The European Union’s (EU) simplification agenda needs to “tackle unnecessary complexity arising from both the Digital Operational Resilience Act (DORA) and the General Data Protection Regulation (GDPR), PensionsEurope has argued.

In its position paper on the European Commission’s digital omnibus regulation proposal, PensionsEurope reiterated its concerns that second pillar pension funds “differ profoundly” from other financial entities and that the application of the principle of proportionality should be reinforced.

It also highlighted pension funds’ work to meet the “extensive requirements” set out under DORA and GDPR. However, it stressed that a different approach needs to be taken for pension funds compared to other parts of the financial sector.

It stated: “Applying DORA uniformly, regardless of the type of financial entity, does not work for IORPs and other types of pension funds, as occupational pensions are often managed through social partners and linked to employer affiliation.

“Small and less complex financial entities, such as most of the IORPs, should consequently not be subject to the same obligations as systemically critical players. DORA should stop diverting pension funds' resources from core operational objectives.”

Therefore, the association called for a principle-based approach to DORA, to achieve effective ICT risk management and avoid what it described as unnecessary ICT controls.

“Against that background, we believe the digital omnibus proposal should lead to further changes to DORA, beyond incident reporting, and not focus on the centralisation of incident reporting,” PensionsEurope said.

In relation to GDPR, PensionsEurope called for the “meaningful simplification” of the regulation with the creation of additional legal basis for data health processing, where necessary, such as in areas that create legal uncertainty for pension funds.

It argued that this would “materially reduce the operational burden on pension funds”.

Despite its criticisms, PensionsEurope acknowledged the commission’s initiative to simplify the EU digital rulebook through the digital omnibus package.

“We recognise the importance of a robust digital operational resilience framework for the financial sector, as well as the need for appropriate safeguards for the processing of personal data,” it stated.

---