The EDPS welcomes the legislation and supports the general interest to fight money laundering and the financing of terrorism effectively. He welcomes the envisaged harmonisation of the AML/CTF framework through the enactment of a Regulation, as this will result in a more consistent application of the rules by EU Member States. Moreover, he sees the harmonisation of the supervisory activities at EU level under the same European authority as a positive step, but calls for a clear definition of the roles, from a data protection perspective, of all stakeholders involved in the supervision model.

The EDPS notes that the proposed legislative package takes a risk-based approach to the screening of banks’ clients in order to assess whether they may represent a money-laundering risk. While the EDPS appreciates the value of the risk-based approach underpinning the proposed legislative package, he considers that further clarifications are needed to minimise intrusion into individuals’ privacy and to ensure full compliance with data protection rules.

In relation to the proposal for the coordination mechanism of Financial Intelligence Units (FIUs), the EDPS emphasises that access to information related to criminal offences in particular, and access to administrative information and financial information about individuals, should be limited to what is necessary in light of specific purposes. He invites the legislator to reassess the necessity and proportionality of the proposed access rights.

Finally, the EDPS advises that the categories of personal data that may be processed be set out in the proposed legislative package. In addition, he considers that the processing of personal data relating to individuals’ sexual orientation or ethnic origin should not be allowed. Further, the proposal should indicate the specific and strict conditions under which the processing of data about individuals’ criminal offences and/or convictions are allowed. To read the EDPS’s press release in full and for a link to the opinion, click here.