EEM Label GDPR compliance considerations

At the heart of the Energy Efficient Mortgage Label (EEML) is the Harmonised Disclosure Template (HDT), which is intended to facilitate and improve access to relevant, consistent and comparable data on energy efficient mortgages within and between jurisdictions for investors, regulators and other market participants for due diligence purposes. During the course of discussions with lending institutions in preparation for the launch and development of the EEML, questions were raised about potential General Data Protection Regulation (GDPR) compliance concerns with regard to completion and disclosure of the Harmonised Disclosure Template (HDT).

Against this background, the Energy Efficient Mortgage Initiative (EEMI) instructed the law firm, Rutgers & Posch, to conduct an analysis of the compliance of the EEM Label and its HDT with GDPR requirements and draft guidance as necessary further to the analysis to address any obstacles. The analysis considers data collection and processing from the perspective of: (1) lending institutions (Direct Option) and (2) a data repository (Repository Option) from which lending institutions could extract data they require. In order to make the analysis as concrete and relevant as possible, the EEM National Hub in the Netherlands (EEM NL Hub) and the Dutch data protection framework, which is based on the EU-wide GDPR, was used as a ‘test case’.

The first memorandum examines the extent to which certain EU regulations – with a focus on the focusing on the Taxonomy Regulation, the Non-Financial Reporting Directive (NFRD) and the (proposed) Corporate Sustainability Reporting Directive (CSRD), the Sustainable Finance Disclosure Regulation (SFRD), the Prospectus Regulation, the Securitisation Regulation and the proposed European Green Bond Regulation – may impose legal obligations or give rise to legitimate interests which would permit the collection and processing of ‘Green Data’ pursuant to GDPR by mortgage originators which are members of the EEMI or by any local repository such as the proposed Dutch Sustainability Data Repository.

The second memorandum identifies Green Data as potentially personal data under the GDPR and therefore indicates that both the Direct Option and the operations of the Repository under the Repository Option relating to the collection and processing of Green Data would require a legal basis pursuant to GDPR in order to comply with applicable data protection laws in the Netherlands (and almost certainly beyond).

The third and final memorandum considers the potential liability risks for the EEM NL Hub and for a potential Dutch Repository from a Dutch civil law perspective and presents a series of recommendations to mitigate these risks where possible.