a Guidance document on the application of Union data protection law in the electoral context, (iii) a Recommendation and (iv) a proposal for a Regulation as regards a verification procedure related to infringements of rules on the protection of personal data in the context of elections to the European Parliament.

Main observations and recommendations

The EDPS recognises political communication as essential to the participation of citizens, political forces and candidates in democratic life and to the fundamental right to freedom of expression, and that these rights and freedoms are interdependent with the right under Article 7 of the Charter to respect for private and family life, home and communications, and the right under Article 8 of the Charter to the protection of personal data.

The EDPS recognises the role of social media platforms and on how this initiative would be coherent with the Code of Practice on online disinformation. In light of the upcoming European Parliament elections in May next year, and the numerous other national elections scheduled for 2019, the EDPS also recognises the recommendations for the setting up of national election networks and a European coordination network.

The EDPS also recognises the recommendation to Member States to perform a comprehensive assessment of risks associated with the elections to the European Parliament with a view to identifying potential cyber incidents that could affect the integrity of the electoral process and underlines the urgency of this matter.

In general, the EDPS considers that, for further clarity, a reference could have been included to the processing of personal data by the European Parliament, the Authority and the Committee, as being within the scope of Regulation (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data.

With regard to the proposed Regulation, the EDPS recommends:

- clarifying the scope of the measures and the complementary aims of such sanctions;

- including EDPS decisions finding an infringement to Regulation (EU) 2018/1725;

- including a reference to the current data protection legal framework for cooperation between national data protection supervisory authorities and the EDPS;

- ensuring the confidentiality of the exchange of information in the context of the cooperation between data protection supervisory authorities and the Committee of independent persons.

The Committee on Constitutional Affairs adopted the joint report by Mercedes BRESSO (S&D, IT) and Rainer WIELAND (EPP, DE) on the proposal for a regulation of the European Parliament and of the Council amending Regulation (EU, Euratom) No 1141/2014 as regards a verification procedure related to infringements of rules on the protection of personal data in the context of elections to the European Parliament.

The committee recommended that the European Parliament's position adopted at first reading under the ordinary legislative procedure should amend the Commission's proposal.

The amended text stipulated that a European political party or a European political foundation shall not influence or attempt to influence the outcome of elections to the European Parliament by taking advantage of an infringement, by a natural or legal person, of the applicable rules on the protection of personal data. This shall only apply if a supervisory authority of a Member State has established, by an enforceable decision , that an infringement of the applicable rules on data protection has occurred.

When the Authority becomes aware of such conduct, it shall refer this matter to the committee of independent eminent persons without undue delay and no later than 3 months after that notification. The committee shall give an opinion, within a short, reasonable deadline set by the Authority, as to whether or not the European political party or European political foundation concerned has violated such rights.

Having regard to the committee's opinion, the Authority shall decide whether to impose financial sanctions on the European political party or European political foundation concerned. The decision of the Authority shall be duly reasoned, in particular with regard to the committee’s opinion, and shall be published expeditiously.

Where a decision of the national supervisory authority has been definitively repealed or where a remedy against such decision has been successful and is final, the Authority shall review any sanction imposed at the request of the European political party or European political foundation concerned.

PURPOSE: to discourage European political parties and European political foundations from taking advantage of the results of infringements of the data protection rules with a view to deliberately influencing the outcome of the elections to the European Parliament.

PROPOSED ACT: Regulation of the European Parliament and of the Council.

ROLE OF THE EUROPEAN PARLIAMENT: the European Parliament decides in accordance with the ordinary legislative procedure on an equal footing with council.

BACKGROUND: recent events have demonstrated the potential risks associated with the illicit use of personal data in relation to electoral processes and democracy. In 2018, the Facebook/Cambridge Analytica case concerning the alleged unlawful processing of user personal data acquired from Facebook by the company Cambridge Analytica raised serious concerns on the impact of data protection infringements on electoral processes. Investigations are ongoing in relation to this particular case, inter alia by the UK data protection supervisory authority which is leading the European investigation. The U.S. Federal Trade Commission has opened an investigation on the case. A series of hearings took place in the European Parliament on the case and its impact on individuals’ personal data in the Union

Regulation (EU, Euratom) No 1141/2014 established a specific European legal status for European political parties and European political foundations and provides for their funding from the general budget of the European Union. It also establishes an Authority for European political parties and European political foundations. This Authority is in particular responsible for examining cases in which these entities are suspected of not respecting European fundamental values.

However, the existing rules do not effectively dissuade and sanction abuses of data protection rules which may affect the democratic debate and free elections. The Commission feels it is necessary to protect the integrity of the European democratic process by providing for financial sanctions in situations where European political parties and European political foundations take advantage of infringements of data protection rules with a view to influencing the outcome of elections to the European Parliament.

CONTENT: in order to ensure that the elections to the European Parliament take place under strong democratic rules and in full respect of the European values of democracy, rule of law and respect of fundamental rights, the Commission is proposing a targeted amendment to Regulation No 1141/2014. It aims to allow financial sanctions on European political parties or foundations that use infringements of data protection rules to deliberately influence or attempt to influence the outcome of elections to the European Parliament.

The proposal provides that a verification procedure is established whereby the Authority must, in certain circumstances, ask the committee of independent eminent persons to assess whether a European political party or a European political foundation has deliberately influenced or attempted to influence the outcome of elections to the European Parliament by taking advantage of an infringement of the applicable rules on protection of personal data. Where the committee finds that to be the case, the Authority should impose effective, proportionate and dissuasive sanctions. Any party or foundation found guilty of a violation may not apply for funding from the general budget of the European Union for the year in which the sanction was imposed. The Authority shall request the opinion without undue delay and no later than 1 month after the decision of the supervisory authority. The committee shall deliver its opinion within a short, reasonable deadline set by the Authority.

Since the new verification procedure is triggered by a decision of a competent data protection supervisory authority, it is proposed to allow for the review of the sanction if the competent data protection supervisory authority’s decision is repealed or where a remedy against such decision has been successful.

Lastly, in order to enable the Authority to operate in an independent and effective manner, the Commission proposes that the latter has its own permanent staff and proposes also to confer the powers of an appointing authority on the Director of the Authority.

BUDGETARY IMPLICATIONS: to ensure the effectiveness of this proposal, the Authority will be provided with more permanent staff to the extent that additional tasks are entrusted to it. The financial impact is estimated at EUR 10.1 million (EUR 1.43 million per year). More permanent staffing provisions will be made through the redeployment of existing resources, and will require the modification of the establishment plans of the contributing institutions. Therefore, these elements will be included in the forthcoming Amending Letter to Draft Budget 2019.