EDPS welcomes AML package, suggests improvements to protect individuals’ personalonal data

The EDPS welcomes the AML package and supports the general interest to fight money laundering and the financing of terrorism effectively. He welcomes the envisaged harmonisation of the AML/CFT framework through the enactment of a Regulation, as this will result in a more consistent application of the main rules by EU Member States. Moreover, he sees the harmonisation of the supervisory activities at EU level under the same European authority as a positive step, but calls for a clear definition of the roles, from a data protection perspective, of all stakeholders involved in the supervision model.

The EDPS notes that the proposed AML package takes a risk-based approach to the screening of banks’ clients in order to assess whether they may represent a money-laundering risk. While the EDPS appreciates the value of the risk-based approach underpinning the proposed legislative package, he considers that further clarifications are needed to minimise intrusion into individuals’ privacy and to ensure full compliance with data protection rules.

Wojciech Wiewiórowski, EDPS, said: 

“I recognise the importance of combatting money laundering and the financing of terrorism. At the same time, it is also important that the measures envisaged to achieve this goal are fully in line with the EU’s data protection laws and principles. In particular, the processing of individuals’ personal data must remain limited to what is necessary and proportionate in light of the specific purpose(s) set out in the proposals.”

In relation to the proposal for the coordination mechanism of Financial Intelligence Units (FIUs), the EDPS emphasises in his opinion that access to information related to criminal offences in particular, and access to administrative information and financial information about individuals should be limited to what is necessary in light of specific purposes. In this regard, he invites the legislator to reassess the necessity and proportionality of the proposed access rights.

Finally, the EDPS advises that the categories of personal data that may be processed are set out in the proposed AML legislative package. In addition, he considers that the processing of personal data relating to individuals’ sexual orientation or ethnic origin should not be allowed. Furthermore, the proposal should indicate the specific and strict conditions under which the processing of data about individuals’ criminal offences and/or convictions are allowed.