text: Council of the European Union doc. 11615/24. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM (2023) 769 final. 4 Council of the European Union doc. 11615/24. Article 1 of the Proposal. 6 The Annexes specify the requirements applicable to establishments pursuant to

text: Articles 11

text: to 14 of the Proposal, the identification and registration of dogs and cats pursuant to Articles 17 and 21 of the Proposal and the collection of data pursuant to Article 20 of the Proposal, accordingly.

text: Recitals 11a, 19 and 57 of the Proposal. 8 According to Article 3(11) of the Proposal, ‘establishments’ means breeding establishments, selling establishments, shelters, and foster homes. 9 Pursuant to Recital 5a of the Proposal, traceability is important to fulfil the objective of ensuring a smooth functioning of the market of dogs and cats in the Union with a high level of animal welfare, as illegal trade creates both disturbances of the market (distortion of competition) and, allows negative animal welfare conditions to flourish due to the lack of control and the maximisation of profit. Furthermore, traceability requirements are needed to be able to trace back the establishment of origin and to establish responsibilities, in particular in case of welfare-related problems identified in a dog or cat. 10 Recital 1 of the Proposal; According to Article 3(5) of the Proposal, ‘placing on the market’ means the sale, offering for sale, distribution or any other form of transfer, of ownership or responsibility, on the market of dogs or cats, whether in return for payment or free of charge, as well as the advertising of dogs or cats for those purposes. 11 According to Article 19(1) of the Proposal, the competent authorities shall establish and maintain a database for the registration of microchipped dogs and cats registered in accordance with

text: Article 17(2)

text: and

text: Article 21(4)

text: . 12 The EDPS notes that

text: Article 20

text: a(1) provides that the Commission shall be controller in relation to the processing of personal data collected under the second subparagraph of Article 21(4) of the Proposal. The EDPS understands that this should be a reference to the second subparagraph of

text: Article 21

text: (4a) and recommends amending this cross-reference. 13

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1. 5

text: According to Article 3(15) of the Proposal, ‘operator’ means any natural or legal person, that places dogs or cats on the market and that is responsible for a breeding establishment, a selling establishment or a shelter and for dogs or cats kept therein, or that is responsible for unwanted, abandoned, stray, lost or confiscated dogs or cats and places them in foster homes. 15 According to Article 3(17) of the Proposal, ‘competent authorities’ means competent authorities as defined in point (3) of

text: Article 3 of Regulation (EU) 2017/625

text: . 16

text: Article 7(1)

text: (a) of the Proposal. 17

text: Article 7(2)

text: (a) of the Proposal. 18

text: Article 5(1)

text: (c) of the GDPR. 19

text: Article 5(1)

text: (c) of the GDPR. 20 According to Recital 44b of the Proposal, for the purpose of this Regulation, the names of natural persons and related contact details could appear in the documents processed by the Commission and the Member States in the course of the implementation of this Regulation, namely notification and of establishments, registration of dogs and cats and imports of dogs and cats. 6

text: Article 17(6) of the Proposal. 22

text: Article 17(7)

text: (b) of the Proposal. 23

text: Article 17(7)

text: (b) of the Proposal. 24 As defined in point 14 of

text: Article 4 of Regulation (EU) 2016/429

text: of the European Parliament and of the Council of 9 March 2016 on transmissible animal diseases and amending and repealing certain acts in the area of animal health (‘Animal Health Law’), OJ L 84, 31.3.2016, p. 1. 25

text: Article 21

text: a(4) of the Proposal. 26

text: Article 7

text: a(3) of the Proposal. 7

text: See

text: article 20

text: a(1) of the Proposal. 28 See also paragraph 17 above. 29

text: Article 20

text: a(2) of the Proposal. 30 Recitals 44c, 44d, 44e of the Proposal. 31 Recital 44d of the Proposal. 8

identifier: EDPS yttrande 22/2024

title: EDPS Opinion 22/2024 on the Proposal for a Regulation on the welfare of dogs and cats and their traceability

text: 18 November 2024

text: Opinion 22/2024

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. In accordance with Article 57(1)(g) of Regulation 2018/1725, the EDPS shall ‘advise, on his or her own initiative or on request, all Union institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Council mandate for negotiations with the European Parliament regarding the Proposal for a Regulation of the European Parliament and of the Council on the welfare of dogs and cats and their traceability .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 26 July 2024, the Council consulted the EDPS on the Council mandate for negotiations with the European Parliament regarding the proposal for a Regulation of the European Parliament and of the Council on the welfare of dogs and cats and their traceability (‘the Proposal’).

text: The objectives of the Proposal are to ensure a smooth functioning of the market of dogs and cats and a rational development of the sector, as well as a high level of animal welfare. In order to achieve these objectives, both national competent authorities and the Commission must be able to process certain personal data. Against this background, the EDPS welcomes the inclusion of a specific provision regarding data protection in the Proposal and the aim of ensuring a high level of data protection.

text: With this Opinion, the EDPS provides a number of recommendations regarding the categories of personal data to be processed by either national competent authorities or the Commission. In particular, the EDPS recommends providing further clarifications regarding personal data processed in the context of (1) the notification and registration of establishments; (2) the national database of the identification and registration of dogs and cats (and their owners); (3) the online system performing automated checks of the authenticity of the identification and registration information; (4) the Union pet travellers’ database and (5) the list of approved breeding establishments.

text: The EDPS also recommends explicitly designating the Commission as the controller responsible for processing personal data through the online system performing automated checks of the authenticity of the identification and registration of dogs and cats placed on the market.

text: Finally, the EDPS welcomes that the Proposal provides for maximum storage periods and explains why these storage periods are considered necessary. However, he recommends re-evaluating whether a shorter maximum storage period of personal data relating to present and past owners of dogs or cats would be sufficient to achieve the envisaged purposes. He also suggests defining the maximum period for any personal data processed through the system verifying the authenticity of the identification and registration of dogs and cats.

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Articles 57(1)

text: (g) thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 7 December 2023, the European Commission issued a proposal for a Regulation of the European Parliament and of the Council on the welfare of dogs and cats and their traceability and submitted the proposal to the Council of the European Union. The EDPS was not consulted on the Commission proposal.

text: 2. At its meeting on 26 June 2024, the Permanent Representatives Committee of the Council approved a compromise text, which included amendments that impact the protection of individuals’ rights and freedoms with regard to the processing of personal data.

text: 3. On 26 July 2024, the Council consulted the EDPS on the Council mandate for negotiations with the European Parliament regarding the proposal (‘the Proposal’) and requested that the EDPS submit its opinion no later than 15 November 2024.

text: 4. The objective of the Proposal is to lay down minimum requirements for: (a) the welfare of dogs and cats bred or kept in establishments, or placed on the Union market; (b) the traceability of dogs and cats placed on the Union market .

text: 5. The Proposal is accompanied by three Annexes .

text: 6. The present Opinion of the EDPS is issued in response to a consultation by the Council of the European Union of 26 July 2024, in accordance with

text: Article 57(1)

text: (g) EUDPR. The EDPS 4 observes that a reference to this consultation in a recital of the Proposal is missing. Therefore, the EDPS recommends inserting such reference in a recital of the Proposal.

text: 2. General remarks

text: 7. The EDPS recognizes the legitimate objective of the Proposal of ensuring a smooth functioning of the market of dogs and cats and a rational development of the sector, as well as a high level of animal welfare .

text: 8. To this end, the EDPS understands that it is necessary to establish minimum requirements for the welfare of dogs and cats bred and kept in establishments , as well as strengthened 9 10 requirements regarding the traceability of dogs and cats placed on the Union market .

text: 9. The EDPS notes that the Proposal would entail the processing of personal data by national competent authorities. Such processing may occur in the context of the notification and registration of the establishments referred to in Article 7 of the Proposal. Processing of personal data would also take place in the context of the identification and registration of dogs and cats referred to in Article 17 of the Proposal, which provides that the dogs and cats that are kept in establishments and all dogs and cats placed on the market shall be registered in a national database, referred to in Article 19 of the Proposal .

text: 10. The EDPS notes that the Proposal would also entail the processing of personal data by the Commission, for instance in the context of the Union pet travellers’ database referred to in the second subparagraph of

text: Article 21

text: (4a) of the Proposal .

text: 11. Against this background, the EDPS welcomes the reference to both the EUDPR and the GDPR in recital 44a of the Proposal.

text: 3. Categories of personal data

text: 3.1.Notification and registration

text: 12. The Proposal provides that operators of establishments shall notify the competent authorities of their activity, providing at least the information outlined in Article

text: 17 including their name and address , as well as any changes thereof .

text: 13. In accordance with the data minimisation principle , only personal data that is necessary for the purpose of notifying the activities of the establishments to the competent authorities may be processed. Therefore, the EDPS considers it important that the Proposal avoids open-ended terms such as ‘at least’ insofar as personal data are concerned. Instead, the Proposal should aim to specify, as exhaustively as possible, any categories of personal data to be processed in relation to this purpose.

text: 3.2.National database

text: 14. With regard to the registration of dogs and cats in the national database, Article 17(2) of the Proposal provides that for dogs and cats kept in establishments, the registration shall be made in the name of the operator of the establishment responsible for the dog or the cat. For natural persons placing a dog or a cat on the market, the registration shall be made in the name of that person. In case of transfer of ownership or responsibility, the natural or legal person placing the dog or cat on the market shall ensure that any change of ownership or responsibility is recorded in the database referred to in Article 19 of the Proposal.

text: 15. In order to ensure compliance with the principle of data minimisation , the EDPS recommends clarifying which categories of personal data shall be recorded in the database in case of registration and in case of transfer of ownership or responsibility. In particular, the EDPS recommends clarifying whether the personal data processed shall be limited to the names and, potentially, contact details of the persons concerned.

text: 3.3.Online system

text: 16. Article 17(6) of the Proposal, provides that ‘[t]he Commission shall ensure that an online system performing automated checks of the authenticity of the identification and registration of dogs and cats placed on the market, using the database referred to in

text: Article 19

text: , is publicly available and free of charge. The Commission may entrust the development, maintenance and operation of this system to an independent entity...’. Such system shall be compliant with data protection in accordance with the EUDPR and the GDPR .

text: 17. The EDPS understands that the online system pursuant to Article 17(6) of the Proposal will use the database referred to in Article 19(1) of the Proposal. As the database referred to in

text: Article 19(1)

text: involves the processing of personal data (e.g. name of natural persons placing a dog or a cat on the market or subsequent owner), the EDPS recommends clarifying, either in the Proposal or by way of an implementing act , which categories of personal data, if any, will be made available to the verifying person during the verification of the authenticity of the identification and registration of dogs and cats placed on the market.

text: 18. The EDPS underlines that any processing of personal data through the online system and the functionalities it will provide should be limited to the specific purpose of the online system, i.e. to enable the verification of the authenticity of the registration and identification of dogs and cats.

text: 3.4.Union pet travellers’ database

text: 19. The Proposal stipulates that the entry of dogs and cats into the Union under a noncommercial movement , shall be pre-notified by their owners into an online Union pet travellers’ database at least 5 working days before the crossing of the Union border. The owner shall pre-notify their identity and where relevant the identity of the authorised person travelling with the dog or cat, the identification number of the microchip of the dog or cat, its main destination in the Union, and where relevant the planned date and place of exit from the Union .

text: 20. The EDPS notes that the Proposal does not further specify precisely what ‘identity’ information owners would be expected to provide when pre-notifying. Since the Proposal does not empower the Commission to issue delegated or implementing acts in relation to

text: Article 21

text: a(4) of the Proposal, the EDPS recommends specifying which identity information should be provided by the owner or the authorized person traveling with the pet.

text: 3.5.List of approved breeding establishments

text: 21. In addition, the Proposal provides that competent authorities shall maintain a list of the approved breeding establishments and make it publicly available . The Proposal does not explicitly specify what information from the list of approved breeding establishments will be made public (e.g., whether it will include personal data such as the names and addresses of the operators of breeding establishments in case those operators are natural persons). To ensure legal clarity and foreseeability, the EDPS recommends clearly specifying which categories of data will be included in the publicly available list of breeding establishments, taking into consideration the principle of data minimisation and purpose limitation.

text: 4. Roles and responsibilities

text: 22. The EDPS welcomes the inclusion of a specific provision regarding data protection in the Proposal, which also aims to clarify which entities act as a controller when processing personal data that is collected under

text: Article 7

text: Article 7

text: a,

text: Article 19(1)

text: and Article 21(4) of the Proposal .

text: 23. The EDPS observes that no reference is made to the processing of personal data through the online system pursuant to Article 17(6) of the Proposal. The EDPS recommends specifying in

text: Article 20

text: a(1) of the Proposal that the Commission shall also be the controller with regard to the processing of personal data through this system, especially in case any personal data would be made available during the verification of the authenticity of the identification and registration of dogs and cats placed on the market .

text: 5. Data storage

text: 24. The EDPS welcomes that the Proposal provides for storage durations for personal data related to the notification and registration of establishments, the approval of the breeding establishments the registration of dogs and cats in the database, as well as the prenotification of dogs and cats entering into the Union . The EDPS also welcomes that the Proposal includes a justification of why these storage periods would be necessary to achieve the envisaged purposes .

text: 25. Recital 44d of the Proposal states that “[t]he retention period of personal data of the present and past owners for dogs or cats in national databases should be 5 years after the recording of the death of the dog or cat in those databases or 30 years from the date of the first registration of the dog or cat in those databases, in order to cover the life expectancy of dogs and cats, to maintain a robust traceability systems for all dogs and cats traded in the Union, and to allow for official controls on welfare problems such as abnormal death rates requiring data analysis, including after the death of the dog or cat” .

text: 26. The EDPS understands that the justification for the storage of personal data of owners for thirty years - in case the death of the dog or cat is not recorded - is based on the life expectancy of dogs and cats, as well as the potential need for posthumous analysis (e.g., welfare concerns, abnormal death rates). However, a thirty-year storage period may exceed the realistic period during which personal data is needed, particularly for dogs, considering that it significantly exceeds their life expectancy. Hence, the EDPS recommends reevaluating whether a shorter maximum storage period would be sufficient for the intended purposes.

text: 27. Finally, the EDPS recommends defining the maximum period for any personal data processed through the online system for verifying the authenticity of the identification and registration of dogs and cats, referred to in Article 17(6) of the Proposal.

text: 6. Implementing acts

text: 28. The Proposal provides for several implementing acts. For instance, the Commission shall adopt implementing acts laying down: (a) based on the content of the databases referred to in

text: Article 19(3)

text: (a), the exact information to be provided by natural and legal persons placing dogs or cats on the market, as proof of identification and registration of the dogs and cats in accordance with

text: Article 17(3)

text: (a), both in cases where the dogs and cats are offered through online platforms and by other means; (b) the following aspects of the system referred to in

text: Article 17(6)

text: : the key functionalities of the system; the technical, electronic and cryptographic requirements for the system .

text: 29. Moreover, with regard to the databases, referred to in Article 19 of the Proposal, the Commission shall, by means of implementing acts, lay down provisions concerning, among others, data protection pursuant to the requirements of

text: Regulation (EU) 2018/1725

text: and

text: Regulation (EU) 2016/679

text: 30. In this regard, the EDPS reminds the Commission of its obligation to consult the EDPS when preparing implementing acts that would have an impact on the protection of individuals' rights and freedoms with regard to the processing of personal data pursuant to Article 42(1) of the EUDPR.

text: 7. Conclusions

text: 31. In light of the above, the EDPS makes the following recommendations: (1) specify the categories of personal data to be processed and particularly: a. provide an exhaustive list of all categories of personal data processed for the notification and registration of establishments, as outlined in Article 7 of the Proposal; b. clarify whether the personal data processed for the registration of dogs and cats in the national database referred to in Article 19 of the Proposal, shall be limited to the names and, potentially, contact details of the persons concerned. c. clarify, either in the Proposal or by way of an implementing act, which categories of personal data, if any, will be made available to the verifying person during the verification of the authenticity of the identification and registration of dogs and cats d. specify which identity information should be pre-notified by the owner or the authorised person travelling with the pet into the online Union pet traveller’s database, as referred to in

text: Article 21

text: (4a) of the Proposal; e. clarify whether any personal data, and if so which categories, will be included in the publicly available list of breeding establishments, as outlined in

text: Article 7

text: a(3) of the Proposal. (2) explicitly designate, in

text: Article 20

text: a(1) of the Proposal, the Commission as controller responsible for processing personal data through the online system performing automated checks of the authenticity of the identification and registration of dogs and cats placed on the market, provided for in Article 17(6) of the Proposal. (3) re-evaluate the maximum storage period for the personal data of present and past owners in the database referred to in Article 19(1) of the Proposal. (4) define the maximum period for any personal data processed through the system verifying the authenticity of the identification and registration of dogs and cats, as specified in Article 17(6) of the Proposal. Brussels, 18 November 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 10


text: COM(2025) 407 final. COM(2025) 406 final. 1

text: OJ L 295, 21.11.2018, p. 39. 4 COM(2025) 406 final. COM(2025) 404 final. 6 Conclusion Proposal,

text: Article 1

text: . 4

text: Signing Proposal and Conclusion Proposal, Explanatory Memorandum, page 1 and 2. 8 OJ L 359, 16.12.2014, p. 1 to 29. 9 OJ L 24.10.2023. 10 EDPS Opinion 9/2023 Opinion 9/2023 on the Proposal for a Council Directive amending Directive

text: on administrative cooperation in the field of taxation. 11 Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 28.11.1995, p. 31). 12

text: Commission Decision 2010/625/EU of 19 October 2010

text: pursuant to Directive

text: of the European Parliament and of the Council on the adequate protection of personal data in Andorra (OJ L 277, 21.10.2010, p. 27). 5

text: REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the first review of the functioning of the adequacy decisions adopted pursuant to

text: Article 25(6) of Directive 95/46/EC

text: , COM(2024) 7 final, p. 7. 6

identifier: EDPS yttrande 22/2025

amnesord:
Finance
International Cooperation
Transfers of data

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion the Proposal on the signing and conclusion of the provisional application of the Amending Protocol between the EU and Andorra on the automatic exchange of financial account information to improve international tax compliance

serie: yttranden

text: Opinion 22/2025

type: rubrik

text: on the Proposal for a Council Decision on the signing and conclusion of the Amending Protocol to the Agreement between the European Union and the Principality of Andorra on the automatic exchange of financial account information to improve international tax compliance

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to (i) the Proposal for a Council Decision on the signing, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Andorra on the automatic exchange of financial account information to improve international tax compliance ; and to (ii) the Proposal for a Council Decision on the conclusion, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Andorra on the automatic exchange of financial account information to improve international tax compliance .

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposals that are relevant from a data protection perspective.

text: Executive Summary

text: The EDPS is consulted on the Proposals for Council Decisions to sign and conclude, on behalf of the Union, the Amending Protocol to the Agreement between the European Union and the Principality of Andorra on the automatic exchange of financial account information to improve international tax compliance.

text: The Amending Protocol aims to ensure that the automatic exchange of financial account information between EU Member States and Andorra is aligned with the updated Common Reporting Standard developed by the Organisation for Economic Co-operation and Development. In addition, the Amending Protocol aims to align the text of the Agreement with the new data protection framework (i.e. the GDPR for EU Members States and Qualified Law 29/2021 on the protection of personal data for Andorra). Finally, the Amending Protocol would ensure that the existing agreement between the European Union and Andorra remains aligned with Union legislation in the same field.

text: Any transfer of information containing personal data from the European Union to Andorra constitutes an international transfer of personal data in the meaning of Chapter V of the GDPR. The international transfer of personal data from Member States to Andorra does not require specific authorisations nor safeguards under Chapter V of Regulation 2016/679, by virtue of

text: Commission Decision 2010/625/EU

text: . The EDPS recommends including a reference to the EU adequacy decision concerning Andorra in a recital of both the Signing and the Conclusion Proposals.

text: Contents

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 17 July, the European Commission issued: - a Proposal for a Council Decision on the signing, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Andorra on the automatic exchange of financial account information to improve international tax compliance (‘the Signing Proposal’) ; - a Proposal for a Council Decision on the conclusion, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Andorra on the automatic exchange of financial account information to improve international tax compliance (‘the Conclusion Proposal’) .

text: 2. The objective of the Signing Proposal is to authorise the signing, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Andorra (Andorra) on the exchange of financial account information to improve international tax compliance (‘the Agreement’).

text: 3. The objective of the Conclusion Proposal is to approve the Amending Protocol .

text: 4. The Agreement provides the legal basis for the reciprocal automatic exchange of financial account information between the EU Member States and Andorra, in accordance with the Common Reporting Standard (CRS) developed by the Organisation for Economic Cooperation and Development (OECD).

text: 5. The Amending Protocol aims to (i) ensure that the automatic exchange of financial account information between EU Member States and Andorra is aligned with, and continues to take place in accordance with, the updated CRS from 1 January 2026; and to (ii) align the text of the Agreement with the new data protection framework (i.e.

text: Regulation (EU) 2016/679

text: on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General data protection regulation, GDPR) for EU Members States; and Qualified Law 29/2021 on the protection of personal data for Andorra ).

text: 6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 17 July 2025, pursuant to Article 42(1) of the EUDPR. The EDPS welcomes the reference to this consultation in Recital 6 of the Signing Proposal and in Recital 8 of the Conclusion Proposal.

text: 2. General remarks

text: 7. The EDPS welcomes the objectives pursued by the Proposals, notably to improve administrative cooperation in the area of direct taxation, and to improve international tax compliance. The EDPS acknowledges that the negotiated Amending Protocol ensures that the existing agreement between the European Union and Andorra remains aligned with Union legislation in the same field, notably

text: Council Directive 2014/107/EU

text: amending Directive

text: on administrative cooperation in the field of taxation (DAC 2) as amended by

text: Council Directive (EU) 2023/2226 of 17 October 2023

text: amending Directive

text: on administrative cooperation in the field of taxation (DAC8) . The EDPS has previously issued an opinion on DAC8 on 3 April 2023 .

text: 8. The EDPS regrets not having been consulted on the Council Decision authorising the opening of negotiations for the amendment of the Agreement in line with

text: Article 42(1)

text: EUDPR.

text: 9. Any transfer of information containing personal data from the European Union to Andorra constitutes an international transfer of personal data in the meaning of Chapter V of the GDPR.

text: 10. On 19 October 2010, the Commission adopted a decision recognising that the Principality of Andorra ensures an adequate level of protection for personal data transferred within the scope of the Directive

text: of the European Parliament and of the Council (Data 11 12 Protection Directive) from the European Union to Andorra (‘the Adequacy Decision’) .

text: 11. With the entry into application of the GDPR, the adequacy decisions adopted under the Data Protection Directive (including the one concerning Andorra) remained in force. Pursuant to

text: Article 97

text: GDPR, the Commission shall periodically review adequacy decisions, every four years, in order to determine whether the countries and territories that received an adequacy finding continue to provide an adequate level of protection for personal data.

text: 12. On 15 January 2024, the Commission confirmed that Andorra continues to provide an adequate level of protection for personal data transferred within the scope of the GDPR from the EU to Andorra . As a result, data transfers from the EU to Andorra can take place without additional requirements.

text: 13. The EDPS welcomes that the preamble of the Agreement and the Explanatory Memoranda of both Signing and Conclusion Proposals refer to the Adequacy Decision. As the Adequacy Decision would cover the transfer of personal data regulated by the Agreement, the EDPS recommends including a reference to it in a recital of both the Signing and the Conclusion Proposals.

text: 3. Conclusions

text: 14. In light of the above, the EDPS recommends to include a reference to

text: Commission Decision 2010/625/EU

text: in a recital of both the Signing and the Conclusion Proposals. Brussels, 20 August 2025 (e-signed) p.o. Leonardo CERVERA NAVAS

type: vagledning

utgivare: edps


text: OJ L 295, 21.11.2018, p. 39. 2 Recital 1 of the Proposal.

text: Recital 2 of the Proposal 4 Article 1 of the Proposal. 4

text: Directive

text: of the European Parliament and of the Council of 12 August 2013 on attacks against information systems and replacing Council Framework Decision 2005/222/JHA OJ L 218, 14.8.2013, p. 8–14.

text: Directive (EU) 2016/1148

text: of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union, OJ L 194/1, 19.7.2016 p. 1.

text: Regulation (EU) 2019/881

text: of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing

text: Regulation (EU) No 526/2013

text: (Cybersecurity Act), OJ L 151, 7.6.2019, p. 15. 5

text: EDPS Opinion 5/2021 on the Cybersecurity Strategy and the NIS 2.0 Directive, issued on 11 March 2021 9 COM(2022) 454 final, p. 8. 6

text: Article 3(1) of the Proposal provides that: ‘product with digital elements’ means any software or hardware product and its remote data processing solutions, including software or hardware components to be placed on the market separately. 11 Article 3(2) of the Proposal provides that: “This Regulation applies to products with digital elements whose intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network.” 12 For example: hardware and operating system of servers, software of application servers, software of web applications, etc. 13 For example: mobile phones, personal computers, operating systems, software applications etc 14 The EDPS recalls the impact of bugs found in encryption products used by service providers and users such as the ‘Heartbleed’, ‘POODLE’, as well as the ‘VeraCrypt’ case. 7

text: Regulation (EU) 2017/745

text: of the European Parliament and of the Council of 5 April 2017 on medical devices, amending Directive

text: Regulation (EC) No 178/2002

text: and

text: Regulation (EC) No 1223/2009

text: and repealing Council Directives

text: and

text: , JO L 117 du 5.5.2017, p. 1–175. 16 Directive

text: of the European Parliament and of the Council of 16 April 2014 on the harmonisation of the laws of the Member States relating to the making available on the market of radio equipment and repealing Directive

text: Text with EEA relevance, OJ L 153, 22.5.2014, p. 62–106. 8

text: Regulation (EU) 2019/881

text: Regulation (EU) No 526/2013

text: (Cybersecurity Act) (OJ L 151, 7.6.2019, p. 15–69). 18

text: Article 6(2)

text: (c) of the Proposal. 9

identifier: EDPS yttrande 23/2022

amnesord:
Internal Market
Cybersecurity

title: Horizontal cybersecurity requirements for products with digital elements

text: 9 November 2022 Opinion 23/2022 on the Proposal for a Regulation of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements and amending

text: Regulation (EU) 2019/1020

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Commission’s Proposal for a Regulation of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements and amending

text: Regulation (EU) 2019/1020

text: .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the draft Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: Regulation (EU) 2019/1020

text: (‘the Proposal’).

text: The EDPS recalls that

text: Article 5(1)

text: (f) GDPR has established security as one of the main principles relating to the processing of personal data.

text: Article 32

text: GDPR further defines this obligation, applicable to both controllers and processors, to ensure an appropriate level of security. Therefore, the EDPS welcomes that security and data minimization principles are already embedded in the essential cybersecurity requirements enumerated in the Annex I of the Proposal. In addition, the EDPS strongly recommends including the data protection by design and by default principle in the essential cybersecurity requirements of products with digital elements.

text: Recital 17 provides for very important governance provisions that are not reflected in the operational part of the Proposal. Therefore, the EDPS recommends specifying in the operational part of the Proposal all the aspects related to the creation of synergies on both standardisation and certification on cybersecurity as well as synergies between this Proposal and the Union data protection law in the area of market surveillance and enforcement. Furthermore, the EDPS considers it necessary to clarify that the Proposal does not seek to affect the application of existing EU laws governing the processing of personal data, including the tasks and powers of the independent supervisory authorities competent to monitor compliance with those instruments.

text: The EDPS welcomes the fact that this provision acknowledges that the processing of personal data is a critical and sensitive function and might as such require the corresponding critical products with digital elements to obtain a European cybersecurity certificate under a European cybersecurity certification scheme. At the same time, the EDPS recommends clarifying in a recital of the Proposal that obtaining a European cybersecurity certification under the Proposal does not guarantee compliance with the GDPR.

text: Finally, the EDPS welcomes the proposed penalties, which are similar to those of the GDPR for a breach

text: Article 32

text: GDPR on the security of processing, with a maximum fine of 2.5% of global annual turnover. As a result, the Proposal could serve as yet another form of protection for individuals that reside within EU Member States, in conjunction with the provisions of the GDPR.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the EU institutions, bodies, offices and agencies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 15 September 2022, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements and amending

text: Regulation (EU) 2019/1020

text: (‘the Proposal’).

text: 2. The objective of the Proposal is to improve the functioning of the internal market by laying down a uniform legal framework for essential cybersecurity requirements for placing products with digital elements on the Union market . In particular, the Proposal aims to set the boundary conditions for the development of secure products with digital elements by ensuring that hardware and software products are placed on the market with fewer vulnerabilities and that manufactures take security seriously throughout a product’s life cycle. It also aims to create conditions allowing users to take cybersecurity into account when selecting and using products with digital elements .

text: 3. To this end, the Proposal lays down : • rules for the placing on the market of products with digital elements to ensure the cybersecurity of such products; • essential requirements for the design, development and production of products with digital elements, and obligations for economic operators in relation to these products with respect to cybersecurity; • essential requirements for the vulnerability handling processes put in place by manufacturers to ensure the cybersecurity of products with digital elements during the whole life cycle, and obligations for economic operators in relation to these processes; • rules on market surveillance and enforcement of the above-mentioned rules and requirements.

text: 4. The EU framework comprises several pieces of horizontal legislation that cover certain aspects linked to cybersecurity from different angles (products, services, crisis management, and crimes). In 2013, the Directive on attacks against information systems , harmonising criminalisation and penalties for a number of offences directed against information systems came into force. In August 2016,

text: Directive (EU) 2016/1148

text: on security of network and information systems (NIS Directive) entered into force as the first piece of EU-wide legislation on cybersecurity. Its revision, resulting in the NIS2 Directive, raises the EU common level of ambition regarding the cybersecurity of ICT services. In 2019, the EU Cybersecurity Act entered into force, aiming to enhance the security of ICT products, ICT services and ICT processes by introducing a voluntary European cybersecurity certification framework.

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 15 September 2022, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 71 of the Proposal. In this regard, the EDPS also positively notes that he was previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General comments

text: 6. The EDPS welcomes the Proposal and fully supports its general objective to improve the functioning of the internal market by laying down a uniform legal framework for essential cybersecurity requirements for placing products with digital elements on the Union market.

text: 7. The Proposal mandates that products with digital elements will only be made available on the market if they meet specific essential cybersecurity requirements for the design, development and production of these products. Moreover, the Proposal establishes obligations for economic operators in relation to these products with respect to cybersecurity. For example, it requires manufacturers to factor cybersecurity in the design and development of the products with digital elements.

text: 8. Whereas the NIS2 Directive included in its scope of application operators of essential services and digital services providers in order to establish a high common level of cybersecurity of their ICT systems, the Proposal at hand would introduce common cybersecurity rules for manufacturers and developers of products with digital elements, covering both hardware and software. The EDPS notes that such products can be embedded in the ICT systems of digital service providers, acting as entities under NIS2 Directive and can be used by individuals that use digital services, such as mobile phones, personal computers, operating systems and software applications. In this context, the EDPS recalls his Opinion on the Cybersecurity Strategy and the NIS 2.0 Directive .

text: 9. Pursuant to the Explanatory Memorandum the horizontal cybersecurity requirements: • would contribute to the security of personal data by protecting the confidentiality, integrity and availability of information in products with digital elements. • will facilitate compliance with the requirement of security of processing of personal data under the GDPR. • would enhance the transparency and information to users, including those that might be less equipped with cybersecurity skills. Users would also be better informed about the risks, capabilities and limitations of the products with digital elements, which would place them in a better position to take the necessary preventive and mitigating measures to reduce the residual risks.

text: 10. The EDPS recalls

text: Article 5(1)

text: Article 32

text: 11. The cybersecurity of products with digital elements that are used by individuals is of utmost importance to protect their rights and freedoms, in particular the right to privacy, and to enhance their trust in digital services. Without such requirements, the individuals can fall victims of cybersecurity attacks aiming to have access to their personal data and confidential communications.

text: 12. This is why the EDPS considers that laying down a uniform legal framework for essential cybersecurity requirements for placing products with digital elements is very important for safeguarding fundamental rights and freedoms, including the rights to privacy and to the protection of personal data, and strongly supports the Proposal for a comprehensive package of relevant effective technical and organisational measures.

text: 13. In addition, the EDPS recalls that

text: Article 25

text: GDPR lays down data protection by design and by default principle, which aims to build data protection and privacy into the design of processing operations and information systems, even before the actual processing takes place, and to ensure that by default, only personal data which are necessary for each specific purpose of the processing are processed. In practice, this principle requires, amongst others, the use of privacy enhancing technologies such as encryption and pseudonymization. The GDPR provisions make clear that security and data protection by design and by default are essential for compliance with EU data protection law.

text: 14. Concerning the products with digital elements, the role of manufacturers is typically limited to supplying the product to individuals. The GDPR does not impose requirements on manufacturers directly, but only "encourages" them in recital 78 GDPR "to take into account the right to data protection when developing and designing such products, services and applications and, with due regard to the state of the art, to make sure that controllers and processors are able to fulfil their data protection obligations". Nevertheless, it is clear that users will ultimately decide against a product if using it means that they, as controllers, will be unable to adhere to data protection requirements. This creates an indirect "requirement" for manufacturers to design their products in such a way that users will be able to adhere to the requirements of the GDPR when processing data in the future.

text: 15. Therefore, despite the fact that the GDPR does not address directly the manufacturers of products with digital elements, but only the controllers when such products are embedded in their ICT systems, it is essential that the principle of data protection by design and by default is applied also to products. On the one hand, it would facilitate the compliance of controllers with the principle of data protection by design and by default and on the other hand, it would ensure that personal data of individuals using such products in order to access digital services is duly protected. Therefore, the EDPS strongly recommends including the data protection by design and by default principle in the essential cybersecurity requirements of products with digital elements.

text: 3. Scope of the Proposal

text: 16. The wide scope of the Proposal covers all products with digital elements, and specifically “means any software or hardware product and its remote data processing solutions, including software or hardware components to be placed on the market separately” … “whose intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network” . This includes both products that can be connected physically via hardware interfaces and products that are connected logically, such as via network sockets, pipes, files, application programming interfaces and any other type of software interface.

text: 17. The EDPS understands that products with digital elements under the scope of the Proposal 12 13 can be embedded in the ICT systems of controllers and can be used by individuals in order to access personal data processing services provided by controllers.

text: 18. In this context, the EDPS recommends explaining in the preamble to the Proposal the importance of products with digital elements that perform cryptographic operations including encryption at rest and in transit and pseudonymisation that are necessary for effective information security, cybersecurity, data protection and privacy. Furthermore, in line with recital 26 of the Proposal, he also recommends adding in Annex II tangible and intangible products with digital elements that perform cryptographic operations.

text: 19. The EDPS notes that certain digital products and services subject to sectoral legislation fall outside of the Proposal’s scope. These include software-as-a-service, medical devices, in vitro diagnostic medical devices, motor vehicles, products used exclusively for national security or military purposes or designed specifically to process classified information.

text: 20. Nevertheless, security related provisions of some sectoral legislations excluded from the scope of the Proposal are not always as detailed and concrete as the ones in the Proposal itself. This is the case of

text: Regulation (EU) 2017/745

text: that sets up general safety measures for medical devices, but does not require the devices to be delivered without any known vulnerabilities or to encrypt relevant data at rest or in transit according to state of the art mechanisms. Moreover, the same Regulation includes the obligation to ’establish, implement, document and maintain a risk management system’. However, it is unclear if such system will also cover cybersecurity and data protection related aspects. In consequence, the EDPS recommends deleting

text: Regulation (EU) 2017/745

text: from the list of the legislations excluded from the application of the Proposal.

text: 21. The EDPS also notes that Recital 15 indicates that the essential requirements laid down by the Proposal ‘include all the elements of the essential requirements referred to in

text: Article 3(3)

text: , points (d), (e) and (f) of Directive

text: on the marketing of radio equipment . As point (e) refers to personal data and privacy, the EDPS recommends clarifying expressly in the Proposal what are the elements of the essential requirements referred to by

text: Article 3(3)

text: (e) of Directive

text: on personal data and privacy.

text: 4. Relationship to existing Union legislation on personal data protection

text: 22. The EDPS observes that Recital 17 of the Proposal clarifies that it is “without prejudice” to the GDPR and indicates that: • synergies on both standardisation and certification on cybersecurity aspects should be considered through the cooperation between the Commission, the European Standardisation Organisations, the European Union Agency for Cybersecurity (ENISA), the European Data Protection Board (EDPB) established by the GDPR , and the national data protection supervisory authorities; • synergies between this Proposal and the Union data protection law should also be created in the area of market surveillance and enforcement. To this end, national market surveillance authorities appointed under this Proposal should cooperate with authorities supervising Union data protection law. The latter should also have access to information relevant for accomplishing their tasks.

text: 23. The EDPS takes note that Recital 17 provides for very important governance provisions that are not reflected in the operative part of the Proposal. In addition, the way these ‘synergies’ could be created is not detailed. The EDPS is concerned that such synergies are unlikely to occur in practice in the absence of clear corresponding provisions,Therefore, the EDPS recommends specifying in the operational part of the Proposal all the aspects related to the creation of synergies on both standardisation and certification on cybersecurity as well as synergies between this Proposal and the Union data protection law in the area of market surveillance and enforcement (such as structured cooperation among the relevant bodies, provisions mandating information sharing, including personal data, in specific cases, etc.).

text: 24. Furthermore, the EDPS considers it necessary to explicitly clarify that the Proposal does not seek to affect the application of existing EU laws governing the processing of personal data, including the tasks and powers of the independent supervisory authorities competent to monitor compliance with those instruments.

text: 5. Critical digital products for the processing of personal data and European cybersecurity scheme

text: 25. Recital 39 states that the Proposal aims to create synergies with

text: Regulation (EU) 2019/881

text: on the EU Cybersecurity Act that establishes a voluntary European cybersecurity certification framework for ICT products, processes and services.

text: 26. Furthermore, in line with

text: Article 6(5)

text: (b) of the Proposal, the Commission is empowered to adopt delegated acts in accordance to specify categories of highly critical products with digital elements for which the manufacturers should be required to obtain a European cybersecurity certificate under a European cybersecurity certification scheme. When determining such categories of highly critical products with digital elements, the Commission should take into account, inter alia, the intended use of performing critical or sensitive functions, such as processing of personal data .

text: 27. In this regard, the EDPS welcomes the fact that the Proposal acknowledges that the processing of personal data is a critical and sensitive function and might as such require the corresponding critical products with digital elements to obtain a European cybersecurity certificate under a European cybersecurity certification scheme. At the same time, the EDPS recommends clarifying in in the preamble that obtaining a European cybersecurity certification under the Proposal does not guarantee compliance with the GDPR.

text: 6. Penalties applicable to infringements by economic operators

text: 28. In line with the Proposal, the Member States shall establish penalties applicable to infringements by economic operators, with limits set out as follows: • Non-compliance with essential requirements set out in Annex I and obligations for manufactures shall be subject to administrative fines of up to €15 million or up to 2.5% of its global revenue, whichever is higher. • Non-compliance with other obligations under the CRA shall be subject to administrative fines of up to €10 million or up to 2% of global revenue, whichever is higher.

text: 29. In case incorrect, incomplete or misleading information is supplied to notified bodies and market surveillance authorities in reply to a request, the offender shall be subjected to administrative fines of up to €5 million or up to 1% of global revenue, whichever is higher.

text: 30. The EDPS welcomes the proposed penalties, which are similar to those of the GDPR for a breach

text: Article 32

text: 7. Conclusions

text: 31. In light of the above, the EDPS makes the following recommendations: (1) to include the data protection by design and by default principle in the essential cybersecurity requirements of products with digital elements; (2) to explain in the preamble the importance of products with digital elements that perform cryptographic operations, including encryption at rest and in transit and pseudonymisation that are necessary for effective information security, cybersecurity, data protection and privacy; (3) to add in Annex II tangible and intangible products with digital elements that perform cryptographic operations; (4) to delete

text: Regulation (EU) 2017/745

text: from the list of the legislations excluded from the application of the Proposal; (5) to clarify expressly in the Proposal what are the elements of the essential requirements referred to by

text: Article 3(3)

text: (e) of Directive

text: on personal data and privacy; (6) to specify in the operational part of the Proposal the practical aspects related to the creation of synergies on both standardisation and certification on cybersecurity as well as synergies between this Proposal and the Union data protection law in the area of market surveillance and enforcement; (7) to clarify that the Proposal does not seek to affect the application of existing EU laws governing the processing of personal data, including the tasks and powers of the independent supervisory authorities competent to monitor compliance with those instruments; (8) to add relevant definitions of ‘free software’, ‘open source software’ and ‘free and open source software’; 10 (9) to clarify in recital of the Proposal that obtaining a European cybersecurity certification under the Proposal does not guarantee compliance with the GDPR. Brussels, 9 November 2022 (e-signed) Wojciech Rafał WIEWIÓROWSKI 11


identifier: EDPS yttrande 23/2023

title: EDPS Opinion 23/2023 on the Proposal for a Decision on the signing and the conclusion, of the Protocol on the implementation of the Fisheries Partnership Agreement between the European Community and Rep. of Kiribati

text:   4

text: Data Protection safeguards

text: International transfers of personal data


text: COM(2024) 671 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2024) 671 final. 4 Explanatory Memorandum, p. 1; recitals 3 and 4 of the Proposal. Explanatory Memorandum, p. 2. 6 COM(2024) 670 final. 7 Explanatory Memorandum, p. 2; recital 3 of the Proposal. 8 Explanatory Memorandum, p. 2. 4

text: COM(2024) 671 final, Explanatory Memorandum, p. 2. 10 Idem. 11 Idem. 12 COM(2022) 548 final. 13

text: Council Directive 2004/82/EC of 29 April 2004

text: on the obligation of carriers to communicate passenger data, OJ L 261, 6.8.2004, p. 24–27. 5

text: EDPS Opinion 6/2023 on the Proposals for Regulations on the collection and transfer of advance passenger information (API), issued on 8 February 2023. 15

text: Regulation (EU) 2024/1183

text: of the European Parliament and of the Council of 11 April 2024 amending

text: Regulation (EU) No 910/2014

text: as regards establishing the European Digital Identity Framework, OJ L, 2024/1183, 30.4.2024.

text: Regulation (EU) No 910/2014

text: of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive

text: , OJ L 257, 28.8.2014, p. 73–114, as amended, current consolidated text here. 17 Proposal for a Council Regulation on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement, COM/2024/316 final. 18 EDPS Opinion 21/2024 on the Proposal for a Council Regulation on strengthening the security of identity cards, issued on 13 September 2024. 7

identifier: EDPS yttrande 23/2024

title: EDPS Opinion 23/2024 on the Proposal for a Regulation on the issuance of and technical standards for digital travel credentials based on identity cards

text: 4 December 2024

text: Opinion 23/2024

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Council Regulation on the issuance of and technical standards for digital travel credentials based on identity cards . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: The objective of the Proposal is to make it easier for Union citizens to exercise their right to free movement, by enabling them to use digital travel credentials based on identity cards that would allow them to pass through border controls more quickly and more smoothly. For this purpose, the Proposal is accompanied by another Proposal for a regulation of the European Parliament and of the Council establishing an application for the electronic submission of travel data (“EU Digital Travel application”) and amending Regulations

text: (EU) 2016/399

text: and

text: (EU) 2018/1726

text: of the European Parliament and of the Council and

text: Council Regulation (EC) No 2252/2004

text: , as regards the use of digital travel credentials. That Proposal will be subject to a separate Opinion.

text: The present Opinion is limited to the rules for issuing digital travel credentials based on identity cards. The EDPS considers that the Proposal does not raise any specific concerns from a data protection perspective and makes one recommendation to better clarify the relationship between the digital travel credentials and the data categories stored in the European Digital Identity Wallet, in particular person identification data.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 11 October 2024, the European Commission issued the Proposal for a Council Regulation on the issuance of and technical standards for digital travel credentials based on identity cards (‘the Proposal’).

text: 2. The objective of the Proposal is to make it easier for Union citizens to exercise their right to free movement, by enabling them to use digital travel credentials based on identity cards that would allow them to pass through border controls more quickly and more smoothly .

text: 3. For this purpose, this initiative goes side-by-side with a Proposal for a regulation of the European Parliament and of the Council establishing an application for the electronic submission of travel data (“EU Digital Travel application”) and amending Regulations

text: (EU) 2016/399

text: and

text: (EU) 2018/1726

text: Council Regulation (EC) No 2252/2004

text: , as regards the use of digital travel credentials . Among other things, that Proposal introduces a digital travel credential based on passports and sets out specifications for the ‘EU Digital Travel application’, a mobile phone application for the issuance and submission of digital travel credentials for advance check ahead of travel. Adopting both Proposals at the same time ensures consistency in the developments for identity cards and passports, taking into account that both types of travel documents can be used to exercise the right to free movement . As a result, Union citizens holding an identity card should be able to use the ‘EU Digital Travel application’ to create and submit identity card-based digital travel credentials just like when using passports .

text: 4. In addition, according to the explanatory memorandum to the Proposal, digital travel credentials could also be used to facilitate other aspects of free movement, such as registering with national authorities when taking up residence in another Member State, which has the potential to reduce administrative burden. At a later stage, it may also become possible to exercise free movement based on a digital travel credential only, that is, without the need for a physical identity card or passport.

text: 5. Lastly, an authentic digital travel credential could facilitate access to electronic identification schemes, and to services that require reliable identification. This has the potential to simplify the daily life of Union citizens, including those that reside in a Member State other than that of which they are a national . The Proposal would lay down a uniform standard for digital travel credentials, avoiding fragmentation, ensuring compliance with Union values, and guaranteeing that all Union citizens can benefit from digital travel credentials . Furthermore, the Proposal pursues the objective of global interoperability, by basing the technical specifications on the ICAO’s digital travel credential standard .

text: 6. The 2023 Commission work programme envisaged a Proposal on digitalisation of travel documents and facilitation of travel in Chapter 3.5 ‘Promoting our European Way of Life’.

text: 7. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 11 October 2024, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 22 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 8. The EDPS recalls that Member States have developed and deployed automated border control gates based on biometric passports for the last 20 years. When it came to the technical implementation of the automatic border control gates, the data protection supervisory authorities were particularly instrumental in ensuring that the risks typically associated with such systems, such as misuse of biometric data, long-term data storage and tracking, discriminatory refusal of entry based solely on an inaccuracy in biometric matching, did not materialise in the EU. The EDPS is of the opinion that efficiency in border controls, enhanced security and a more seamless travel experiences when crossing a border are without a doubt advantages of such systems. However, remaining algorithmic biases or other forms of inaccuracies still require human intervention by a border guard, just as travellers with disabilities, technological barriers, or language limitations denying them access to or use of automated systems require continued access to conventional border control checks by border guards.

text: 9. In the same vein, the EDPS recalls that the requirement for air carriers to provide Advance Passenger Information (API) prior to the landing of an aircraft has also been established 20 years ago . In this regard, the EDPS recalls that he has issued an Opinion on two Proposals for Regulations on the collection and transfer of advance passenger information (API), where he has focused in particular on the processing of API data from EU internal flights .

text: 10. The EDPS takes note that the introduction of digital travel credentials based on identity cards, as provided for in the Proposal, would have the potential to support both aforementioned business processes as well as a direct submission of the traveller’s data to border authorities based for advance checking. At the same time, the Proposal focuses on the issuance and technical standards of the digital travel credentials based on identity cards and not on their use case scenarios. Therefore, the focus of this opinion will be equally narrow.

text: 11. The EDPS underlines that the separation of travel credentials from a physical identification document puts data security at the forefront. In this context, the security of the technical solution is crucial where identity data is processed in a digital format and on a mobile device. For this reason,

text: Regulation (EU) 2024/1183

text: points out in recital 15 that technologies used for the European Digital Identity Wallets should be developed aiming towards the highest level of, among others, security and privacy.

text: 12. Consequently, the EDPS stresses that, even if digital travel credentials are not stored in the European Digital Identity Wallet, they equally need to be protected according to the highest standards against any unauthorised access, altercation, or loss of data. The same applies to the process of their issuance and access.

text: 13. Other than that, the Proposal does not raise any specific concerns from a data protection perspective, as the following specific comments demonstrate.

text: 3. Voluntary nature of the issuance of digital travel credentials based on identity cards

text: 14. According to Article 2 of the Proposal, digital travel credentials based on identity cards are issued upon request from the person having applied for an identity card, or from the holder of an existing identity card, if applicable.

text: 15. The EDPS welcomes that issuance of the credentials is voluntary on the side of the user. In this regard, the EDPS calls on Union and Member State bodies that would process the digital travel credentials to ensure that the possible choice not to request or use the credentials would not entail in practice any discriminatory or other negative consequences for the individual. 6

text: 4. Relationship with the European Digital Identity Wallet

text: Article 2(4)

text: (b) of the Proposal requires that the digital travel credentials based on identity cards be in a format that enables their storage in European Digital Identity Wallets issued in accordance with

text: Regulation (EU) No 910/2014

text: 17. The EDPS notes that according to

text: Article 2(4)

text: (d) of the Proposal, the digital travel credentials based on identity cards will contain the same personal data, including facial image and excluding the fingerprints, as the identity card based on which they are issued or created. Conversely, according to

text: Article 3

text: , point 3 of

text: Regulation (EU) No 910/2014

text: , ‘person identification data’ that can be stored in the European Digital Identity Wallet means a set of data that is issued in accordance with Union or national law and that enables the establishment of the identity of a natural or legal person, or of a natural person representing another natural person or a legal person.

text: 18. However, the Proposal lacks further details about the relationship of the digital travel credentials with the European Digital Identity Wallet and, in particular, with the ‘person identification data’ stored in the latter. For instance, one may assume that digital travel credentials would be stored in the form of attestations of attributes rather than person identification data. Therefore, the EDPS recommends further clarifying the relationship between the digital travel credentials and the European Digital Identity Wallet, e.g. by adding an explanatory recital to the Proposal.

text: 5. Specific rules on data protection

text: 19. The EDPS notes that, in addition to the general reference in recital 15 of the Proposal to

text: Regulation (EU) 2016/679

text: (GDPR) with regard to the processing of personal data in the context of the application of the future Regulation,

text: Article 4

text: thereof, under the headline ‘protection of personal data’, refers to Article 11 of a proposed Council Regulation on strengthening the security of identity cards of Union citizens . The latter legal act contains attributions of controllership and responsibility, clarifications on supervisory rights of the supervisory authorities under the GDPR, and processing limitations for machine-readable data and biometric data. The EDPS has already issued an Opinion on that legislative Proposal and its predecessor, so he considers that no further comments are warranted.

text: 20. In addition, according to

text: Article 2(4)

text: subparagraph 2 of the Proposal, the digital travel credentials issued or created pursuant to this Article should not include the fingerprints of the holder. The EDPS welcomes this important restriction of the biometric data included in the credentials, which is in line with the principles of data minimisation and proportionality.

text: 6. Conclusion

text: 21. In light of the above, the EDPS makes the following recommendation: - to clarify the relationship between the digital travel credentials and the European Digital Identity Wallet, and in particular with the ‘person identification data’ stored in the Wallet. Brussels, 4 December 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8