text: OJ L 295, 21.11.2018, p. 39. 2 COM(2024) 237 final. 3 COM(2024) 236 final. 4 Article 1 of the Signing Proposal. Article 2 of the Signing Proposal. 6 Article 1 of the Conclusion Proposal. 7 Explanatory memorandum of each proposal, page 1. 4

text: Appendix 6. 9

text: Council Regulation (EC) No 2027/2006 of 19 December 2006

text: on the conclusion of the Fisheries partnership agreement between the European Community and the Republic of Cape Verde, OJ L 414, 30.12.2006, p. 1–2 (ES, CS, DA, DE, ET, EL, EN, FR, IT, LV, LT, HU, NL, PL, PT, SK, SL, FI, SV) 10 European Data Protection Board (EDPB) Guidelines 2/2020 on

text: articles 46 (2)

text: (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, issued on 15 December 2020. The same guidance also clarifies the safeguards required to be put in place by provisions to be inserted into administrative arrangements between public bodies, subject to authorisation from the competent supervisory authority. 5

text: Chapter VII ‘Infringements’ 6

identifier: EDPS yttrande 17/2024

title: EDPS Opinion 17/2024 on the signing, provisional application and conclusion of the Protocol (2024-2029) implementing the Fisheries Partnership Agreement between the European Community and the Republic of Cabo Verde

text: 5 July 2024

text: Opinion 17/2024

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to (i) the Proposal for a Council Decision on the signing, on behalf of the European Union, and provisional application of the Protocol (2024-2029) implementing the Fisheries Partnership Agreement between the European Community on the one hand, and the Republic of Cabo Verde on the other and (ii) the Proposal for a Council Decision on the conclusion, on behalf of the Union, of the Protocol (2024-2029) implementing the Fisheries Partnership Agreement between the European Community, on the one hand, and the Republic of Cabo Verde, on the other. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposals that are relevant from a data protection perspective.

text: Executive Summary

text: The EDPS is consulted on the Commission proposals to sign, provisionally apply and conclude a Protocol on the implementation of the Fisheries Partnership Agreement between the EU and the Republic of Cabo Verde.

text: The EDPS welcomes the inclusion of an Article dedicated to data protection, which is supplemented by an appendix to the Annex to the Protocol, expanding the data protection provisions and detailing the conditions and safeguards relating to the processing of personal data.

text: For the purpose of transferring data, the EDPS invites nevertheless the Commission to specify what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies.

text: The EDPS also recommends adding a provision that would refer to the specific safeguards to be provided in case of processing of personal data relating to criminal convictions and offences.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 6 June 2024, the European Commission issued:  a proposal for a Council Decision on the signing, on behalf of the European Union, and provisional application of the Protocol (2024-2029) implementing the Fisheries Partnership Agreement between the European Community and the Republic of Cabo Verde (‘the Signing Proposal’) ; and  a proposal for a Council Decision on the conclusion, on behalf of the Union, of the Protocol (2024-2029) implementing the Fisheries Partnership Agreement between the European Community and the Republic of Cabo Verde (‘the Conclusion Proposal’) .

text: 2. The objective of the Signing Proposal is (i) to authorize the signing, on behalf of the Union, of the new Protocol implementing the Fisheries Partnership Agreement between the European Community and the Republic of Cabo Verde (‘the Protocol’) and (ii) to provide for the provisional application of the Protocol .

text: 3. The objective of the Conclusion Proposal is to approve the Protocol .

text: 4. The purpose of the new Protocol is to grant fishing opportunities to Union vessels in the fishing zones in Cabo Verde’s waters, in accordance with scientific advice and International Commission for the Conservation of Atlantic Tunas (ICCAT) recommendations. An additional aim is to strengthen the cooperation between the Union and Cabo Verde, thereby implementing the partnership framework to develop a sustainable fisheries policy and sound exploitation of fishery resources in Cabo Verde’s waters, in the interests of both parties .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 6 June 2024, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 10 of the Signing Proposal and in Recital 8 of the Conclusion Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 6. The EDPS welcomes the inclusion in the Protocol of a specific article on data protection:

text: Article 14

text: provides that the data shall be processed by the competent authorities solely for the purposes of implementing the Agreement, and in particular for the purposes of fisheries management, monitoring, control and surveillance. It also specifies that personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject.

text: 7. Moreover,

text: Article 14

text: is supplemented by an appendix to the Annex to the Protocol, which develops the provisions on the processing of personal data. The EDPS notes with satisfaction that these provisions lay down the definitions of ‘personal data’ and ‘processing’, the categories of personal data to be processed, the designation of authorities responsible for the processing of data, the principles relating to processing of personal data including the retention periods, the modalities of onward transfers, the rights of the persons concerned, the right to redress and the designation of independent supervisory authorities.

text: 3. International transfers of personal data

text: 8. The EDPS recalls that in absence of an adequacy decision, transfers of personal data to a third country may be based on a legally binding and enforceable instrument between public authorities or bodies. In such a case, such instrument should provide appropriate safeguards and ensure that enforceable data subject rights and effective legal remedies for data subjects are available.

text: 9. The EDPS notes that Article 14(4) of the Protocol foresees that further safeguards and legal remedies in relation to personal data and data subjects’ rights may be established by the Joint Committee provided for in Article 9 of the Agreement between the European Community and the Republic of Cape Verde. In this respect, the EDPS recommends the Joint Committee to specify in par. 2.7 of Appendix 6 what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies .

text: 4. Personal data relating to criminal convictions and offences

text: 10. The EDPS notes that the annex to the Protocol entitled ‘Conditions governing fishing activities by Union Vessels in Cabo Verde’s fishing zone’ includes a chapter on infringements committed by a Union vessel holding a fishing authorization. The EDPS recalls that data processed to prevent and fight against illegal fishing may constitute personal data relating to criminal convictions and offences, in which case appropriate safeguards for the rights and freedoms of data subjects should be provided, in accordance with

text: Article 10

text: GDPR and/or

text: Article 11

text: EUDPR. The EDPS recommends the Joint Committee to also add in Appendix 6 to the Annex a provision that would mention these specific safeguards.

text: 5. Conclusions

text: 11. In light of the above, the EDPS makes the following recommendations: (1) to make use of the Joint Committee to specify in par. 2.7 of Appendix 6 what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, (2) to make also use of the Joint Committee to add in Appendix 6 to the Annex a provision that would specify the safeguards to be provided in the context of the processing of data relating to criminal convictions and offences. Brussels,


text: OJ L 295, 21.11.2018, p. 39. 2 COM(2025) 369 final. 3 COM(2025) 370 final. 4 Article 1 of the Conclusion Proposal. Recital 5 of the Signing Proposal, 4

text: Council Regulation (EC) No 894/2007 of 23 July 2007

text: on the conclusion of a Fisheries Partnership Agreement between the Democratic Republic of São Tomé and Príncipe and the European Community OJ L 205, 7.8.2007, p. 35–58.

identifier: EDPS yttrande 17/2025

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion on the signing and conclusion of the provisional application and conclusion of Protocol (2025-2029) on the implementation of the Fisheries Partnership Agreement of the Democratic Republic of São Tomé and Príncipe and the European Community

serie: yttranden

text: Opinion 17/2025

type: rubrik

text: on the signing, provisional application and conclusion of the Protocol (2025–2029) on the implementation of the Fisheries Partnership Agreement between the Democratic Republic of São Tomé and Príncipe and the European Community

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to (i) the Proposal for a Council Decision on the signing, on behalf of the Union, and provisional application of the Protocol (2025–2029) on the implementation of the Fisheries Partnership Agreement between the Democratic Republic of São Tomé and Príncipe and the European Community and (ii) the Proposal for a Council Decision on the conclusion, on behalf of the Union, of the Protocol (2025-2029) on the implementation of the Fisheries Partnership Agreement between Democratic Republic of São Tomé and Príncipe and the European Community. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: The EDPS is consulted on the Commission proposal to sign, provisionally apply and conclude the new Protocol on the implementation of the Fisheries Partnership Agreement between the Democratic Republic of São Tomé and Príncipe and the European Community.

text: The EDPS welcomes the inclusion of an Article dedicated to data protection, which is supplemented by an appendix to the Annex to the Protocol, expanding the data protection provisions and detailing the conditions and safeguards relating to the processing of personal data.

text: For the purpose of transferring data, the EDPS invites nevertheless the Commission to specify what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on

text: Articles 46(2)

text: The EDPS also recommends adding a provision that would refer to the specific safeguards to be provided in case of processing of personal data relating to criminal convictions and offences.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 9 July 2025, the European Commission issued:  a Proposal for a Council Decision on the signing, on behalf of the Union, and provisional application of the Protocol (2025–2029) on the implementation of the Fisheries Partnership Agreement between the Democratic Republic of São Tomé and Príncipe and the European Community (‘the Signing Proposal’) .  a Proposal for a Council Decision on the conclusion, on behalf of the Union, of the provisional application of the Protocol (2025-2029) on the implementation of the Fisheries Partnership Agreement between the Democratic Republic of São Tomé and Príncipe and the European Community (‘the Conclusion Proposal’) .

text: 2. The objective of the Signing Proposal is (i) to authorize the signing, on behalf of the Union, of the new Protocol on the implementation of the Fisheries Partnership Agreement between the Democratic Republic of São Tomé and Príncipe and the European Community (‘the Protocol’) and (ii) to provide for the provisional application of the Protocol.

text: 4. The aim of the Protocol is to allow European Union vessels to fish in São Tomé and Príncipe’s fishing zone and to enable the Union and the Democratic Republic of São Tomé and Príncipe to work together more closely to develop a sustainable fisheries policy, so as to promote the responsible exploitation of fishery resources in São Tomé and Príncipe’s fishing zone and in the Atlantic Ocean, and to help achieve decent working conditions in the fisheries sector .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 9 July 2025, pursuant to Article 42(1) of the EUDPR. The EDPS welcomes the reference to this consultation in Recital 10 of the Signing Proposal and in Recital 9 of the Conclusion Agreement. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of the EUDPR.

text: 2. General remarks

text: Article 15

text: provides that the data exchanged under the Agreement shall be processed by the competent authorities solely for the purpose of implementing the Agreement, and in particular for management purposes and for fisheries monitoring, control and surveillance. It also specifies that personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject.

text: 7. Moreover,

text: Article 15

text: 9. The EDPS notes that Article 15(4) of the Protocol foresees that further safeguards and legal remedies in relation to personal data and data subjects’ rights may be established by the Joint Committee provided for in Article 9 of the Agreement between the Democratic Republic of São Tomé and Príncipe and the European Community . In this respect, the EDPS recommends the Joint Committee to specify in par. 2.7 of Appendix 6 to the Annex to the Protocol what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 46(3)(b) of 5 Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies.

text: 10. The EDPS notes that the Annex to the Protocol entitled ‘Conditions governing fishing activities by Union vessels in São Tomé and Príncipe’s fishing zone’ includes a chapter on infringements committed by Union vessels in São Tomé and Príncipe’s fishing zone. The EDPS recalls that in case data processed to prevent and fight against illegal fishing would constitute personal data relating to criminal convictions and offences, appropriate safeguards for the rights and freedoms of data subjects should be provided, in accordance with

text: Article 10

text: GDPR and/or

text: Article 11

text: 5. Conclusions

text: 11. In light of the above, the EDPS makes the following recommendations: (1) to make use of the Joint Committee to specify in par. 2.7 of Appendix 6 to the Annex what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies. (2) to make also use of the Joint Committee to add in Appendix 6 to the Annex a provision that would specify the safeguards to be provided in the context of the processing of data relating to criminal convictions and offences. Brussels, 20 August 2025 (e-signed) p.o. Leonardo CERVERA NAVAS 6

type: vagledning

utgivare: edps


text: COM(2026) 314 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2026) 314 final. 4 COM(2026) 314 final, p. 1 and 2. COM(2026) 314 final, p. 2. 6 COM(2026) 314 final, p. 3. 4

text: See, for instance, EDPS Opinion 4/2021 on the Proposal for Amendment of the Europol Regulation, issued on 8 March 2021, para 40. 8 See Contribution by the EDPS to the Report on the application of

text: Regulation (EU) 2018/1725

text: , 21 December 2021, in particular at p. 3, 21-26 and 36-38. 9 See EDPS Contribution in the context of the Commission initiative to further specify procedural rules relating to the enforcement of the General Data Protection Regulation, 25 April 2023, p. 1-9. 5

text: Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL amending Regulations

text: (EU) 2016/679

text: (EU) 2018/1724

text: (EU) 2018/1725

text: (EU) 2023/2854

text: and Directives

text: (EU) 2022/2555

text: and

text: (EU) 2022/2557

text: as regards the simplification of the digital legislative framework, and repealing Regulations

text: (EU) 2018/1807

text: (EU) 2019/1150

text: (EU) 2022/868

text: , and

text: Directive (EU) 2019/1024

text: (Digital Omnibus), 19.11.2025, COM(2025)837 final. 11 COM(2026) 314 final, p. 3. 12

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA. 13 It would seem more prudent to introduce those changes to chapter IX only when simultaneously the changes proposed to the LED, also with a view of ensuring consistency across LED and Chapter IX. This would also be more in line with the approach followed in the Digital Omnibus, which only introduced changes to GDPR and provisions of EUDPR outside of Chapter IX. 14 See EDPB-EDPS Joint Opinion on the Proposal for a Regulation as regards the simplification of the digital legislative framework (Digital Omnibus), dated 10 February 2026, at paragraphs 65 and following. 6

text: See EDPB-EDPS Joint Opinion on the Proposal for a Regulation as regards the simplification of the digital legislative framework (Digital Omnibus), dated 10 February 2026, at paragraph 84 of Section 8.2 ‘The EDPB and the EDPS stress that the revision of the EUDPR should also provide for the establishment of a common template for notifying personal data breaches, as well as for the establishment of a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The competence to establish such template and list should be entrusted to the EDPS. As to the EUDPR, the EDPS is already empowered to adopt lists of processing activities requiring and not requiring DPIAs. The EDPB and the EDPS consider that transferring this responsibility to the Commission is not necessary, nor appropriate, given that the Commission would itself have to comply with those lists. The Commission, as a European institution should not be given the possibility of shaping the extent of its own obligations under the EUDPR.’ 16 Budapest Főváros IV. Kerület Újpest Önkormányzat Polgármesteri Hivatala

text: Case C-46/23

text: , , in particular at paragraph 50. 7

text: See Contribution by the EDPS to the Report on the application of

text: Regulation (EU) 2018/1725

text: , 21 December 2021, p. 22-25; the EDPS Contribution in the context of the Commission initiative to further specify procedural rules relating to the enforcement of the General Data Protection Regulation, 25 April 2023, p. 1-9 and the EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of

text: Regulation (EU) 2016/679

text: , 19 September 2023,p. 47-49. 8

text: The EDPS has set out in detail the practical obstacles encountered when cooperating with national DPAs and made concrete proposals on how to remedy them, see Contribution by the European Data Protection Supervisor in the context of the Commission initiative to further specify procedural rules relating to the enforcement of the General Data Protection Regulation, dated 25 April 2023, p. 3-5. See Contribution by the EDPS to the Report on the application of

text: Regulation (EU) 2018/1725

text: , dated 21 December 2021, p. 22-25. 19 See Contribution by the EDPS to the Report on the application of

text: Regulation (EU) 2018/1725

text: , dated 21 December 2021, Cluster 3: Cooperation, p. 22-26. 20 Articles

text: and

text: EUDPR. 21 Article 113 of the Proposal for Europol Regulation, COM(2026) 580 final. 22 Article 52 of the Proposal for Eurojust Regulation, COM(2026) 570 final. 9

text: See EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of

text: Regulation (EU) 2016/679

text: , dated 19 September 2023, p. 47-49. 10

text: Joint letter of the Customs Information System Supervision Coordination Group and the Coordinated Supervision Committee (CSC) of the EDPB to the European Commission, “Call for amending the CIS Regulation in order to transfer the Supervision Coordination Group from the competence of the European Data Protection Supervisor to the competence of the Coordinated Supervision Committee”, dated 2 July 2026. 11

text: With regard to the cooperation agreements concluded by Europol,

text: Article 25(4) of Regulation (EU) 2016/794

text: on the European 25 Union Agency for Law Enforcement Cooperation (“Europol Regulation”) required the European Commission to assess the data protection provisions contained in Europol’s existing cooperation agreements to determine whether they should be renegotiated to ensure appropriate data protection safeguards. Furthermore, in its First Report on the application and functioning of the Law 25 Enforcement Directive (LED) , the Commission stated that this assessment was underway and expected to be completed in the second half of 2022. It further indicated that it would inform the co-legislators of the outcome of that assessment and, where necessary, seek to renegotiate the agreements to ensure that they contain appropriate data protection safeguards. To date, neither the outcome of that assessment nor any subsequent follow-up measures have been presented. 12

identifier: EDPS yttrande 17/2026

title: EDPS Opinion 17/2026 on the Proposal for a Regulation amending Regulation (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the EU institutions, bodies, offices and agencies

text: Opinion 17/2026

text: on the Proposal for a Regulation amending

text: Regulation (EU) 2018/1725

text: on the protection of natural persons with regard to the processing of personal data by the EU institutions, bodies, offices and agencies

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and the Council amending

text: Regulation (EU) 2018/1725

text: on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data .

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 23 June 2026, the European Commission issued the Proposal for a Regulation of the European Parliament and the Council amending

text: Regulation (EU) 2018/1725

text: on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data (EUDPR).

text: The Proposal aims to simplify and ensure consistency of the data protection framework applicable to processing of operational data by EU Justice and Home Affairs (JHA) agencies and bodies, including Europol, Eurojust, the European Public Prosecutor’s Office (EPPO), and, to a limited extent, Frontex.

text: The EDPS welcomes the overall objective of this Proposal, notably to harmonise, complete and streamline the current data protection framework regarding processing of operational data by EU institutions, offices, bodies and agencies active in the area of freedom, security and justice and to clarify his powers vis-à-vis such agencies. This is an important step towards a comprehensive alignment of the data protection framework for the EU institutions, offices, bodies and agencies active in the area of freedom, security and justice, which the EDPS has repeatedly called for.

text: The EDPS underlines that achieving the objective of a coherent and streamlined legal framework, and ensuring its consistent application, requires effective supervision and enforcement. In this context, clear rules on the exercise of supervisory and enforcement powers, together with effective cooperation between national DPAs and the EDPS are essential to ensure the effective and uniform application of the framework. This is all the more important in the area of criminal justice and law enforcement, given the complex and highly sensitive nature of personal data processing by Union and Member States competent authorities. This Proposal presents an important opportunity to address the identified challenges for the effective and consistent enforcement of data protection rules in a comprehensive and horizontal manner.

text: Having this in mind, the EDPS recommends in particular (i) maintaining consistency between Chapter IX EUDPR and the Law Enforcement Directive; (ii) to clarify that his powers include ordering compliance whenever an infringement of the EUDPR is identified, as well as the legal possibility to impose interim measures in urgent cases; (iii) to streamline cooperation between the EDPS and national supervisory authorities; (iv) to provide for mandatory cooperation for prior consultations related to joint controllership; (v) to adapt

text: Article 84

text: EUDPR to provide for scenarios where operational data originate from Member States; and (vi) to bring the coordinated supervision of the Customs Information System (CIS) under the scope of

text: Article 62 of Regulation (EU) 2018/1725

text: . Furthermore, with regard to the existing cooperation agreements allowing exchanges of operational personal data between Europol and Eurojust and third countries, the EDPS recommends ensuring that the data protection safeguards included therein are in full alignment with the current EU data protection frameworks. Finally, the Opinion also underlines the need for additional allocation of both human and financial resources to the EDPS, corresponding to the substantial expansion of the tasks and data-processing capabilities of Union JHA Agencies.

text: Having regard to

text: Regulation (EU) 2018/1725

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 23 June 2026, the European Commission issued the Proposal for a Regulation of the European Parliament and the Council amending

text: Regulation (EU) 2018/1725

text: on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data’ (‘the Proposal’).

text: 2. The objective of the Proposal is to simplify and ensure consistency of the data protection framework applicable to processing of operational data by EU Justice and Home Affairs (JHA) agencies and bodies, including Europol, Eurojust, the European Public Prosecutor’s Office (EPPO), and, to a limited extent, Frontex. This goal is intended to be reached by aligning the relevant rules across EU bodies and agencies. The other primary objectives of the Proposal are to streamline the powers of the European Data Protection Supervisor and to enhance legal certainty .

text: 3. The Proposal is part of a bigger legislative package aimed at strengthening the Union’s capacity to prevent, detect, investigate and prosecute serious cross-border crime, which also includes proposals to strengthen the mandates of Europol and Eurojust and a recast of the Directive on European Investigation Order. In this regard, the EDPS notes that the proposed revisions of the Europol and Eurojust Regulations are actually at the core of the current Proposal . The EDPS has been formally consulted on all these proposals and will issue relevant opinions. In particular, the Proposal aims to identify all common denominators of data protection rules applicable to Europol and Eurojust, and regroups them in the EUDPR, thereby reducing fragmentation and duplication. This should allow the founding acts of Union bodies, offices, and agencies active in the area of law enforcement and criminal justice to maintain only those tailored-made data protection rules, developed to reflect their respective specific operational needs and nature .

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 23 June 2026, pursuant to Article 42(1) of EUDPR. The EDPS welcomes reference to this consultation in Recital (69) of the Proposal. The EDPS also positively notes that it was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 5. The EDPS welcomes and supports the overall objective of the Proposal, notably to harmonise, complete and streamline the current data protection framework regarding processing of operational data by EU institutions, offices, bodies and agencies active in the area of freedom, security and justice (hereinafter also “EU JHA agencies”) and to clarify his powers vis-à-vis such agencies. This is an important step towards a comprehensive alignment of the data protection framework for the EU institutions, offices, bodies and agencies active in the area of freedom, security and justice, which the EDPS has repeatedly called for .

text: 6. The EDPS also welcomes the steps taken by the Proposal towards strengthening the existing framework, for instance the new wording of

text: Article 45

text: on the Data Protection Officer, of

text: Article 87

text: a on record-keeping for operational personal data as well as the introduction of additional safeguards in Article 88 of the EUDPR on logging. At the same time, he considers that additional improvements are needed for the Proposal to fully achieve its stated objectives.

text: 7. The EDPS underlines that achieving the objective of a coherent and streamlined legal framework, and ensuring its consistent application, requires effective supervision and enforcement. Clear rules on the exercise of supervisory and enforcement powers, together with effective cooperation between national DPAs and the EDPS are essential to ensure the effective and uniform application of the framework.

text: 8. This is all the more essential in the area of criminal justice and law enforcement, given the complex and highly sensitive nature of personal data processing by Union and Member States competent authorities and the risks for all the persons concerned. As the EUDPR will now also serve as the horizontal legal framework governing the processing activities carried out by Europol, Eurojust and the EPPO, it is of critical importance that effective supervision be guaranteed.

text: 9. Therefore, the Proposal should establish a clear legal framework that governs the exercise of the EDPS powers and that enables effective cooperation between the EDPS and national supervisory authorities in the exercise of their respective tasks and powers. The specific recommendations included in this Opinion build on the EDPS’ practical experience to date, as well as his contribution to the first evaluation of the EUDPR and subsequent recommendations .

text: 10. In addition, with the same objective of ensuring coherence and alignment of the legal framework, the EDPS recalls that, in line with Recital 10 EUDPR, the rules for the protection and the free movement of operational personal data processed by the competent Union bodies, offices or agencies should be consistent with

text: Directive (EU) 2016/680

text: . Preserving this uniformity is essential to safeguard the coherence of the Union data protection framework and to ensure the consistent interpretation and application of the relevant rules.

text: 3. Alignment with the Digital Omnibus

text: 11. The EDPS notes that the Proposal also aims to align the provisions on processing of operational 10 11 data with the Digital Omnibus proposal , when relevant . According to recitals 41 and 45 of the Digital Omnibus Proposal, both the EUDPR and the

text: Directive (EU) 2016/680

text: (“LED”) should be brought into alignment with the changes made to GDPR as soon as possible. However, until the amendments proposed by the Digital Omnibus have been adopted, the final text of those amendments remains uncertain. Moreover, the timeline for the possible amendment of the LED remains unknown .

text: 12. As Chapter IX of the EUDPR is meant to mirror the LED, the EDPS considers it of utmost importance to maintain consistency between the two. Otherwise, there is a risk of fragmentation of the legal framework and of divergence between Chapter IX and the LED. Such divergence would be to the detriment of legal certainty and the coherent application of the relevant rules. For example, in the context of joint operations falling within the scope of both Chapter IX EUDPR and the LED, different rules could apply depending on whether the processing of data is carried out by the Member States' competent authorities or by the EU institution or agency concerned. This would not only create operational complexity but also risks undermining the uniform application of the legal framework.

text: 13. The EDPS therefore recommends aligning the provisions on processing of operational data with the Digital Omnibus proposal together with corresponding changes to the LED.

text: 14. Should the co-legislators nevertheless wish to proceed with already aligning Chapter IX with the Digital Omnibus at this stage, the EDPS recalls the recommendations made in the EDPB- EDPS Joint Opinion on the Digital Omnibus , in particular on automated individual decisionmaking, including profiling, and on the right of access.

text: 15. The EDPS also notes that the amendments in the Proposal aimed at bringing the EUDPR in line with the Digital Omnibus do not extend to the establishment of a common template for notifying a personal data breach and a list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. In this regard, the EDPS reiterates the recommendation that the EDPS be provided with the competence to establish both the template and the list .

text: 4. Ensuring effective enforcement

text: Article 95

text: a of the Proposal aims to establish a coherent framework for the supervision of Union bodies, offices and agencies active in the area of law enforcement and criminal justice. The EDPS very much supports the objective of streamlining its supervisory tasks and powers. Effective supervision and enforcement are essential to ensure the alignment and coherence of the legal framework, as well as the consistent application of data protection rules.

text: 4.1. Compliance orders

text: 17. According to the Court of Justice of the EU , the powers of supervisory authorities must be interpreted in light of their fundamental task of ensuring compliance with EU data protection law. Accordingly, each data protection authority must have genuine powers to take effectual action against infringements of EU data protection law, even where the applicable legislation does not expressly provide for a specific corrective power. This follows from their mandate to monitor and enforce compliance with data protection rules, as well as from the principle of effectiveness (effet utile) of EU law.

text: Article 95

text: a(3)(j) of the Proposal provides that the EDPS may order the controller or processor to bring processing operations into compliance with this Regulation and, where applicable, with data protection rules laid down in the founding act of the Union body, office or agency, where appropriate, in a specified manner and within a specified period.

text: 19. The description of the EDPS’ power to order compliance should encompass any infringement of the EUDPR, without being limited to specific processing operations, as suggested by

text: Article 95

text: a(3)(j) of the Proposal. Compliance orders may also be warranted, for example, in relation to record keeping obligations (

text: Article 31

text: ) the designation and position of the DPO (Article

text: EUDPR), and any other requirements that do not constitute processing operations within the meaning of

text: Article 3(3)

text: EUDPR.

text: 20. While the EDPS considers that its current powers are not limited to processing operations only, it would nevertheless be preferable for those powers to be expressly provided for in the applicable legislative framework. This would enhance legal certainty, transparency and the foreseeability of supervisory action, while clearly defining the scope of the supervisory authority's intervention and thereby contributing to the consistent and effective application of data protection law.

text: 21. This clarification would also ensure the internal coherence of the enforcement framework. Under

text: Article 95

text: a(3), point (l), of the Proposal, the power to impose administrative fines is conditional upon the prior issuance of a binding order. Clarifying that

text: Article 95

text: a(3), point (j) of the Proposal includes the power to order compliance whenever an infringement of the EUDPR is identified would therefore provide a clear legal basis for the subsequent exercise of the fining power and remove any uncertainty as to the interaction between these provisions.

text: 22. For the same reasons and for the sake of consistency, the EDPS also recommends amending

text: Article 58(2)

text: , point (e) EUDPR accordingly. This would additionally help to ensure a coherent and comprehensive framework governing the processing of operational personal data by Union institutions, bodies, offices and agencies in a consistent manner.

text: 4.2. Interim measures

text: 23. The EDPS notes that the effectiveness of enforcement of the fundamental right to protection of personal data and to privacy often depends on the timely availability of interim measures to safeguard these rights. This underscores the possibility to adopt interim measures on an urgent basis where there are reasonable grounds to conclude that an EU institution, office, body or agency has infringed the EUDPR or any other legislation conferring supervisory competence on the EDPS.

text: 24. Therefore, in view of ensuring an efficient and prompt enforcement of the applicable data protection law and preventing possible risks for the fundamental rights of the affected data subjects, the EDPS recommends adding in

text: Article 95

text: a of the Proposal such possibility for interim measures.

text: 4.3. Streamlining cooperation

text: 26. The EDPS welcomes the explicit recognition of the need for close cooperation with the national supervisory authorities in the exercise of their respective tasks and powers under

text: Article 95

text: a(1) of the Proposal, as it contributes to the consistent and coherent application of the EU data protection framework.

text: 27. Ensuring effective and efficient means of cooperation between the EDPS and national supervisory authorities is crucial to ensuring the effectiveness of the EUDPR and the coherent application of Union data protection law . As this Proposal seeks to streamline the data protection framework applicable to the processing of operational personal data by JHA agencies, it should also streamline the cooperation between the EDPS and national supervisory authorities. In this regard, the EDPS recalls the previously identified practical obstacles that exist because of the lack of comprehensive rules governing cooperation between national supervisory authorities and the EDPS . In short, these practical obstacles are attributable to the fact that: - provisions governing cooperation between national supervisory authorities and EDPS typically only provide for a general vaguely worded duty of cooperation, without a clearly defined procedure and/or deadlines; - because of a restrictive interpretation of the notion of ‘supervisory authority’ in relation to the EDPS, specific provisions governing cooperation between national supervisory authorities are considered not to be applicable to the cooperation between national SAs and the EDPS; - the EDPS and national supervisory authorities cannot make use of common IT tools that enable secure exchange of information and facilitate the initiation of requests for mutual assistance or joint operations.

text: 28. Streamlining cooperation between the EDPS and national supervisory authorities would greatly facilitate coordinated supervision and enforcement under the EUDPR, the LED, the GDPR and other relevant Union legal acts, including the Europol and Eurojust Regulation. . Moreover, further developing and clarifying the horizontal provisions in the EUDPR on the cooperation and coordination between the EDPS and the national supervisory authorities would also remove the need for additional detailed provisions on the matter in the founding 21 22 legal acts of the Union JHA agencies, in particular Europol and Eurojust , thus contributing for the achievement of the policy objective of the Proposal for more consistent and streamlined data protection framework.

text: 29. In light of the above, the EDPS recommends clarifying the modalities of cooperation between national supervisory authorities and the EDPS. In particular, the amended EUDPR should ensure that: - all data protection supervisory authorities cooperate actively to ensure effective supervision and consistent enforcement of all the Union’s data protection rules; - all data protection supervisory authorities carry out such cooperation in accordance with

text: Article 50

text: LED, Articles

text: , and 66(3) GDPR, as well as Articles

text: and

text: EUDPR; - the EDPS is, for purpose of cooperation with national supervisory authorities in accordance with Chapter VII EUDPR, also considered as a “supervisory authority” within the meaning of Chapter VII of the LED and Chapter VII of the GDPR; - the EDPS is able to cooperate and exchange information with the other data protection authorities, including in the JHA area, by using a secure common electronic information and communication system.

text: 30. The EDPS notes that the above recommendations have been supported also by the European Data Protection Board (“EDPB”) in the EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of

text: Regulation (EU) 2016/679

text: 4.4. Mandatory cooperation in specific cases

text: 31. Still with the aim of streamlining cooperation between the EDPS and the national data protection supervisory authorities, the EDPS notes that, based on his practical experience, certain specific cases would benefit from mandatory cooperation. Therefore, he considers that

text: Article 61(1)

text: EUDPR, which lays down a horizontal requirement for the EDPS to cooperate with national supervisory authorities to the extent necessary for the performance of their respective duties, should be further developed with dedicated mechanisms in specific cases where cooperation could be deemed mandatory, as further detailed below.

text: 32. First, in the context of prior consultations pursuant to

text: Article 90

text: EUDPR and the corresponding

text: Article 28

text: LED, there is a specific need to ensure consistency of the opinions issued by the EDPS and the national supervisory authorities in relation to processing operations falling under the joint controllership of EU bodies acting in the scope of Chapter 4 or Chapter 5 of Title V of Part III TFEU and Member States competent authorities.

text: 33. In the light of this, the EDPS recommends including under

text: Article 90

text: EUDPR an express requirement for the EDPS and the concerned national supervisory authorities to cooperate, within the scope of their respective competences and within the framework of their responsibilities, in prior consultation processes related to processing operations falling under joint controllership of EU bodies and Member States national authorities.

text: 34. In the same vein, the EDPS notes that

text: Article 84

text: EUDPR on the exercise of rights by the data subjects and verification by the EDPS, currently does not contain rules for the scenarios where operational data originate from Member States, which is a very common feature in the area of criminal justice and law enforcement where the Union agencies like Europol act as information hubs.

text: 35. Therefore, the EDPS recommends further developing

text: Article 84

text: EUDPR by providing that where the operational data concerned are originating from one or more Member States, the EDPS and the national supervisory authority of the Member State that provided the data should, each acting within the scope of their respective competences, ensure that the necessary verifications or a review on the lawfulness of the processing of the data have been carried out correctly. In this context, the national supervisory authorities should inform the EDPS of the outcome of their verifications within an appropriate deadline (not be shorter than one month and not longer than three months).

text: 4.5. Coordinated supervision of the Customs Information System

text: 36. Finally, the EDPS regrets that the Proposal does not take the opportunity to amend

text: Council Regulation (EC) 515/97

text: so as to bring the coordinated supervision of the Customs Information System (CIS) under the scope of

text: Article 62 of Regulation (EU) 2018/1725

text: . Such an amendment would enhance consistency by transferring the activities of the last remaining Supervision Coordination Group to the Coordinated Supervision Committee (CSC) under the European Data Protection Board (EDPB). In this context, the EDPS recalls the CIS SCG and EDPB joint letter which further details the underlying reasons of this request and recommends including such amendment accordingly . He also calls on the co-legislators to introduce a specific amendment to that purpose.

text: 5. International transfers

text: 37. The EDPS positively notes the introduction of a comprehensive section governing rules for transfers of operational personal data to third countries and international organisations by inserting new Articles

text: a, 94b, 94c, 94d, and the effort to streamline the relevant framework by aligning it with the framework established under the LED.

text: 38. He further welcomes the clarification as to what are the ‘legally binding instruments’ that EUIs may use for the purpose of providing appropriate safeguards when transferring personal data outside of the EEA, i.e.: (i) international agreements pursuant to

text: Article 218

text: TFEU, (ii) cooperation agreements allowing exchanges of operational personal data between Eurojust and third countries which were concluded before 12 December 2019 or IOs; and (iii) cooperation agreements allowing exchanges of operational personal data between Europol and third countries or IOs which were concluded before 1 May 2017.

text: 39. He however notes that the Proposal does not address the need to align the ‘legacy’ agreements referred to in points (ii) and (iii) with the applicable data protection legal framework, which entered into force after their conclusion. Under this framework, transfers of personal data for law enforcement purposes may only take place where robust and effective safeguards are ensured, including, inter alia, effective independent supervision, enforceable and effective data subject rights (such as the right to information and judicial redress), as well as effective oversight and administrative and judicial remedies. It is therefore important to ensure that these agreements provide for the level of protection required by current EU data protection law.

text: 40. While recognising that not all legacy agreements can be revised and amended at once, the EDPS would like to remind that for instruments negotiated prior to the entry into force of the current data protection legislation and their continued application should be conceived as temporary and adaptation-oriented from the outset, not as a perpetual exemption.

text: 41. In light of the above, the EDPS recommends ensuring that these agreements are reviewed and, where necessary, renegotiated to ensure full alignment with the current EU data protection framework .

text: 6. Enhancement of the supervisory capacity of the EDPS

text: 42. As already highlighted in this Opinion, the Proposal is part of a bigger JHA package of criminal justice and law enforcement initiatives aimed at strengthening the Union’s capacity to prevent, detect, investigate and prosecute serious cross-border crime, in particular through new enhanced mandates of Europol and Eurojust.

text: 43. The EDPS notes that the proposed extension of Europol’s and Eurojust’s tasks would not merely entail a quantitative increase in the volume of personal data processed. It would also likely involve more complex processing operations, additional information flows, increased exchanges with national authorities and potentially third countries, as well as a greater need to assess compliance with the applicable data protection safeguards. These developments would inevitably require more intensive and specialised supervision by the EDPS.

text: 44. Effective supervision cannot be ensured without adequate resources. The EDPS’ supervisory responsibilities are a necessary counterpart to the expansion of the JHA agencies’ operational powers. If Europol and Eurojust are entrusted with additional tasks involving the processing of personal data, the EDPS must be equipped with the corresponding human and financial resources to exercise his supervisory mandate effectively, independently and in a timely manner. The EDPS therefore underlines the need for an additional allocation of both human and financial resources to the EDPS.

text: 7. Conclusions

text: 45. In light of the above, the EDPS makes the following recommendations: (1) to refrain from aligning Chapter IX of the EUDPR with the Digital Omnibus proposal absent corresponding changes to the LED; (2) to clarify that

text: Article 95

text: a(3), point (j), of the Proposal includes the power to order compliance whenever an infringement of the EUDPR is identified, and to align

text: Article 58(2)

text: , point (e) of the EUDPR accordingly. (3) to provide in

text: Article 95

text: a of the Proposal for the legal possibility for the EDPS to adopt interim measures in urgent cases and to align it with

text: Article 58(2)

text: EUDPR; (4) to provide for clear procedures for cooperation between the EDPS and national supervisory authorities in cases involving the application of the EUDPR, the LED, GDPR and other relevant Union legal acts (such as the Europol and Eurojust Regulation); (5) to provide for mandatory cooperation between the EDPS and national supervisory authorities in case of prior consultations related to joint controllership; (6) to adapt

text: Article 84

text: EUDPR to provide for scenarios where operational data originate from Member States; (7) to bring the coordinated supervision of the Customs Information System (CIS) under the scope of

text: Article 62 of Regulation (EU) 2018/1725

text: ; (8) to ensure that the cooperation agreements allowing exchanges of operational personal data between Eurojust and third countries or international organisations concluded before 12 December 2019, and the cooperation agreements allowing exchanges of operational personal data between Europol and third countries or international organisations concluded before 1 May 2017 are reviewed and, where necessary, brought in line with the applicable data protection law. (9) to recall, by way of a recital, the need for appropriate resources to ensure effective supervision of Union institutions, offices, bodies and agencies, also taking into account to the expansion of the JHA agencies’ operational powers. Brussels, 11 August 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 13


text: OJ L 295, 21.11.2018, p. 39. 2 COM(2022) 296 final. 3 Recital (4) of the Proposal. 4

text: OJ L 119, 4.5.2016, p. 1–88. 5 Article 1(3) of Regulation 1217/2009. See section 3.2. 7 For example,

text: Article 2

text: (i) of the Proposal refers to both the GDPR and EUDPR in defining the concept of ‘personal data’ whereas

text: Article 2

text: (k), refers only to the definition of “processing” under the EUDPR but contains no references to the GDPR (even though the definition in the GDPR is identical). 8 For example,

text: Article 2

text: (o) of the Proposal aims to define “pseudonymous data” whereas Article 4(5) of the GDPR and Article 3(6) of the EUDPR already provide a definition of ‘pseudonymisation’. In the same vein,

text: Article 2

text: (n) of the Proposal aims to define “anonymous data”, a concept, which is already explained in recital (26) GDPR and recital (16) EUDPR. 9 See recitals (8), (10) and

text: Article 2

text: (i) of the Proposal. 10 See Court of Justice of European Union in Joint Cases C92/09, Volker und Markus Schecke Gbr v. Land Hessen, and

text: , Eifert v. Land Hessen and Bundesanstalt für Landwirtschaft und Ernahrung, at paragraph 53, where the CJEU 5

text: considered that legal persons can claim the protection of Articles 7 and 8 of the Charter in so far as the official title of the legal person identifies one or more natural persons. 11

text: Article 2

text: (i) of the Proposal currently specifies that (i) ‘personal data’ means personal data as defined in Regulations

text: (EU) 2016/679

text: and

text: (EU) 2018/1725

text: , however extending protection to the legitimate interests of farmers who are legal persons. 12 See AEPD-EDPS joint paper on 10 misunderstandings related to anonymisation, 27 April 2021. 13 See

text: Article 29

text: Working Party Opinion 05/2014 on Anonymisation Techniques, 10 April 2014.

text: See also recital (9) of the Proposal 15 See Court of Justice of European Union, judgments of 1 August 2022, OT and the Vyriausioji tarnybinės etikos komisija,

text: , EU:C:2022:601, paragraphs 73 and following. 16 See also Opinion 15/2022 on the Proposal for a Regulation on European Union geographical indications for wine, spirit drinks and agricultural products, and quality schemes for agricultural products, 18 July 2022, paragraphs 19. 17 See also Opinion 15/2022 on the Proposal for a Regulation on European Union geographical indications for wine, spirit drinks and agricultural products, and quality schemes for agricultural products, 18 July 2022, paragraphs 19. 18 Court of Justice of European Union, judgments of 1 August 2022, OT and the Vyriausioji tarnybinės etikos komisija,

text: , EU:C:2022:601, paragraph 98. 7

text: See EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data, 25 February 2019. 20

text: Article 5(1)

text: (e) GDPR and

text: Article 4(1)

text: (e) EUDPR. 8

text: See Judgment of the Court (Grand Chamber) of 5 June 2018, case

text: , Wirtschaftsakademie v Schleswig- Holstein, paragraph 29. 22 COM(2022) 296 final, p. 2. 9

identifier: EDPS yttrande 18/2022

title: EDPS Opinion on the Proposal for a Regulation as regards conversion of the Farm Accountancy Data Network into a Farm Sustainability Data Network (FSDN)

text: 11 August 2022

text: Opinion 18/2022

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council amending

text: Council Regulation (EC) No 1217/2009

text: as regards conversion of the Farm Accountancy Data Network into a Farm Sustainability Data Network. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the draft Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: Council Regulation (EC) No 1217/2009

text: The Proposal aims to regulate the processing of personal data in the context of the collection of farm level economic, environmental and social data as well as the further management and use of such data in the Farm Sustainability Data Network (‘FSDN’). In this regard, the EDPS welcomes the explicit references to the need to comply with both the GDPR and with the EUDPR. The EDPS also welcomes that the Proposal contains references to the GDPR and EUDPR when providing definitions of relevant terms such as ‘personal data’ and ‘processing’. However, in the interest of legal certainty, the EDPS strongly recommends revisiting the proposed definitions to ensure that both the GDPR and EUDPR are referenced in a systematic and consistent manner and to avoid introducing definitions of concepts already covered by those instruments.

text: The EDPS positively notes that in case individual data will be shared by the Commission or liaison agencies, the data of the farmers and all other individual details obtained pursuant to the Proposal would be anonymised or pseudonymised. Both anonymisation and pseudonymisation are important techniques to mitigate data protection risks. That being said, the EDPS considers it important to preserve a clear distinction between these concepts, as pseudonymous data can still be related to an identifiable individual and therefore qualifies as personal data.

text: As regards the publication of FSDN data, the EDPS recalls that any requirement to publish personal data should, in addition to being provided by law, also fulfil the other requirements arising from Article 52(1) of the Charter and Article 6(3) of the GDPR. The EDPS considers that the Proposal, in its current form, does not provide a specific reason of public interest justifying the publication personal data in identifiable form, even if the data were to be pseudonymised prior to publication. The EDPS therefore recommends specifying that only duly anonymised FSDN data may be made publically available.

text: The EDPS considers that certain specifications regarding the processing of personal data should be addressed by the Proposal itself rather than by way of delegated acts. In particular, the EDPS considers that the categories of personal data, as well as the specific purposes for which they may be processed, should be specified directly in the Proposal. Furthermore, the EDPS recommends specifying (criteria to determine) the retention period for the relevant categories of personal data and clarifying the roles of the actors involved. Finally, insofar as the Proposal aims to establish an IT system for the purpose of linking databases, the EDPS recommends including in the Proposal a high level description of the IT tool, including data protection roles and responsibilities and relevant applicable safeguards.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 22 June 2022, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council amending

text: Council Regulation (EC) No 1217/2009

text: (‘the Regulation 1217/2009’) as regards conversion of the Farm Accountancy Data Network into a Farm Sustainability Data Network (‘the Proposal’).

text: 2. The main objective of the Proposal is to amend Regulation 1217/2009 in order to convert the Farm Accountancy Data Network (‘FADN’) into a Farm Sustainability Data Network (‘FSDN’), with a view to collect farm level data on sustainability. The conversion would also contribute to the improvement of advisory services to farmers and benchmarking of farm performance.

text: 3. Data are currently collected mainly to assess economic aspects of agricultural holdings, while there is a need to assess the overall sustainability of the holding, including environmental data linked to soil, air, water and biodiversity, as well as data covering the social dimension of farming. The conversion to a FSDN would enable the benchmarking of farm performance against regional, national and sectorial averages. Regarding accountancy data, accounts of agricultural holdings constitute the basic source for any assessment of incomes on agricultural holdings or study of their business operation. The information collected could also be used to provide personalised advisory services and feedback to farmers with the aim to improve the agricultural holdings’ sustainability .

text: 4. The Proposal would also change the way the data is collected, providing inter alia for interoperability with other systems containing farm data, making it possible to combine data originally collected for different purposes. To this end, a unique farm ID would be introduced. In addition, the Proposal also mandates the publication of FSDN data.

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 22 June 2022, pursuant to Article 42(1) of EUDPR. In this regard, the EDPS invites the co-legislators to include an explicit reference to this consultation in one of the Recitals of the Proposal.

text: 2. General remarks

text: 6. The EDPS notes that the Proposal would regulate the processing of personal data in the context of the collection of farm level economic, environmental and social data as well as the further management and use of such data in the FSDN. In this regard, the EDPS welcomes the references, in Article 1(4) of the Proposal, to the need to comply with

text: Regulation (EU) 2016/679

text: (‘GDPR’) and with the EUDPR during the processing, management and use of data.

text: 7. Regulation 1217/2009 currently provides that the data obtained shall serve as the basis for the drawing up of reports by the Commission on the situation of agriculture and of agricultural markets, as well as on farm incomes in the Union. It also provides that those reports shall be made publicly available on a dedicated website . Article 1(3) of the Proposal would mandate the publication of data in more general terms, specifying that ‘FSDN data shall be made publicly available in a manner consistent with Articles 7 and 8 of the Charter of Fundamental Rights of the European Union and Regulations

text: (EU) 2016/679

text: and 2018/1725’. While welcoming the references to the Charter, the GDPR and EUDPR, the EDPS considers that the Proposal does not provide an adequate legal basis for the publication of personal data, for the reasons further set out below .

text: 8. The EDPS welcomes that Article 2 of the Proposal refers to the GDPR and EUDPR when providing definitions of relevant terms such as ‘personal data’ and ‘processing’. At the same time, the EDPS notes that the cross-references are not always consistent . Moreover, the Proposal also aims to define concepts which are closely related (but not identical) to terms and concepts already explained in the GDPR and EUDPR . In the interest of legal certainty, the EDPS strongly recommends revisiting the proposed definitions to ensure that both the GDPR and EUDPR are referenced in a systematic and consistent manner and to avoid introducing definitions of concepts already covered by those instruments.

text: 9. Finally, the EDPS welcomes the fact the Proposal would extend measures to protect individuals with regard to the processing of their personal data to legal persons . The EDPS also recalls that data concerning legal persons concerning legal persons may, as clarified by the Court of Justice of the European Union , constitute personal data in certain cases. For the reasons set out in the previous paragraph, however, the EDPS considers that the extension of data protection guarantees to legal persons should be provided separately from the definition of personal data as such.

text: 3. Specific remarks

text: 3.1.Anonymisation and pseudonymisation

text: 10. The EDPS welcomes Recital 8, 9 and Article 16(2) of the Proposal, which indicate that in case individual data will be shared by the Commission or liaison agencies, the data of the farmers and all other individual details obtained pursuant to the Proposal will be anonymised or pseudonymised, covering both natural and legal persons.

text: 11. Both anonymisation and pseudonymisation are important techniques to mitigate data protection risks. It is important to note, however, there is a significant difference between these two concepts.

text: 12. Article 4(5) of the GDPR and Article 3(6) of the EUDPR define ‘pseudonymisation’ as “the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person”. This means that the use of “additional information” can lead to the identification of the individuals, which is why pseudonymous personal data is still personal data .

text: 13. Anonymous data, on the other hand, cannot be associated to specific individuals. In line with Recital 26 of the GDPR and Recital 16 of the EUDPR anonymous data is “information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable”. Once data is truly anonymous and individuals are no longer identifiable, the data will not fall within the scope of the GDPR or the EUDPR. An important factor is that the processing must be irreversible .

text: 14. In summary, what differentiates pseudonymisation from anonymisation is that the latter consists in processing this data in a way that it can no longer be related to an identified or identifiable individual. Unlike anonymised data, pseudonymised data qualifies as personal data. A clear distinction between these two concepts should be preserved. Therefore,

text: Article 6

text: 15. Moreover, the EDPS considers that it is not clear whether Article 16(2) of the Proposal refers only to the exchange of data between the national liaison agencies and the Commission or also extends to the sharing of data with the general public or otherwise making it available for reuse. The EDPS therefore recommends further clarifying which type of data can be made available to whom.

text: 3.2.Publication of FSDN data

text: 16. As regards the publication of FSDN data, the EDPS recalls that any requirement to publish personal data should, in addition to being provided by law, also fulfil the other requirements arising from Article 52(1) of the Charter and Article 6(3) of the GDPR, and in particular must meet an objective of public interest and be proportionate to the legitimate aim pursued .

text: 17. The EDPS underlines that the objective of transparency cannot be invoked as an end in itself . If there is a specific objective of public interest that would justify publication of personal data as necessary and proportionate, it should be clearly spelled out in the enacting terms of the Proposal as such . In addition, it must be borne in mind that an objective of general interest may not be pursued without having regard to the fact that it must be reconciled with the fundamental rights affected by the measure, by properly balancing the objective of general interest against the rights at issue .

text: 18. As regards the objectives pursued, the EDPS notes that

text: Article 1

text: provides that data obtained pursuant to this Regulation shall contribute to the assessment of EU agriculture’s sustainability. The EDPS considers that ‘contributing to the assessment of EU agricultural policy’ does not amount to a specific reason of public interest justifying the publication personal data in identifiable form, even if the data were to be pseudonymised prior to publication. Therefore, EDPS recommends specifying in Article 16 of the Proposal that only duly anonymised FSDN data may be made publically available.

text: 3.3.Specifications concerning the processing of personal data

text: 19. The EDPS notes that Article 4(3) of the Proposal would empower the Commission to adopt delegated acts on the data management process, in particular the farm ID, data storage, data quality and validation, use of data, access to and transmission of primary data, processing of primary data, combination of data with other data sources, procedure for ensuring availability of detailed and aggregated data, compatible data storage and exchange systems, review of refusal to provide data, obligations for end-users of scientific data and other interested parties. Moreover, in line with Article 4(4) of the Proposal, the Commission shall adopt implementing acts establishing and updating form and content of common regular and special surveys as well as methods and requirements for reusing and sharing data.

text: 20. The EDPS considers that, insofar as the Proposal intends to allow the Commission to process, manage and use of personal data collected by the Member States, a certain degree of specification as regards the processing of personal data should be provided in the Proposal itself, and not only by way of delegated acts.

text: 21. The EDPS recalls that, in line with the data minimisation principle laid down in

text: Article 5(1)

text: (c) of the GDPR and

text: Article 4(1)

text: (c) of the EUDPR, the collection of personal data should be limited to what is necessary to fulfil the purposes for which they are processed. Consequently, the EDPS considers that the categories of personal data should be specified directly in the Proposal. While the EDPS understands that the precise data to be collected will be set out in surveys and it may not be possible to fully detail each possible data category, the EDPS considers that only more detailed data fields (sub-categories of data) falling under the already defined categories of data should be specified through the adoption of delegated acts. When specifying the categories of data, the EDPS recalls first and foremost the need to comply with the requirements of necessity and proportionality .

text: 22. The EDPS notes that in line with Article 1 of the Proposal the data obtained shall contribute to the assessment of EU agriculture’s sustainability. However, Recital 4 of the Proposal seems to indicate also other purposes that do not seem to be supported by the enacting terms of the Proposal (e.g., the provision the personalised advisory services). The EDPS recommends clearly specifying all the purposes for which personal data may be processed in the enacting terms of the Proposal.

text: 23. Furthermore, pursuant to the principle of storage limitation, personal data can be kept “for no longer than is necessary for the purposes for which the personal data are processed” . Therefore, the Proposal should establish a retention period for the relevant categories of personal data, or at least laying down criteria to determine such periods, taking into account the purposes of the processing.

text: 24. Finally, the EDPS recalls the need to be consulted on delegated acts where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data, in accordance with

text: Article 42(1)

text: EUDPR.

text: 3.4.Determination of roles and responsibilities

text: 25. The concepts of controller, joint controller and processor play a crucial role in the application of data protection law, since they determine who shall be responsible for compliance with different data protection rules, and how data subjects can exercise their rights in practice.

text: 26. The EDPS recalls that in line with Articles 28 of the EUDPR and Article 26 of the GDPR “where two or more controllers determine the purposes and means of the processing, they shall be joint controllers”. This specification makes it clear that the concept of controllership does not necessarily refer to one single entity, but can also involve multiple parties playing a role in a processing operation. As a result, and as confirmed by the CJEU, each of the actors involved have obligations under data protection law . Insofar as the various actors act as joint controllers, they “shall in transparent manner determine their respective responsibilities for compliance with their data protection obligations, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information (...)”. In that case, the distribution of tasks between them should be laid down, preferably by law, or by an arrangement between the joint controllers.

text: 27. The allocation of the responsibilities between the various actors should be clear and accessible in order in particular to ensure that the data subjects can fully exercise their rights under the EUDPR and GDPR. While detailed arrangements to ensure compliance with data protection requirements may be specified by way of a delegated act, the EDPS considers that the roles of the various actors involved as controller, joint controller or processor should be clearly assigned in the Proposal.

text: 28. According to the Explanatory Memorandum, the FSDN plans to introduce a unique farm ID, which could be introduced, for instance, under the Integrated Farm Statistic (‘IFS’) and help linking the IFS and FSDN data. Adaptations (to either the legal act, system or methods of collection) for the purpose of linking databases would be required under each database. Therefore, even if the FSDN provides possibility for interoperability, other databases and systems would have to mirror it .

text: 29. Article 19(3) of the Proposal specifies that when setting up of the system for collecting the additional environmental and social variables, including training and interoperability between data collection systems, necessitates significant adaptations in the national FADN data collection system of a Member State.” In addition, the revised

text: Article 19(6)

text: states that the Commission shall adopt implementing acts establishing (...) adaptations to the data collection system”.

text: 30. The EDPS recognises that interoperability, when implemented in a well thought-out manner and in compliance with the requirements of necessity and proportionality, may be a useful tool to address legitimate needs of competent authorities of the Member States and the Commission and can contribute to the development of effective and efficient information sharing.

text: 31. Insofar as the Proposal aims to establish an IT system for the purpose of linking databases, the EDPS recommends including in the Proposal a high level description of the IT tool, including data protection roles and responsibilities and relevant applicable safeguards. Furthermore, the EDPS recalls that when a proposal for legislation has a possible impact on data protection, the European Commission has to submit it to the EDPS for consultation. This includes above mentioned implementing acts.

text: 4. Conclusions

text: 32. In light of the above, the EDPS recommends: a) to revisit the proposed definitions to ensure that both the GDPR and EUDPR are referenced in a systematic and consistent manner and to avoid introducing definitions of concepts already covered by those instruments; b) amending

text: Article 16(2)

text: and recital (8) of the Proposal to remove any suggestion that pseudonymisation would avoid the possibility of identification; c) specifying in Article 16 of the Proposal that only duly anonymised FSDN data may be made publically available; d) specifying the categories of personal data so as to ensure that the processing of personal data is limited to what is directly relevant and necessary to accomplish the specified purposes of the Proposal ; e) specifying all the purposes for which personal data may be processed in the enacting terms of the Proposal; f) establishing a retention period for the relevant categories of personal data concerned, or at least laying down criteria to determine such periods, taking into account the purposes of the processing; g) clearly assigning the roles of the various actors involved as controller, joint controller or processor; h) insofar as the Proposal aims to establish an IT system for the purpose of linking databases, including in the Proposal a high level description of the IT tool, including data protection roles and responsibilities and relevant applicable safeguards. Brussels, 11 August 2022 [e-signed] Wojciech Rafał WIEWIÓROWSKI 10