Appearing online this morning on the Official Journal of the European Union website is the Opinion of the European Data Protection Supervisor on the Recommendation for a Council Regulation amending Regulation (EC) No 2533/98 of 23 November 1998 concerning the collection of statistical information by the European Central Bank. The conclusion of the EDPS is as follows:
“30. The EDPS notes the willingness to improve the exchange of statistical information between the ESS [Eurostat] and the ESCB [the European System of Central Banks] and the access for research purposes. Although it is welcome that such exchange and access may take place while ensuring strict confidentiality of the data, some clarifications are needed as regards the terminology used and the concepts covered by such exchange and access.
31. The EDPS has the following comments regarding the submitted Recommendation and future change of Regulation (EC) No 2533/98:
— further clarification about the expression of ‘statistical information’ should be made in the recitals of the Regulation, as the notion of statistical information in the context of Regulation (EC) No 2533/98 should be limited to statistics on natural and legal persons which are processed within the sphere of competence of the ECB,
— the EDPS does not oppose the widening of purposes but objects to a list of purposes which would be indicative and not sufficiently specified,
— it should be ensured that the data protection framework is fully applied in the case of collection of payment statistics. The collection of financial information relating to natural persons who are identifiable (either directly or indirectly) should normally not be allowed, unless the necessity of the processing is clearly demonstrated and security measures are implemented,
— further collaboration between the ESS and the ECB should be developed in view of ensuring the respect of the data quality principle as well as the data minimization principle,
— it should be ensured that access to statistical information for research purposes should be provided in such a way that the reporting agent cannot be identified,
either directly or indirectly, when account is taken of all relevant means that might reasonably be used by a third party”.