text: OJ L 295, 21.11.2018, p. 39. 2 COM(2025) 294 final and COM(2025) 295 final. 3 See COM(2025) 294 final and COM(2025) 295 final, Annex,

text: Article 1(1)

text: and (2). 4 OJ L, 2024/948, 25.3.2024. See COM(2025) 294 final and COM(2025) 295 final, Explanatory Memorandum, p. 3. 4

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1. 7

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89–131. 8

text: Directive (EU) 2016/681

text: of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, OJ L 119, 4.5.2016, p. 132– 149. 9 Opinion 1/15 of the Court of Justice (Grand Chamber) of 26 July 2017, EU:C:2017:592. 10 Judgment of the Court of Justice (Grand Chamber) of 21 June 2022 “Ligue des droits humains”,

text: , EU:C:2022:491. 11 See https://www.icao.int/safety/airnavigation/nationalitymarks/annexes_booklet_en.pdf 12 OJ L 176, 10.7.1999, p. 36. 5

text: See COM(2025) 282 final and COM(2025) 279 final, Explanatory Memorandum, p. 2 and 3. 14 Opinion 46/2023 on the negotiating mandate for an Agreement between the EU and Iceland on the transfer of Passenger Name Record data, issued on 30 October 2023. 15

text: Regulation (EU) 2025/13

text: of the European Parliament and of the Council of 19 December 2024 on the collection and transfer of advance passenger information for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, and amending

text: Regulation (EU) 2019/818

text: , OJ L, 2025/13, 8.1.2025. 16 EDPS Opinion 6/2023 on the Proposals for Regulations on the collection and transfer of advance passenger information (API), issued on 8 February 2023. 6

identifier: EDPS yttrande 15/2025

title: EDPS Opinion 15/2025 on the signing and conclusion of an Agreement between the EU and Iceland on the transfer of Passenger Name Record data.

text: Opinion 15/2025

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposals for Council Decisions on the signing and on the conclusion, on behalf of the European Union, of the Agreement between the European Union and Iceland on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime.

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 12 June 2025, the European Commission issued two Proposals for Council Decisions on the signing and on the conclusion, on behalf of the European Union, of the Agreement between the European Union and Iceland on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. The aim of the draft Agreement is to enable the transfer of Passenger Name Record (PNR) data by air carriers from the Union to Iceland and to lay down rules and conditions subject to which those PNR data may be processed by Iceland as well as to enhance police and judicial cooperation between the Union and Iceland in respect of PNR data.

text: In the Opinion, the EDPS recalls the specific legal situation of Iceland as a Schengen associated country. Pursuant to the Schengen Association Agreement between the EU and Iceland of 1999, Iceland is bound by the Union acts which constitute a development of the provisions of the Schengen acquis. As a result, Iceland is supposed to apply the

text: Directive (EU) 2016/680

text: in a similar manner as EU Member States. In addition, as member of the European Economic Area, Iceland is not considered as a third country within the meaning of Chapter V of the GDPR. However, the EU PNR Directive does not constitute a development of the provisions of the Schengen acquis and therefore Iceland is not bound by its provisions. Consequently, the Agreement between the EU and Iceland must adduce all the appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU.

text: Following his assessment of the draft Agreement, including the implementation of his previous specific recommendations on the negotiating mandate, the EDPS concludes that the draft Agreement between the European Union and Iceland on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime contains the necessary safeguards required in order for it to be compatible with the EU legal framework on data protection.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 12 June 2025 the European Commission issued two Proposals for Council Decisions on the signing and on the conclusion, on behalf of the European Union, of the Agreement between the European Union and Iceland on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (‘the Proposals’).

text: 2. The aim of the draft Agreement is to enable the transfer of Passenger Name Record (PNR) data by air carriers from the Union to Iceland and to lay down rules and conditions subject to which those PNR data may be processed by Iceland, as well as to enhance police and judicial cooperation between the Union and Iceland in respect of PNR data .

text: 3. The negotiations on a PNR Agreement with Iceland, as well as with two other Schengen associated countries - Norway and the Swiss Confederation, began on 21 March 2024, in accordance with the negotiating mandate adopted by the Council on 4 March 2024 . On 9 April 2025, the EU and Iceland negotiators initialled the text of the draft Agreement and thus formally concluded negotiations .

text: 4. The present Opinion of the EDPS is issued in response to two consultations by the European Commission of 12 June 2025, pursuant to Article 42(1) of EUDPR. Bearing in mind that both Proposals concern the same draft Agreement, the present Opinion covers both of them. The EDPS welcomes the reference to this consultation in Recitals 6 of the Proposals.

text: 2. General remarks

text: 5. PNR data is information provided by passengers, and collected by and held in the air carriers’ reservation and departure control systems for their own commercial purposes. While useful for combating terrorism and serious crime, the transfer of PNR data to third countries and the subsequent processing by their authorities constitutes an interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter of Fundamental Rights (the Charter). For this reason, it requires a legal basis under EU law and must be necessary, proportionate and subject to strict limitations and effective safeguards.

text: 6. In addition to the Charter, the applicable legal rules in case of transfer and processing of PNR data, include also the horizontal EU legal framework on data protection, namely

text: Regulation (EU) 2016/679

text: (the GDPR) and

text: Directive (EU) 2016/680

text: (the Law Enforcement 7 8 Directive) , as well as the specific

text: Directive (EU) 2016/681

text: (the EU PNR Directive) .

text: 7. Furthermore, the Court of Justice of the EU (CJEU) on two occasions interpreted the legal framework on PNR and provided guidance as regards proportionality and the necessity of PNR data processing, namely in Opinion 1/15 of 26 July 2017 and Judgment in Case C- 817/2019 of 21 June 2022 . The requirements laid down by the CJEU in the cited case law constitute an important point of reference for the assessment of any EU agreement on the transfer of PNR data, including the one at hand.

text: 8. The EDPS also recalls that, in addition to the Union legislation, PNR data is subject to international rules and standards. The United Nations Security Council Resolution 2396 (2017) on threats to international peace and security caused by returning foreign terrorist fighters, adopted on 21 December 2017, and the subsequent UN Security Council Resolution 2482 (2019) of 19 July 2019, called on UN Member States to develop the capability to collect and use PNR data, based on Standards and Recommended Practices on PNR (SARPs) of the International Civil Aviation Organization (ICAO) from 2020, adopted by means of Amendment 28 to Annex 9 to the Convention on International Civil Aviation (Chicago Convention) . All EU Member States, as well as Iceland, are Parties to the Chicago Convention.

text: 9. An important legal aspect to be noted, which is also expressly highlighted in the Proposals, is the legal situation of Iceland as a Schengen associated country as regards the application of the Union legal framework on data protection. Firstly, Iceland is not considered a third country within the meaning of Chapter V of Regulation 2016/679 since the GDPR has been incorporated with adaptations in Annex XI to the European Economic Area (EEA) Agreement. Secondly, pursuant to Article 8 of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the latters' association with the implementation, application and development of the Schengen acquis of 1999 , Iceland is bound by the Union acts which constitute a development of the provisions of the Schengen acquis, including

text: Directive (EU) 2016/680

text: , in a similar manner as EU Member States.

text: 10. However, the EU PNR Directive does not constitute a development of the Schengen acquis, hence Iceland does not participate in the implementation of this legal instrument . Therefore, the Agreement between the EU and Iceland must adduce all the appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU.

text: 11. The EDPS has already issued in 2023 an Opinion on the negotiating mandate for an Agreement between the EU and Iceland on the transfer of PNR data . In his Opinion, the EDPS made two specific recommendations: - to align the definition of sensitive data in the future Agreement with the definitions of special categories of data in Article 9(1) of GDPR and

text: Article 10 of Directive (EU) 2016/680

text: ; and - to provide for in the Agreement the legal possibilities to suspend it in case of breaches of its provisions, as well as to terminate it if the non-compliance is serious and persistent.

text: 12. The EDPS notes with satisfaction that these recommendations have been taken into account during the negotiations and are subsequently reflected in the final text of the Agreement, as follows: - Article 8 of the draft Agreement provides for a prohibition to process special categories of PNR data in line with how this concept has been defined in the EU data protection acquis; - Article 20 of the draft Agreement provides for a suspension mechanisms and

text: Article 21

text: provides for the possibility for either Party to terminate the Agreement at any time.

text: 3. Use of the API-PNR router

text: 13. The EDPS notes that Article 4 of the draft Agreement provides for the possibility for Iceland to make use of the API-PNR router established with

text: Regulation (EU) 2025/13

text: , as envisaged by

text: Article 10

text: (c) of that Regulation, which has not been included in the negotiating directives.

text: 14. The EDPS recalls that he has issued an Opinion on the proposals for the so-called API Regulations , which were subsequently adopted as

text: Regulation (EU) 2025/12

text: and

text: Regulation (EU) 2025/13

text: , where he commented, among others, on the router.

text: 15. In view of the fact that Iceland is a Schengen associated country with direct access to the EU large-scale IT systems in the area of justice and home affairs, the EDPS considers the possible use of a common technical solution for the exchange of PNR data as appropriate. In this context, the EDPS welcomes the provision of

text: Article 4(1)

text: (b) of the draft Agreement, which explicitly clarifies that Iceland would be bound by the rules on the functioning and the conditions for the use of the API-PNR router, as established by API Regulations, if it decides to use this common technical solution.

text: 4. Access to PNR data by Europol and Eurojust

text: 16. The EDPS notes that according to Article 15 of the draft Agreement, Iceland will share with Europol or Eurojust, within the scope of their respective mandates, the results of processing of PNR data, or analytical information based on PNR data, in specific cases where necessary to prevent, detect, investigate, or prosecute terrorist offences or serious crime. Such exchange may be carried out on its own initiative or at the request of the Union Agencies.

text: 17. In this context, the EDPS reminds that, in as far as the data concerns extra-EU flights between the EU and Iceland, this information is already processed under the EU PNR Directive by the Member States' Passenger Information Units (PIU). The EU PNR Directive does not foresee direct access to this data for Eurojust, and strictly defines the conditions under which Europol is able to access it.

text: 18. In view of the above, it is the understanding of the EDPS that regarding Europol or Eurojust, the condition “within the scope of their respective mandates” refers not only to the tasks and powers of the two Agencies provided for in the EU regulations establishing them but also the specific rules laid down in the EU PNR Directive. Consequently, the EU- Iceland PNR Agreement should not lead to situations where Union Agencies request PNR data from Iceland which they would not be able to request from an EU Member State.

text: 5. Conclusions

text: 19. In light of the above, the EDPS concludes that the draft Agreement between the European Union and the Iceland on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime contains the necessary safeguards required in order for it to be compatible with the EU legal framework on data protection. Brussels, 24 July 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7


text: COM(2026) 283 final. COM(2026) 287 final. 1

text: OJ L 295, 21.11.2018, p. 39. 4 COM(2026) 283 final. COM(2026) 287 final. 6 See Article 2 of the Annexes to the Proposals. 4

text: Regulation (EU) 2018/1727

text: of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council Decision 2002/187/JHA (OJ L 295, 21.11.2018, p. 138). 8

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89). 9 At the moment, the only existing adequacy decision under the LED is the one adopted for the United Kingdom, available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D1773. 10 COM(2020) 743 final. 11 EDPS Opinion 10/2020 on the negotiating mandate to conclude ten agreements allowing the exchange of data between Eurojust and the competent authorities for judicial cooperation in criminal matters in certain third countries. 12 Council Decision authorising the opening of negotiations for Agreements between the European Union and Algeria, Argentina, Armenia, Bosnia and Herzegovina, Brazil, Colombia, Egypt, Israel, Jordan, Lebanon, Morocco, Tunisia and Turkey on cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the competent authorities for judicial cooperation in criminal matters of those third States, see 6153/21 + ADD 1, Council Decision adopted by written procedure on 1 March 2021 (CM 1990/21). 13 See Explanatory Report, COM(2026) 283 and 287 final, p. 2. 5

text: See Explanatory Report, COM(2026) 283 and 287 final, p. 1. 15 For further details see the EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data, issued on 19 December 2019, https://edps.europa.eu/sites/edp/files/publication/19- 12- 19_edps_proportionality_guidelines_en.pdf. 16 See Judgments of the Court of Justice of 6 October 2020, La Quadrature du Net and others, joined cases

text: and 520/18, ECLI:EU:C:2020:791, paragraph 130, of 8 April 2014 in Joined Cases

text: and

text: , Digital Rights, EU:C:2014:238, paragraph 52; and Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592, paragraph 140. 17 In accordance with Article 26 of the Eurojust Regulation,

text: Article 3

text: and Chapter IX of EUDPR apply to the processing of operational personal data by Eurojust. 6

text: Opinion 1/15, EU-Canada PNR Agreement, ECLI:EU:C:2017:592, par. 219. 7

identifier: EDPS yttrande 15/2026

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 15/2026 on two Proposals for Council Decisions on the signing and conclusion of an Agreement between the EU and Algeria on the cooperation between Eurojust and the authorities of Algeria competent for judicial cooperation in criminal matters

serie: yttranden

text: Opinion 15/2026

type: rubrik

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Council decision on the signing of an agreement between the European Union and the People’s Democratic Republic of Algeria on the cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the authorities of the People’s Democratic Republic of Algeria competent for judicial cooperation in criminal matters and the Proposal for a Council decision on the conclusion of an Agreement between the European Union and the People’s Democratic Republic of Algeria on the cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the authorities of the People’s Democratic Republic of Algeria competent for judicial cooperation in criminal matters .

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 25 June 2026, the European Commission issued two Proposals for Council Decisions, under

text: Article 16(2)

text: and

text: Article 85

text: in conjunction with Article 218(5) of the Treaty on the Functioning of the European Union, one on the signing and other on the conclusion, of an agreement between the European Union and the People’s Democratic Republic of Algeria on the cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the authorities of the People’s Democratic Republic of Algeria competent for judicial cooperation in criminal matters. The proposals are accompanied by an Annex containing the agreed text of the Agreement.

text: The objective of the Proposal is to enhance judicial cooperation between the competent authorities of Algeria and Eurojust in combating serious crime by allowing the transfer of personal data between the competent authorities of Algeria and Eurojust, in order to support and strengthen their action, and their cooperation in investigating and prosecuting serious crime, in particular organised crime and terrorism, corruption, money laundering and cybercrime, and related criminal offences, while ensuring appropriate safeguards with respect to the fundamental rights and freedoms of individuals, including privacy and the protection of personal data.

text: The EDPS has already had the opportunity to comment on the exchange of personal data between Eurojust and the competent authorities of Algeria in his Opinion 10/2020, where the EDPS provided several recommendations in order to clarify and, where necessary, further develop the safeguards and controls with respect to protection of personal data. The EDPS notes with satisfaction that his recommendations have been taken into account and that the provisions of the negotiated Agreement are consistent with the provisions of Chapter IX of EUDPR on the processing of operational personal data by union bodies, offices and agencies. As a result, it could be concluded that the presented Agreement between the EU and Algeria provides for adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

text: At the same time, in this Opinion, the EDPS provides some recommendations, in particular with regards to onward transfers of personal data, the right to erasure of personal data, the possibility to postpone transfer of personal data and on the review and evaluation of the Agreement, aimed at facilitating the practical implementation of the future Agreement by Eurojust and the competent authorities of Algeria.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 25 June 2026, the European Commission issued the Proposal for a Council Decision on the signing of an agreement between the European Union and the People’s Democratic Republic of Algeria on the cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the authorities of the People’s Democratic Republic of Algeria competent for judicial cooperation in criminal matters and the Proposal for a Council decision on the conclusion of an Agreement between the European Union and the People’s Democratic Republic of Algeria on the cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the authorities of the People’s Democratic Republic of Algeria competent for judicial cooperation in criminal matters (‘the Proposals’), both accompanied by their respective Annexes containing the final negotiated text of the Agreement.

text: 2. The objective of the Agreement is to enhance judicial cooperation between the competent authorities of Algeria and Eurojust in combating serious crime by allowing the transfer of personal data between the competent authorities of Algeria and Eurojust, in order to support and strengthen their action, and their cooperation in investigating and prosecuting serious crime, in particular organised crime and terrorism, corruption, money laundering and cybercrime, and related criminal offences, while ensuring appropriate safeguards with respect to the fundamental rights and freedoms of individuals, including privacy and the protection of personal data .

text: 3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 25 June 2026, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 9 of the Proposals.

text: 2. General remarks

text: Regulation (EU) 2018/1727

text: (‘Eurojust Regulation’) lays down specific rules regarding transfers of personal data by Eurojust to third countries and international organisations.

text: Article 56(2)

text: thereof lists a number of legal grounds, based on which Eurojust could lawfully transfer data to authorities of third countries, such as an adequacy decision of the Commission in accordance with

text: Article 36 of Directive (EU) 2016/680

text: (‘LED’) finding that the third country ensures an adequate level of protection , a cooperation agreement allowing for the exchange of operational personal data concluded before 12 December 2019 between Eurojust and the given third country or international organisation, or an international agreement between the Union and the third country or international organisation pursuant to

text: Article 218

text: TFEU that provides for adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

text: 5. On 19 November 2020, the Commission adopted a Recommendation for a Council Decision authorising the opening of negotiations for Agreements between the European Union (EU) and Algeria, Armenia, Bosnia and Herzegovina, Egypt, Israel, Jordan, Lebanon, Morocco, Tunisia and Turkey on cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the competent authorities for judicial cooperation in criminal matters of those third States .

text: 6. The EDPS issued an Opinion regarding the Recommendation on 17 December 2020. The Council granted the authorisation for the opening of the negotiations on 1 March 2021, adding also Argentina, Brazil and Colombia to the list, and adopted a set of negotiating directives .

text: 7. Several negotiation rounds and written exchanges took place between April 2022 and August 2025, when the negotiators reached an agreement at technical level on a text. Algeria had given its final agreement on 3 February 2026 .

text: 8. The EDPS recognises the need for cooperation between Eurojust and judicial authorities of third countries involved in the investigation and prosecution of serious crimes, which do not stop at Union borders. In this regard, Eurojust should be able to cooperate and exchange personal data with them to the extent necessary for the accomplishment of its tasks within the framework of the requirements set out in the Eurojust Regulation .

text: 9. At the same time, transfers of personal data gathered in the context of criminal investigations envisaged under the future Agreement are liable to have a significant impact on the lives of the individuals concerned, as they will be used in prosecution cases in the receiving country under its national law. Consequently, the necessity and proportionality of the envisaged processing need to be assessed in accordance with Article 52(1) of the Charter .

text: 10. In particular, transfers of personal data between Eurojust and the authorities competent for judicial cooperation in criminal matters of Algeria constitute an interference with individuals’ rights to privacy and data protection guaranteed by Articles 7 and 8 of the Charter. Therefore, the future Agreement must ensure that the derogations and limitations to rights to privacy and data protection, including in relation to fighting crime, apply only in so far as is strictly necessary . In that regard, the EDPS welcomes Article 10(5) of the future Agreement, obliging the Parties to comply with the safeguards provided for in the Agreement regardless of the nationality of the data subject concerned and without discrimination.

text: 11. As mentioned above, the EDPS has already had the opportunity to comment on the exchange of personal data between Eurojust and the competent authorities of Algeria in his Opinion 10/2020, where the EDPS provided several recommendations in order to clarify and, where necessary, further develop the safeguards and controls with respect to protection of personal data. The EDPS notes with satisfaction that his recommendations have been taken into account and that the negotiated Agreement provides for similar data protection safeguards as provided for in Chapter IX of EUDPR with regard to processing of operational personal data by Union bodies, offices and agencies when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part three TFEU .

text: 12. As a result, it can be concluded that the presented Agreement between the European Union and Algeria adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals, in line with

text: Article 56(2)

text: (c) of the Eurojust Regulation.

text: 13. At the same time, the EDPS considers that certain safeguards with respect to the protection of personal data, while already provided for in the future Agreement, may still benefit from additional precision and clarity. In this regard, the subsequent comments by the EDPS aim at facilitating the practical implementation of the Agreement by Eurojust and the competent authorities of Algeria as well as to provide guidance for future agreements with other third countries that are still under negotiations or negotiations are still to begin.

text: 3. Onward transfers of personal data received

text: 14. The EDPS recalls that, in accordance with

text: Article 56(6)

text: and recital 45 of the Eurojust Regulation, when personal data are transferred from Eurojust to a third country, the level of protection of natural persons ensured by the Eurojust Regulation and by Union law must not be undermined. This requirement is fully valid also in case of a potential onward transfer of personal data received from Eurojust by the competent authorities of Algeria to other authorities in Algeria or to the authorities of a third country or to an international organisation.

text: 15. The EDPS therefore welcomes Article 13 of the future Agreement, which prohibits further transferring the personal data received from Eurojust to other authorities of Algeria or to the authorities of a third country or to an international organisation, unless such onward transfer is carried out under strictly limited conditions.

text: 16. The EDPS additionally welcomes paragraph 1(c) of

text: Article 13

text: , which lays down that the possible onward transfer to other authorities of Algeria is subject to the same conditions and safeguards as those applying to the original transfer.

text: 17. In that regard, although this is not explicitly mentioned in paragraph 2 of the same Article, regulating onward transfers to the authorities of a third country or to an international organisation, the EDPS expects that, when giving its explicit prior authorisation pursuant to paragraph 2(b), Eurojust will assess and clearly indicate that the conditions and safeguards applying to the original transfer should also apply to the onward transfer, similarly to the explicit obligation in paragraph 1(c) of

text: Article 13

text: 4. Right of access, rectification, erasure or restriction

text: 18. The EDPS recalls that the right of access and the right to rectification are essential elements of the right to data protection under Article 8(2) of the Charter. Furthermore, as regards Article 7 of the Charter, the European Court of Justice has held that “the fundamental right to respect for private life, enshrined in that article, means that the person concerned may be certain that his personal data are processed in a correct and lawful manner. In order to carry out the necessary checks, that person must have a right of access to the data relating to him which is being processed” . The EDPS therefore welcomes the inclusion, under Articles 14 and 15 of the future Agreement, of a right to access as well as rectification, erasure or restriction.

text: 19. As regards specifically the right to erasure, the EDPS positively notes that paragraph 2 of

text: Article 15

text: prescribes that the Parties must provide for any data subject the right to obtain from the authorities processing personal data transferred under the Agreement the erasure of personal data concerning the data subject where the processing of the personal data infringes data protection principles (Article 10(1) of the Agreement), rules on processing of data of victims and witnesses, and special categories of personal data (

text: Article 11

text: ) or rules on automated processing of personal data (

text: Article 12

text: ), or where the personal data must be erased in order to comply with a legal obligation to which the authorities are subject.

text: 20. The EDPS considers that even though the provision of

text: Article 15(2)

text: mentions explicitly infringements of Articles

text: and Article 12 of the Agreement as grounds enabling the data subject to obtain erasure of personal data, this should not be viewed as an exhaustive list. In particular, it is the understanding of the EDPS that the infringement of

text: Article 10(1)

text: (a) - lawfulness of processing of personal data - should be interpreted broadly, thus covering possible infringements of other legal obligations under the future Agreement, such as those laid down in

text: Article 10(6)

text: 5. Postponement of the transfer of personal data

text: 21. The EDPS welcomes the explicit legal possibility included in Article 34(4) of the future Agreement, according to which a Party may “may postpone the transfer of personal data in the event that, and for as long as, the other Party ceases to provide for, and implement, the safeguards and obligations under Chapter II”.

text: 22. The EDPS considers that it may provide a useful and effective safeguard, especially in cases of third countries facing practical issues to meet the obligations stemming from the Agreement, e.g. amendments of the relevant domestic legislation, legal or organisational changes affecting the supervisory authority, etc.

text: 23. At the same time, in view of the possible implementation of this safeguard in practice, the EDPS considers that it is important to have clarity who on the EU side would carry out the assessment whether Algeria (or any other third country) has ceased to provide for, and implement, the data protection safeguards and obligations under Chapter II of the Agreement.

text: 6. Review and evaluation of the Agreement

text: 24. The EDPS welcomes Article 33 of the future Agreement that provides for the regular review and evaluation of the Agreement and specifically envisages the participation of “relevant experts on data protection” in the respective review teams. In this context, the EDPS recommends the involvement of the independent data protection authorities in the review and the evaluation of the Agreement. .

text: 7. Conclusions

text: 25. In light of the above, the EDPS makes the following recommendations: (1) in case of onward transfers to the authorities of a third country or an international organisation, when giving its explicit prior authorisation pursuant to paragraph 2(b), Eurojust to assess and clearly indicate that the conditions and safeguards applying to the original transfer should also apply to the onward transfer, similarly to the explicit obligation in paragraph 1(c) of

text: Article 13

text: ; 8 (2) regarding the right to erasure pursuant to

text: Article 15(2)

text: , to interpret broadly the infringement of

text: Article 10(1)

text: (a) - lawfulness of processing of personal data - thus providing the data subjects with the right to obtain from the authorities processing personal data transferred under the Agreement the erasure of their personal data also in case of infringements of other legal obligations under the future Agreement, such as

text: Article 10(6)

text: ; (3) to clarify, pursuant to Article 34(4) of the Agreement, who on the EU side would carry out the assessment whether Algeria has ceased to provide for, and implement, the safeguards and obligations under Chapter II of the Agreement; (4) to involve the independent data protection authorities in the future reviews and evaluations of the Agreement. Brussels, 10 August 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 9

type: vagledning

utgivare: edps


text: OJ L 295, 21.11.2018, p. 39. 2 COM (2022) 245 final. 3 COM (2022) 245 final, p. 2. 4

text: Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions on the EU Strategy to tackle Organised Crime 2021-2025, COM(2021)170 final. 5 Directive

text: of the European Parliament and of the Council of 3 April 2014 on the freezing and confiscation of instrumentalities and proceeds of crime in the European Union (OJ L 127, 29.4.2014, p. 39). Council Decision 2007/845/JHA of 6 December 2007 concerning cooperation between Asset Recovery Offices of the Member States in the field of tracing and identification of proceeds from, or other property related to, crime (OJ L 332, 18.12.2007, p. 103). 7 See Article 2(3) of the Proposal. 8 For further details see the EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data, issued on 19 December 2019, https://edps.europa.eu/sites/edp/files/publication/19- 12-19_edps_proportionality_guidelines_en.pdf 9 See Judgments of the Court of Justice of 8 April 2014 in Joined Cases

text: and

text: , DRI, paragraph 52; of 16 December 2008 in

text: Case C‑73/07

text: Satakunnan Markkinapörssi and Satamedia, paragraph 56; of 9 November 2010 in Joined Cases

text: and

text: Volker und Markus Schecke and Eifert, paragraphs 77 and 86. 10 See Recital 37 of the Proposal. 11

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89–131). 5

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (Text with EEA relevance) (OJ L 119, 4.5.2016, p. 1–88). 13 See Recital 17 of the Proposal. 14

text: Regulation (EU) 2016/794

text: of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ L 135, 24.5.2016, p. 53). 6

text: See Recital 18 of the Proposal. 16 See Recital 43 of the Proposal. 7

text: See Recitals 44 and 45 of the Proposal. 8

identifier: EDPS yttrande 16/2022

title: EDPS Opinion on the Proposal for a Directive of the European Parliament and of the Council on asset recovery and confiscation

text: 19 July 2022

text: Opinion 16/2022

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Directive of the European Parliament and of the Council on asset recovery and confiscation. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the draft Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: The objective of the Proposal is to strengthen the capabilities of the competent authorities of the Member States to identify, freeze and manage assets; to reinforce and extend confiscation capabilities so as to cover all relevant criminal activities carried out by organised crime groups, thereby enabling confiscation for all relevant assets; and to improve the cooperation between the authorities involved in asset recovery.

text: The EDPS notes that processing of personal data in the context of asset recovery and confiscation, envisaged under the Proposal, is liable to have a significant impact on the individuals concerned and constitute an interference with individuals’ rights guaranteed by the EU Charter of Fundamental Rights, including the right to data protection. He therefore welcomes the fact that the Proposal explicitly underlines the particular importance that the protection of personal data, in accordance with Union law, is ensured in connection to processing of data under the Proposal.

text: The EDPS, however, has doubts whether special categories of personal data listed under Annex II.B.(2)(c) (v) of

text: Regulation (EU) 2016/794

text: (e.g. forensic identification information such as fingerprints, DNA profile established from the non-coding part of DNA, voice profile, blood group, dental information or behavioural data), to which the Proposal refers to, may actually be relevant in the specific context of assets recovery and whether they should be available for the cross-border exchange between asset recovery offices.

text: Moreover, the EDPS considers that the national legislation transposing the proposed Directive should designate the competent authority (or authorities) which will be responsible for the management of the registry of frozen and confiscated property and thus will take the role of data controller in accordance with Article 3(8) of the LED. The Proposal should also lay down clearly the purposes for which centralised registries may be accessed and searched, directly and immediately.

text: As regards the cooperation with EU bodies and agencies, the EDPS recalls that any exchange and further processing of personal data in the context of the envisaged cooperation must take place in strict compliance with the provisions of Chapter IX of the EUDPR and the specific data protection rules in the legal acts establishing the Union agencies.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 25 May 2022, the European Commission issued the Proposal for a Directive of the European Parliament and of the Council on asset recovery and confiscation (‘the Proposal’).

text: 2. The objectives of the Proposal, according to the Explanatory Memorandum , are the following: - to strengthen the capabilities of competent authorities to identify, freeze and manage assets; - to reinforce and extend confiscation capabilities so as to cover all relevant criminal activities carried out by organised crime groups, thereby enabling confiscation for all relevant assets; - to improve the cooperation between all actors involved in asset recovery and promote a more strategic approach to asset recovery.

text: 3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 25 May 2022, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 51 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 EUDPR.

text: 2. General remarks

text: 4. The Proposal, announced in the EU Strategy to tackle Organised Crime adopted by the Commission in April 2021 , would replace the existing Directive

text: on the freezing and confiscation of the proceeds and instrumentalities of crime , and Council Decision 2007/845/JHA on Asset Recovery Offices .

text: 5. The Proposal aims at establishing minimum rules on the tracing, freezing, confiscation and management of property in criminal matters. The Proposal would apply: The rules laid down in the Proposal also aim at facilitating the implementation of ‘EU restrictive measures’, as defined in Article 3(11) of the Proposal .

text: 6. Processing of personal data in the context of asset recovery and confiscation, envisaged under the Proposal, is liable to have a significant impact on the individuals concerned and constitute an interference with individuals’ rights guaranteed by the EU Charter of Fundamental Rights, including the right to data protection. Therefore, the requirements of necessity and proportionality of the envisaged processing need to be assessed in accordance with Article 52(1) of the Charter . Consequently, the proposed Directive must ensure that the limitations to right data protection in relation to the fight against organised crime apply only in so far as is strictly necessary .

text: 7. The EDPS welcomes the fact that the Proposal explicitly underlines the particular importance that the protection of personal data, in accordance with Union law, is ensured in connection to processing of data under this Directive . In this context, recital 37 of the Proposal clarifies that

text: Directive (EU) 2016/680

text: (‘the LED’) applies to the processing of personal data by national competent authorities, notably asset recovery offices, for the purposes of this Proposal.

text: 8. In addition, recital 38 of the Proposal specifies that, where relevant, notably having regard to the processing of personal data by asset management offices for the purpose of the management of property,

text: Regulation (EU) 2016/679

text: (‘the GDPR’) may also be applicable.

text: 3. Access to information by asset recovery offices

text: 9. The EDPS notes that Article 6 of the Proposal provides a list of information to be accessed by asset recovery offices to the extent that information is necessary for the identification and tracing of proceeds, instrumentalities and property. Although

text: Article 6(1)

text: (g) (“relevant information which is held by authorities competent for preventing, detecting, investigating or prosecuting criminal offences”) and

text: Article 6(1)

text: (a) “fiscal data, including data held by tax and revenue authorities”, do not exhaustively list all of the categories of data to be processed pursuant to these provisions, the information to be accessed should in any event be limited in accordance with

text: Article 6(1)

text: (“to the extent that information is necessary for the tracing and identification of proceeds, instrumentalities, and property”).

text: 10. The EDPS welcomes the fact that the access to information would be subject to specific safeguards in order to prevent possible misuse of the access rights . In this regard, he positively notes that the access to information by asset recovery offices established under Article 7 of the Proposal would be permitted only where necessary and on a case-by-case basis (

text: Article 7(1)

text: ) and would be accompanied by technical and organisational measures ensuring the security of the data (

text: Article 7(3)

text: ). The EDPS also takes note of the safeguard for the persons concerned laid down in

text: Article 6(3)

text: , according to which the access to the information listed in

text: Article 6(1)

text: must be without prejudice to the procedural safeguards established under national law.

text: 11. In addition, the EDPS welcomes the provisions on monitoring the access and searches by asset recovery offices in Article 8 of the Proposal. He also notes that these provisions are without prejudice to the general rules on logging in Article 25 of the LED and compliment them in the specific context of asset recovery and confiscation.

text: 4. Exchange of information between asset recovery offices

text: 12. The EDPS notes that Article 9(1) of the Proposal would provide for the cross-border exchange between asset recovery offices of the information listed in Annex II, Section B, point 2, of

text: Regulation (EU) 2016/794

text: . The referred catalogue of data categories would apply to persons who, pursuant to the national law of the Member State concerned, are (a) suspected of having committed or having taken part in a criminal offence in respect of which Europol is competent, or who have been convicted of such an offence, or (b) persons regarding whom there are factual indications or reasonable grounds under the national law of the Member State concerned to believe they will commit criminal offences in respect of which Europol is competent.

text: 13. The EDPS has consistently expressed his support for measures aimed at harmonisation and alignment of the legal rules applicable to the processioning of operational personal data. Therefore, he welcomes the approach chosen by the Commission to define in an exhaustive manner the categories of data that may be exchanged asset recovery offices.

text: 14. The use of a closed list of data categories would provide additional legal certainty and corresponds to the principle of data minimisation, laid down in

text: Article 4(1)

text: (c) of the LED. Moreover, it is complemented by the obligation laid down in Article 9(2) of the Proposal to specify as precisely as possible the content of the request for information, including the type of criminal offence for which the request is made.

text: 15. At the same time, the EDPS has doubts whether the special categories of personal data listed in Annex II.B.(2)(c) (v) would actually be relevant in the specific context of assets recovery (e.g. forensic identification information such as fingerprints, DNA profile established from the non-coding part of DNA, voice profile, blood group, dental information or behavioural data). Therefore, the EDPS recommends excluding the above-mentioned categories of sensitive personal data from the scope of the Proposal, unless convincing objective arguments in support of their necessity and proportionality in the specific context of the Proposal can be presented to the co-legislator.

text: 16. The EDPS also notes that Article 9(5) of the Proposal establishes the use of the Secure Information Exchange Network Application (SIENA), managed by Europol, by asset recovery offices as secure communication channel for this exchange of information . In this regard, the EDPS considers that this element of the Proposal may indeed contribute to enhancing data security and also strengthening and facilitating supervision.

text: 5. Establishment of centralised registries of frozen and confiscated property

text: 17. Article 26 of the Proposal would impose on Member States an obligation to put in place centralised registries containing information related to the freezing, confiscation and management of instrumentalities and proceeds, or property which may become or is the object of a confiscation order . Pursuant to Article 26(5) of the Proposal, Member States must put in place appropriate technical and organizational measures to ensure the security of the data contained in the centralised registries of frozen and confiscated property.

text: 18. In this regard, the EDPS considers that the national legislation transposing the Directive should designate the competent authority(ies) which will be responsible for the

text: 19. Furthermore, the EDPS recommends the Proposal to lay down clearly the purposes, for which centralised registries may be accessed and searched, directly and immediately (i.e. information stored in the registry can only be accessed and used for the purposes laid down by the Proposal, i.e. freezing, confiscation and management of instrumentalities and proceeds, or property which may become or is the object of a confiscation order).

text: 6. Cooperation between asset recovery offices and EU agencies

text: 20. The EDPS notes that Article 28 of the Proposal would provide for close cooperation between asset recovery offices and the European Public Prosecutor’s Office (EPPO), Europol and Eurojust, in accordance with their respective mandates, insofar as it is necessary to trace and identify property within the cross-border investigations .

text: 21. In this regard, the EDPS recalls that any exchange and further processing of personal data in the context of the envisaged cooperation must take place in strict compliance with the provisions of Chapter IX of the EUDPR and the specific data protection rules in the legal acts establishing the Union agencies.

text: 7. Conclusions

text: 22. In light of the above, the EDPS makes the following recommendations: (1) with regard to

text: Article 9(1)

text: , to exclude from the Proposal the EDPS the possibility to exchange the special categories of personal data listed under Annex II.B.(2)(c) (v) (forensic identification information such as fingerprints, DNA profile established from the non-coding part of DNA, voice profile, blood group, dental information or behavioural data), unless there are convincing objective arguments in support of their necessity and proportionality; (2) with regard to

text: Article 26

text: , to require Member States to designate which competent authority (or authorities) are responsible for the management of the registry; and to clearly lay down the purposes, for which centralised registries may be accessed and searched, directly and immediately. Brussels, 19 July 2022 (e-signed) Wojciech Rafał WIEWIÓROWSKI


text: COM(2023) 130 final 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 130 final. 4 See page 2 of the Explanatory memorandum of the Proposal. 5 European Union Serious and Organised Crime Threat Assessment: A corrupt Influence: The infiltration and undermining of Europe’s economy and society by organised crime, page 12. Europol and the global cocaine trade, available at https://www.emcdda.europa.eu/publications/eu-drug-markets/cocaine/europeand-global-cocaine-trade_en.

text: Europol and the global cocaine trade, available at https://www.emcdda.europa.eu/publications/eu-drug-markets/cocaine/europeand-global-cocaine-trade_en. 8 EU Drug Market: Cocaine p.10, available at EU Drug Market: Cocaine | www.emcdda.europa.eu. 9 Explanatory memorandum, p. 2.

text: idem. 11

text: Regulation (EU) 2016/794

text: of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA, OJ L 135, 24.5.2016, p. 53. 12 See EDPS Opinion 2/2018 on eight negotiating mandates to conclude international agreements allowing the exchange of data between Europol and third countries, adopted on 14 March 2018, https://edps.europa.eu/sites/edp/files/publication/18-03- 19_opinion_international_agreements_europol_en.pdf and EDPS Opinion 1/2020 on the negotiating mandate to conclude an international agreement on the exchange of personal data between Europol and New Zealand law enforcement authorities, issued on 31 January 2020 https://edps.europa.eu/sites/default/files/publication/20-01-31_opinion_recommendation_europol_en.docx.pdf

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89. 14 See Judgment of the Court of Justice of 30 April 1974,

text: Case C-181/73

text: , R. & V. Haegeman a.o., ECLI:EU:C:1974:41, par. 5. 15 See Judgment of the Court of Justice of 3 June 2008,

text: Case C-308/06

text: , Intertanko a.o., ECLI:EU:C:2008:312, par. 42. 16 See Judgment of the Court of Justice of 3 September 2008, joined cases

text: P and

text: P, Kadi a.o., ECLI:EU:C:2008:461, par. 285. 17 For further details see the EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data.

text: See Judgment of the Court of Justice of 8 April 2014, joined cases

text: and

text: , Digital Rights Ireland Ltd, ECLI:EU:C:2014:238, paragraph 52..

text: Regulation (EU) 2022/991

text: of the European Parliament and of the Council of 8 June 2022 amending

text: Regulation (EU) 2016/794

text: , as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role in research and innovation, OJ L 169, 27.6.2022, p. 1. 20 See

text: Articles 18

text: a(6) and 23(9) of the Europol Regulation. 8

text: See Opinion 1/15 of the Court of Justice of 26 July 2017, EU-Canada PNR Agreement, ECLI:EU:C:2017:592, paragraph 141. 22 Idem. 23

text: Article 5(1)

text: (f) GDPR and

text: Article 4(1)

text: (f) LED and EUDPR. 24 See Judgment of the Court of Justice of 8 April 2014, in joined cases

text: and

text: , Digital Rights Ireland Ltd, ECLI:EU:C:2014:238, paragraph 40. 10

text: See Judgment of the Court of Justice of 1 October 2015,

text: Case C-201/14

text: , Smaranda a.o., ECLI:EU:C:2015:638, in particular para. 32 and 33 where the Court found that “the requirement to inform the data subjects about the processing of their personal data is all the more important since it affects the exercise by the data subjects of their right of access to, and right to rectify, the data being processed, and their right to object to the processing of those data” and that “That information concerns the identity of the data controller, the purposes of the processing and any further information necessary to guarantee fair processing of the data”. 11

identifier: EDPS yttrande 16/2023

title: EDPS Opinion 16/2023 on the negotiating mandate to conclude an international agreement on the exchange of personal data between Europol and Bolivian law enforcement authorities

text: 3 May 2023

text: Opinion 16/2023

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Recommendation for a Council decision authorising the opening of negotiations for an agreement between the European Union and the Plurinational State of Bolivia on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Bolivian authorities competent for fighting serious crime and terrorism .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Recommendation that are relevant from a data protection perspective.

text: Executive Summary

text: On 9 March 2023 the European Commission issued a Recommendation for a Council decision authorising the opening of negotiations for an agreement between the European Union and the Plurinational State of Bolivia on the exchange of personal data between Europol and the Bolivian authorities competent for fighting serious crime and terrorism.

text: The objective of the Recommendation is to open negotiations with Bolivia with the purpose of signing and concluding an international agreement enabling the exchange of personal data between Europol and the Bolivian authorities competent for fighting serious crime and terrorism. The Annex to the Recommendation lays down the Council’s negotiating directives to the Commission, i.e. the objectives the latter should aim to achieve on behalf of the EU in the course of these negotiations.

text: Transfers of personal data gathered in the context of criminal investigations and further processed by Europol to produce criminal intelligence are liable to have a significant impact on the lives of the individuals concerned. For that reason, the international agreement must ensure that the limitations to the rights to privacy and data protection in relation to the fight against serious crime and terrorism apply only in so far as is strictly necessary.

text: The EDPS positively notes that the Commission has established by now, based also on a number of the recommendations from the previous EDPS Opinions on this matter, a well-structured set of objectives (negotiating directives), incorporating fundamental data protection principles, which the Commission aims to achieve on behalf of the EU in the course of international negotiations to conclude agreements on the exchange of personal data between Europol and third country law enforcement authorities.

text: In this regard, the recommendations in this Opinion are aimed at clarifying and, where necessary, further developing the safeguards and controls in the future Agreement between the EU and Bolivia with respect to the protection of personal data. In this context, the EDPS recommends that the future Agreement explicitly lays down the list of the criminal offences regarding which personal data could be exchanged; provides for a periodic review of the need for storage of the transferred personal data as well as other appropriate measures ensuring that the time limits are observed; adduces additional safeguards as regards the transfer of special categories of data; ensures that no automated decision based on the received data under the Agreement would take place without the possibility for a human being to intervene in an effective and meaningful way; lays down clear and detailed rules regarding the information that should be made available to the data subjects.

text: The EDPS recalls that, pursuant to Article 8(3) of the Charter, the control by an independent authority is an essential element of the right to the protection of personal data. The EDPS therefore recommends to the Commission to pay special attention, during the negotiations to the oversight by independent public bodies responsible for data protection with effective powers vis-a-vis the law enforcement and other competent authorities of Bolivia that will use the transferred personal data. In addition, in order to ensure proper implementation of the Agreement, the EDPS also

text: suggests that the Parties exchange on a regular basis information on the exercise of rights by data subjects as well as relevant information about the use of the oversight and redress mechanisms related to the application of the Agreement.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 9 March 2023 the European Commission issued a Recommendation for a Council decision authorising the opening of negotiations for an agreement between the European Union and the Plurinational State of Bolivia on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Bolivian authorities competent for fighting serious crime and terrorism (‘the Recommendation’). The Recommendation is accompanied by its respective Annex.

text: 2. The objective of the Recommendation is to open negotiations with the Plurinational State of Bolivia (hereinafter ‘Bolivia’) with the purpose of signing and concluding an international agreement enabling the exchange of personal data between Europol and the Bolivian authorities competent for fighting serious crime and terrorism. The Annex to the Recommendation lays down the Council’s negotiating directives to the Commission, i.e. the objectives the latter should aim to achieve on behalf of the EU in the course of these negotiations.

text: 3. In the Explanatory Memorandum of the Recommendation the Commission assesses that Latin America’s organised crime groups pose a serious threat to the EU internal security as their actions are increasingly linked to a series of crimes within the Union, particularly in the realm of drug trafficking . The 2021 EU Serious and Organised Crime Threat Assessment (‘SOCTA’) by Europol highlights that unprecedented quantities of illicit drugs are trafficked to the EU from Latin America, generating multi-billion-euro profits, which are used to finance a diverse range of criminal organisations (international and EU-based) and to weaken the rule of law in the EU .

text: 4. Most of the drugs seized in the EU is transported by sea, primarily in maritime shipping containers , and shipped to the EU directly from the countries of production, as well as 5 from neighbouring countries of departure in Latin America . Bolivia is the third largest coca-cultivating country globally, accounting for 12.5% of global cultivation .

text: 5. In its Programming Document 2022-2024, Europol has flagged that, among others, the growing demand for drugs and increased drug trafficking routes into the EU justify the need for enhanced cooperation with Latin American countries. In this sense, in December 2022, Bolivia was included in Europol’s list of priority partners with which the agency may conclude Working Arrangements .

text: 6. Bolivia has also been identified as a key international partner to reduce the global supply of cocaine by the EMCDDA

text: 7. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 9 March 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes that he has been consulted on the Recommendation and expects a reference to this Opinion to be included in the preamble of the Council Decision. In addition, the EDPS welcomes the reference, in Recital 4 of the Recommendation, to Recital 35 of the

text: Regulation (EU) 2016/794

text: (‘Europol Regulation’), which provides that the Commission should be able to consult the EDPS also during the negotiations of the Agreement and, in any event, before the Agreement is concluded.

text: 8. The EDPS recalls that he has already had the opportunity to comment in 2018 and in 2020 on the exchange of personal data between Europol and the law enforcement authorities of third countries on the basis of Europol Regulation .

text: 9. The EDPS positively notes that the Commission has established by now, based also on a number of the recommendations from the previous EDPS Opinions on this matter, a wellstructured set of objectives (negotiating directives), incorporating fundamental data protection principles, which the Commission aims to achieve on behalf of the EU in the course of international negotiations to conclude agreements on the exchange of personal data between Europol and third country law enforcement authorities.

text: 10. In this context, the recommendations in this Opinion are aimed at clarifying and, where necessary, further developing the safeguards and controls in the future Agreement between the EU and Bolivia with respect to the protection of personal data. They are without prejudice to any additional recommendations that the EDPS could make on the basis of further available information and the provisions of the draft agreement during the negotiations. 6

text: 2. General remarks

text: 11. The Europol Regulation lays down specific rules regarding transfers of data by Europol outside of the EU.

text: Article 25(1)

text: thereof lists a number of legal grounds based on which Europol could lawfully transfer data to authorities of third countries. One possibility would be an adequacy decision of the Commission in accordance with

text: Article 36 of Directive (EU) 2016/680

text: (‘LED’) finding that the third country to which Europol transfers data ensures an adequate level of protection. Since there is no such adequacy decision for Bolivia at the moment, the other alternative for Europol to regularly transfer data would be the conclusion of a binding international agreement between the EU and Bolivia, adducing adequate safeguards with respect to the protection of privacy and other fundamental rights and freedoms of individuals.

text: 12. Pursuant to

text: Article 216(2)

text: TFEU, international agreements concluded by the European Union ‛are binding upon the institutions of the Union and on the Member States’. Moreover, according to the settled case law of the Court of Justice of the European Union (‛CJEU’), international agreements become from their coming into force ‛an integral part of 14 15 Community law’ , and they have primacy over acts of secondary Union legislation .

text: 13. Since the proposed Agreement would be a binding international instrument, the EDPS notes that, in line with the case law of the CJEU, the ‛obligations imposed by an international agreement cannot have the effect of prejudicing the constitutional principles of the EC Treaty, which include the principle that all Community acts must respect fundamental rights, that respect constituting a condition of their lawfulness’ . It is therefore essential to ensure that the obligations stemming from the Agreement would not prejudice these principles as far as data protection is concerned.

text: 14. Transfers of personal data gathered in the context of criminal investigations and further processing by Europol to produce criminal intelligence envisaged under the future Agreement are liable to have a significant impact on the lives of the individuals concerned, as they may potentially be used as incriminating evidence in prosecution cases in the receiving country under its national law.

text: 15. As transfers of personal data to third countries constitute an interference with individuals’ right to data protection guaranteed by Article 8 of the Charter, requirements of necessity and proportionality of the envisaged processing need to be assessed in accordance with Article 52(1) of the Charter . As a result, the international agreement must ensure that the 7 limitations to the right to data protection in relation to the fight against serious crime and terrorism apply only in so far as is strictly necessary .

text: 16. Following the amendments of Europol Regulation in 2022 , Chapter IX of EUDPR applies to the processing of operational personal data by Europol. According to Recital 10 of EUDPR, the rules for the protection of operational personal data processed by Union bodies, offices or agencies, when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part Three TFEU, such as Europol, should be consistent with the LED. In this regard, Article 35(3) of the LED lays down the general principle that the level of protection of natural persons applicable in the EU must not be undermined by the transfer of their personal data to third countries or international organisations.

text: 17. The EDPS furthermore considers that the proposed Agreement should also take into account the potential risks in case of transfer of personal data from a third country to Europol. The Europol Regulation explicitly prohibits processing by Europol of “any information which has clearly been obtained in obvious violation of human rights” . This safeguard is even more valid in the context of the extended powers of Europol pursuant to

text: Article 18

text: a(6) of the amended Europol Regulation. Europol may process personal data that do not relate to the categories of data subjects listed in Annex II of the same Regulation, provided by a third country on the basis of an international agreement like the envisaged one, or pursuant to

text: Article 4(1)

text: (t) thereof, which mandates Europol to propose to Member States to enter information alerts in the Schengen Information System, based on data provided by third countries on persons involved in terrorism or serious crime. Therefore, the EDPS recommends the future Agreement to exclude explicitly transfers of personal data obtained in a manifest violation of human rights.

text: 3. Purpose limitation and data minimisation

text: 18. Purpose limitation is among the key principles of the EU data protection framework. It requires, on the one hand, that personal data are collected for specified, explicit and legitimate purposes and, on the other hand, that personal data are not further processed in a manner that is incompatible with those purposes. Article 18 of the Europol Regulation lays down an exhaustive list of purposes for data processing activities by Europol that are considered legitimate.

text: 19. In that regard, the EDPS notes that directive 2 of the Annex limits the exchange of data under the future Agreement only to crimes and related criminal offences falling within Europol's competence in accordance with Article 3 of Europol Regulation, in particular, preventing and combating terrorism, disrupting organised crime and fighting drug trafficking and cybercrime. It also envisages that the Agreement should specify its scope and the purposes for which Europol may transfer personal data to the competent authorities of Bolivia. Furthermore, directive 3(b) of the Annex underlines the principle of specificity, according to which the data should not be processed for other purposes than for the purposes of the transfer. In addition, directive 3(c) aims to ensure that personal data would be adequate, relevant and limited to what is necessary in relation to that purpose. The EDPS considers that all these requirements also apply to any sharing or onward transfer, in accordance with directives 3(i) and (j).

text: 20. In addition, the EDPS welcomes that the Agreement will oblige competent Bolivian authorities to respect any restrictions Europol may impose on access or use of transferred personal data and specify how compliance with these restrictions will be enforced in practice.

text: 21. Given the strong emphasis placed on purpose limitation in the Europol Regulation and for additional legal certainty, the EDPS recommends that the future Agreement explicitly lays down the list of the criminal offences regarding which personal data could be exchanged. Moreover, the transferred personal data must be related to individual cases.

text: 4. Storage limitation

text: 22. The EDPS notes that directive 3(c) of the Annex provides that personal data “will not be retained for longer than is necessary for the purposes for which they have been transferred”. Directive 3(f) further requires that the agreements should lay down rules on storage, review, correction and deletion of personal data. In that regard, the EDPS would like to point out that the Europol Regulation contains an elaborate regime for data storage with technical and procedural safeguards, which ensures that storage and erasure obligations are complied with in practice.

text: 23. In particular,

text: Article 31

text: thereof requires Europol to conduct reviews of the necessity and proportionality of storing the data every three years. This is without prejudice to different retention periods communicated by data providers when sending the data to Europol, which are binding for Europol. Any decision to store the data after the first three years must be duly justified and the motivation must be recorded. Europol is also bound to erase the data that have been erased in the systems of the data provider as soon as it is informed thereof. The EDPS considers these rules as fully applicable also for data received by Europol in the context of international cooperation.

text: 24. The EDPS recommends that the future Agreement provides for a periodic review of the need for storage of the transferred personal data as well as other appropriate measures ensuring that the time limits are observed. 9

text: 5. Special categories of personal data and different categories of data subjects

text: 25. According to the CJEU case law, the need for safeguards applies particularly where the protection of the particular category of personal data that is sensitive data is at stake .

text: 26. In this regard, the EDPS welcomes directive 3(d) aiming to align the special categories of data and their processing with Article 30 of the Europol Regulation, as well as to ensure specific safeguards relating to the transfer of personal data on minors, victims of criminal offence, witnesses or other persons who can provide information concerning criminal offences. However, given the sensitivity of special categories of personal data, the EDPS suggests that the future Agreement adduces the safeguards provided in Article 30 of the Europol Regulation, such as the prohibition of the selection of a particular group of persons solely on the basis of such personal data.

text: 6. Automated decisions

text: 27. The EDPS welcomes directive 3(f) aiming to provide for safeguards in respect to automated processing of personal data. According to the case law of the CJEU, ‛the need for [...] safeguards is all the greater where personal data is subject to automated processing. Those considerations apply particularly where the protection of the particular category of personal data that is sensitive data is at stake’ .

text: 28. In that regard, the EDPS recalls that in line with Article 77 (1) of the EUDPR and Article 11(1) of the LED, such safeguards should include at least the right to obtain human intervention. This would ensure that no automated decision based on the received data under the Agreement would take place without the possibility for a human being to intervene in an effective and meaningful way. This is especially important in the area of law enforcement, where the consequences of profiling on individuals are potentially even more severe. Therefore, the EDPS recommends including specifically this safeguard in the future Agreement.

text: 7. Data security

text: 29. The EDPS wishes to stress that ensuring the security of personal data is not only a clear requirement under EU law , but it is also considered by the CJEU as essential requirement in relation to the fundamental right to data protection . Data security is also essential for ensuring the confidentiality of criminal investigations.

text: 30. The EDPS therefore welcomes directive 3(h) of the Annex, the obligation to ensure security of personal data through appropriate technical and organisational measures, including by allowing only authorised persons to have access to personal data as well as an obligation of notification in the event of a personal data breach affecting data transferred under the Agreement. The EDPS considers it essential that security measures should cover data processed in the place of destination, as well as in transit.

text: 8. Right to information

text: 31. The EDPS welcomes the fact that directive 3(e) of the Annex requires that the future international agreement ensures “enforceable rights of individuals whose personal data are processed by laying down rules on the right of access, rectification and erasure, including the specific grounds which may allow any necessary and proportionate restrictions”. Furthermore, directive 3(f) provides for that the Agreement should lay down rules, inter alia, “on information to be made available to individuals”.

text: 32. The EDPS recalls that data subjects usually have no knowledge of the fact that their data are processed and transferred for law enforcement purposes. At the same time, the right to information is of utmost importance as it allows the exercise of the other data protection rights, including the right to remedies, and ensures fair processing of the data .

text: 33. The EDPS recommends that the future Agreement lays down clear and detailed rules regarding the information that should be made available to the data subjects, in line with

text: Article 79

text: EUDPR. Such rules should also include information about the applicable regime for EU data subjects to exercise their rights of access, rectification and erasure in Bolivia. In the same vein, the future Agreement should also lay down mechanisms to facilitate the exercise of such rights in practice, e.g. consultations between the competent law enforcement authorities and Europol.

text: 9. Supervision

text: 34. Pursuant to Article 8(3) of the Charter, the control by an independent authority is an essential element of the right to the protection of personal data. Therefore, the EDPS welcomes directive 3(k) of the Annex, according to which the Agreement should ensure “a system of oversight by one or more independent public authorities responsible for data protection with effective powers of investigation and intervention to exercise oversight over those public authorities of Bolivia that use personal data/exchanged information”.

text: 35. The EDPS recommends to the Commission to pay special attention during the negotiations to directive 3(k) concerning the oversight by independent public bodies responsible for data protection with effective powers vis-a-vis the law enforcement and other competent authorities of Bolivia that will use the transferred personal data.

text: 10. Review of the Agreement

text: 36. The EDPS welcomes Article 5 of the Annex providing that the Agreement will include provisions on the monitoring and periodic evaluation of the Agreement.

text: 37. For the purposes of this review, the EDPS suggests that the Parties exchange on a regular basis information on the exercise of rights by data subjects, including statistics on the number of requests and their outcome, notably the number of cases where the right was restricted. In addition, the Parties could agree to exchange relevant information about the use of the oversight and redress mechanisms related to the application of the Agreement, including the decisions taken on that account.

text: 11. Conclusions

text: 38. In light of the above, the EDPS recommends: (1) that the future Agreement excludes explicitly transfers of personal data obtained in a manifest violation of human rights, (2) that the future Agreement explicitly lay down the list of the criminal offences regarding which personal data could be exchanged and that the transferred personal data must be related to individual cases, (3) that the future Agreement provide for a periodic review of the need for storage of the transferred personal data as well as other appropriate measures ensuring that the time limits are observed, (4) to ensure the future Agreement adduce the safeguards provided for in Article 30 of the Europol Regulation, (5) to ensure that security measures cover data processed in the place of destination, as well as in transit, (6) to ensure that no automated decision based on the received data under the Agreement would take place without the possibility for a human being to intervene in an effective and meaningful way, (7) that the future Agreement lays down clear and detailed rules regarding the information that should be made available to the data subjects, (8) the Commission to pay special attention during the negotiations to draft directive 3(k) concerning the oversight by independent public bodies responsible for data protection with effective powers vis-a-vis the law enforcement and other competent authorities of Bolivia that will use the transferred personal data, 12 (9) for the purposes of this review of the Agreement, that the Parties exchange on a regular basis information on the exercise of rights by data subjects and relevant information about the use of the oversight and redress mechanisms related to the application of the Agreement. Brussels, 3 May 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 13