text: COM(2023) 97 final 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 97 final. 4 See p. 2 of the Proposal. 5 European Union Serious and Organised Crime Threat Assessment: A corrupt Influence: The infiltration and undermining of Europe’s economy and society by organised crime. Europol and the global cocaine trade, available at https://www.emcdda.europa.eu/publications/eu-drug-markets/cocaine/europeand-global-cocaine-trade_en. 7 Europol and the global cocaine trade, available at https://www.emcdda.europa.eu/publications/eu-drug-markets/cocaine/europeand-global-cocaine-trade_en.

text: EU Drug Market: Cocaine p. 24, available at EU Drug Market: Cocaine | www.emcdda.europa.eu. 9 Europol Programming Document 2022-2024, p. 150. 10 EU Drug Market: Cocaine, available at EU Drug Market: Cocaine, www.emcdda.europa.eu. 11

text: Regulation (EU) 2016/794

text: of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA, OJ L 135, 24.5.2016, p. 53. 12

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89.

text: See Judgment of the Court of Justice of 30 April 1974,

text: Case C-181/73

text: , R. & V. Haegeman a.o., ECLI:EU:C:1974:41, par. 5. 14 See Judgment of the Court of Justice of 3 June 2008,

text: Case C-308/06

text: , Intertanko a.o., ECLI:EU:C:2008:312, par. 42. 15 See Judgment of the Court of Justice of 3 September 2008, joined cases

text: P and

text: P, Kadi a.o., ECLI:EU:C:2008:461, par. 285. 16 For further details see the EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data. 17 See Judgment of the Court of Justice of 8 April 2014, joined cases

text: and

text: , Digital Rights Ireland Ltd, ECLI:EU:C:2014:238, paragraph 52; Judgment of the Court of Justice of 16 December 2008 in the case

text: Satakunnan Markkinapörssi and Satamedia, ECLI:EU:C:2008:727, paragraph 56; Judgment of the Court of Justice of 9 November 2010 in joined cases

text: and

text: Volker und Markus Schecke and Eifert, ECLI:EU:C:2010:662, paragraphs 77 and 86.

text: Regulation (EU) 2022/991

text: of the European Parliament and of the Council of 8 June 2022 amending

text: Regulation (EU) 2016/794

text: , as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role in research and innovation, OJ L 169, 27.6.2022, p. 1.

text: See https://www.coe.int/en/web/data-protection/support-for-drafting-data-protection-legislation-in-ecuador#. 20 See

text: Articles 18

text: a(6) and 23(9) of the Europol Regulation, 21 See EDPS Opinion 2/2018 on eight negotiating mandates to conclude international agreements allowing the exchange of data between Europol and third countries, adopted on 14 March 2018, https://edps.europa.eu/sites/edp/files/publication/18-03- 19_opinion_international_agreements_europol_en.pdf and EDPS Opinion 1/2020 on the negotiating mandate to conclude an international agreement on the exchange of personal data between Europol and New Zealand law enforcement authorities, issued on 31 January 2020 https://edps.europa.eu/sites/default/files/publication/20-01-31_opinion_recommendation_europol_en.docx.pdf 8

text: See Opinion 1/15 of the Court of Justice of 26 July 2017, EU-Canada PNR Agreement, ECLI:EU:C:2017:592, paragraph 141. 23 Idem. 10

text: Article 5(1)

text: (f) GDPR and

text: Article 4(1)

text: (f) LED and EUDPR. 25 See Judgment of the Court of Justice of 8 April 2014, in joined cases

text: and

text: , Digital Rights Ireland Ltd, ECLI:EU:C:2014:238, paragraph 40. 26 See Judgment of the Court of Justice of 1 October 2015,

text: Case C-201/14

text: , Smaranda a.o., ECLI:EU:C:2015:638, in particular para. 32 and 33 where the Court found that “the requirement to inform the data subjects about the processing of their personal data is all the more important since it affects the exercise by the data subjects of their right of access to, and right to rectify, the data being processed, and their right to object to the processing of those data” and that “That information concerns the identity of the data controller, the purposes of the processing and any further information necessary to guarantee fair processing of the data”. 11

identifier: EDPS yttrande 10/2023

title: EDPS Opinion on the negotiating mandate to conclude an international agreement on the exchange of personal data between Europol and Ecuadorian law enforcement authorities

text: 19 April 2023

text: Opinion 10/2023

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Recommendation for a Council decision authorising the opening of negotiations for an agreement between the European Union and the Republic of Ecuador on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Ecuadorian authorities competent for fighting serious crime and terrorism .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 22 February 2023 the European Commission issued a Recommendation for a Council decision authorising the opening of negotiations for an agreement between the European Union and the Republic of Ecuador on the exchange of personal data between Europol and the Ecuadorian authorities competent for fighting serious crime and terrorism.

text: Transfers of personal data gathered in the context of criminal investigations and further processed by Europol to produce criminal intelligence are liable to have a significant impact on the lives of the individuals concerned. For that reason, the international agreement must ensure that the limitations to the rights to privacy and data protection in relation to the fight against serious crime and terrorism apply only in so far as is strictly necessary.

text: The EDPS positively notes that the Commission has established by now, based also on a number of the recommendations from the previous EDPS Opinions on this matter, a well-structured set of objectives (negotiating directives), incorporating fundamental data protection principles, which the Commission aims to achieve on behalf of the EU in the course of international negotiations to conclude agreements on the exchange of personal data between Europol and third country law enforcement authorities.

text: In this regard, the recommendations in this Opinion are aimed at clarifying and, where necessary, further developing the safeguards and controls in the future Agreement between the EU and Ecuador with respect to the protection of personal data. In this context, the EDPS recommends that the future Agreement explicitly lays down the list of the criminal offences regarding which personal data could be exchanged; provides for a periodic review of the need for storage of the transferred personal data as well as other appropriate measures ensuring that the time limits are observed; adduces additional safeguards as regards the transfer of special categories of data; ensures that no automated decision based on the received data under the Agreement would take place without the possibility for a human being to intervene in an effective and meaningful way; lays down clear and detailed rules regarding the information that should be made available to the data subjects.

text: The EDPS recalls that, pursuant to Article 8(3) of the Charter, the control by an independent authority is an essential element of the right to the protection of personal data. The EDPS therefore recommends to the Commission to pay special attention, during the negotiations to the oversight by independent public bodies responsible for data protection with effective powers vis-a-vis the law enforcement and other competent authorities of the Republic of Ecuador that will use the transferred personal data. In addition, in order to ensure proper implementation of the Agreement,

text: the EDPS also suggests that the Parties exchange on a regular basis information on the exercise of rights by data subjects as well as relevant information about the use of the oversight and redress mechanisms related to the application of the Agreement.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 22 February 2023 the European Commission issued a Recommendation for a Council decision authorising the opening of negotiations for an agreement between the European Union and the Republic of Ecuador on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Ecuadorian authorities competent for fighting serious crime and terrorism (‘the Proposal’). The Proposal is accompanied by its respective Annex.

text: 2. The objective of the Proposal is to open negotiations with the Republic of Ecuador with the purpose of signing and concluding an international agreement enabling the exchange of personal data between Europol and the Ecuadorian authorities competent for fighting serious crime and terrorism. The Annex to the Proposal lays down the Council’s negotiating directives to the Commission, i.e. the objectives the latter should aim to achieve on behalf of the EU in the course of these negotiations.

text: 3. In the Explanatory Memorandum of the Proposal the Commission assesses that Latin America’s organised crime groups pose a serious threat to the EU internal security as their actions are increasingly linked to a series of crimes within the Union, particularly in the realm of drug trafficking . The 2021 EU Serious and Organised Crime Threat Assessment (‘SOCTA’) by Europol highlights that unprecedented quantities of illicit drugs are trafficked from Latin America to the EU, generating multi-billion-euro profits, which are used to finance a diverse range of criminal organisations (international and EU-based) and to weaken the rule of law in the EU .

text: 4. Most of the drugs seized in the EU is transported by sea, primarily in maritime shipping containers , and shipped to the EU directly from the countries of production as well as from neighbouring countries of departure in Latin America, including the Republic of Ecuador . 5 Based on quantities of cocaine seized in European ports and in ports elsewhere destined for Europe, Ecuador (with a cocaine seizure of about 67.5 tonnes) was one of the main departure points in 2020, as it has been for some years .

text: 5. In its Programming Document 2022-2024, Europol has flagged that, among others, the growing demand for drugs and increased drug trafficking routes into the EU justify the need for enhanced cooperation with Latin American countries . In this sense, in December 2022, the Republic of Ecuador was included in Europol’s list of priority partners with which the agency may conclude Working Arrangements. In the same vein, Ecuador has been identified as a key international partner to reduce the global supply of cocaine by the European Monitoring Centre for Drugs and Drug Addiction (EMCDDA) .

text: 6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 22 February 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes that he has been consulted on the Proposal and expects a reference to this Opinion to be included in the preamble of the Council Decision. In addition, the EDPS welcomes the reference, in Recital 4 of the Proposal, to Recital 35 of the

text: Regulation (EU) 2016/794

text: (‘Europol Regulation’), which provides that the Commission should be able to consult the EDPS also during the negotiations of the Agreement and, in any event, before the Agreement is concluded.

text: 2. General remarks

text: 7. The Europol Regulation lays down specific rules regarding transfers of data by Europol outside of the EU.

text: Article 25(1)

text: thereof lists a number of legal grounds based on which Europol could lawfully transfer data to authorities of third countries. One possibility would be an adequacy decision of the Commission in accordance with

text: Article 36 of Directive (EU) 2016/680

text: (‘LED’) finding that the third country to which Europol transfers data ensures an adequate level of protection. Since there is no such adequacy decision for Ecuador at the moment, the other alternative for Europol to regularly transfer data would be the conclusion of a binding international agreement between the EU and the Republic of Ecuador, adducing adequate safeguards with respect to the protection of privacy and other fundamental rights and freedoms of individuals.

text: 8. Pursuant to

text: Article 216(2)

text: TFEU, international agreements concluded by the European Union ‛are binding upon the institutions of the Union and on the Member States’. Moreover, according to the settled case law of the Court of Justice of the European Union (‛CJEU’), 6 international agreements become from their coming into force ‛an integral part of 13 14 Community law’ , and they have primacy over acts of secondary Union legislation .

text: 9. Since the proposed Agreement would be a binding international instrument, the EDPS notes that, in line with the case law of the CJEU, the ‛obligations imposed by an international agreement cannot have the effect of prejudicing the constitutional principles of the EC Treaty, which include the principle that all Community acts must respect fundamental rights, that respect constituting a condition of their lawfulness’ . It is therefore essential to ensure that the obligations stemming from the Agreement would not prejudice these principles as far as data protection is concerned.

text: 10. Transfers of personal data gathered in the context of criminal investigations and further processing by Europol to produce criminal intelligence envisaged under the future Agreement are liable to have a significant impact on the lives of the individuals concerned, as they may potentially be used as incriminating evidence in prosecution cases in the receiving country under its national law.

text: 11. As transfers of personal data to third countries constitute an interference with individuals’ rights to privacy and data protection guaranteed by Articles 7 and 8 of the Charter, requirements of necessity and proportionality of the envisaged processing need to be assessed in accordance with Article 52(1) of the Charter . As a result, the international agreement must ensure that the limitations to rights to privacy and data protection in relation to the fight against serious crime and terrorism apply only in so far as is strictly necessary .

text: 12. Following the amendments of Europol Regulation in 2022 , Chapter IX of EUDPR applies to the processing of operational personal data by Europol. According to Recital 10 of EUDPR, the rules for the protection of operational personal data processed by Union bodies, offices or agencies, when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part Three TFEU, such as Europol, should be consistent with the LED. In this regard, Article 35(3) of the LED lays down the general principle that the level of protection of natural persons applicable in the EU must not be undermined by the transfer of their personal data to third countries or international organisations.

text: 13. The EDPS notes that there may be cases where adequate safeguards already follow from the third country’s legislation, international commitments and practices. In that regard, the EDPS welcomes and encourages the possible accession of Ecuador to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of 7 Personal Data (Convention 108+) . In other cases, a legally binding instrument, like the proposed Agreement, would need to provide for adequate and effective safeguards, thus allowing to overcome any shortcomings or limitations of the data protection framework of the third country. At the same time, the EDPS reminds that while Europol and the competent Ecuadorian authorities would be bound by the safeguards and the conditions for the transfer of personal data laid down in the future Agreement, they would be under no legal obligation to transfer the personal data in the first place.

text: 14. The EDPS furthermore considers that the proposed Agreement should also take into account the potential risks in case of transfer of personal data from a third country to Europol. The Europol Regulation explicitly prohibits processing by Europol of “any information which has clearly been obtained in obvious violation of human rights” . This safeguard is even more valid in the context of the extended powers of Europol pursuant to

text: Article 18

text: a(6) of the amended Europol Regulation to process personal data that do not relate to the categories of data subjects listed in Annex II of the same Regulation, provided by a third country on the basis of an international agreement like the envisaged one, or pursuant to

text: Article 4(1)

text: (t) thereof, which mandates Europol to propose to Member States to enter information alerts in the Schengen Information System based on data provided by third countries on persons involved in terrorism or serious crime. Therefore, the EDPS recommends the future Agreement to exclude explicitly transfers of personal data obtained in a manifest violation of human rights.

text: 15. The EDPS recalls that he has already had the opportunity to comment in 2018 and in 2020 on the exchange of personal data between Europol and the law enforcement authorities of third countries on the basis of Europol Regulation .

text: 16. The EDPS positively notes that the Commission has established by now, based also on a number of the recommendations from the previous EDPS Opinions on this matter, a wellstructured set of objectives (negotiating directives), incorporating fundamental data protection principles, which the Commission aims to achieve on behalf of the EU in the course of international negotiations to conclude agreements on the exchange of personal data between Europol and third country law enforcement authorities.

text: 17. In this context, the recommendations in this Opinion are aimed at clarifying and, where necessary, further developing the safeguards and controls in the future Agreement between the EU and Ecuador with respect to the protection of personal data. They are without prejudice to any additional recommendations that the EDPS could make on the basis of further available information and the provisions of the draft agreement during the negotiations.

text: 18. It is also important to note that the EDPS is consulted very early on in the process, at the stage of the draft mandate, before a full in-depth assessment of the laws and practices of Ecuador has been carried out. A possible way to provide additional input at this stage would be the Commission to further consult the EDPS during the negotiations of the Agreement, in line with Recital 4 of the Proposal. For instance, the EDPS may provide his comments on the general methodology applied by the Commission for this type of assessment as well as more targeted feedback on specific areas of concern in relation with the laws and practices of a third country, e.g. on the safeguards preventing potential transfers to Europol of personal data obtained in manifest violation of human rights.

text: 3. Purpose limitation and data minimisation

text: 19. Purpose limitation is among the key principles of the EU data protection framework. It requires, on the one hand, that personal data are collected for specified, explicit and legitimate purposes and, on the other hand, that personal data are not further processed in a manner that is incompatible with those purposes. Article 18 of the Europol Regulation lays down an exhaustive list of purposes for data processing activities by Europol that are considered legitimate.

text: 20. In that regard, the EDPS notes that directive 2 of the Annex limits the exchange of data under the future Agreement only to crimes and related criminal offences falling within Europol's competence in accordance with Article 3 of Europol Regulation, in particular, preventing and combating terrorism, disrupting organised crime and fighting drug trafficking and cybercrime. It also envisages that the Agreement should specify its scope and the purposes for which Europol may transfer personal data to the competent authorities of Ecuador. Furthermore, directive 3(b) of the Annex underlines the principle of specificity, according to which the data should not be processed for other purposes than for the purposes of the transfer. In addition, directive 3(c) aims to ensure that personal data would be adequate, relevant and limited to what is necessary in relation to that purpose. The EDPS considers that all these requirements also apply to any sharing or onward transfer, in accordance with directives 3(i) and (j).

text: 21. Given the strong emphasis placed on purpose limitation in the Europol Regulation and for additional legal certainty, the EDPS recommends that the future Agreement explicitly lays down the list of the criminal offences regarding which personal data could be exchanged. Moreover, the transferred personal data must be related to individual cases.

text: 22. In addition, the EDPS welcomes that the Agreement will oblige competent authorities of Ecuador to respect any restrictions Europol may impose on access or use of transferred personal data and specify how compliance with these restrictions will be enforced in practice.

text: 4. Storage limitation

text: 23. The EDPS notes that directive 3(c) of the Annex provides that personal data “will not be retained for longer than is necessary for the purposes for which they have been transferred”. Directive 3(f) further requires that the agreements should lay down rules on storage, review, correction and deletion of personal data. In that regard, the EDPS would like to point out that the Europol Regulation contains an elaborate regime for data storage with technical and procedural safeguards, which ensures that storage and erasure obligations are complied with in practice.

text: Article 31

text: thereof requires Europol to conduct reviews of the necessity and proportionality of storing the data every three years. This is 9 without prejudice to different retention periods communicated by data providers when sending the data to Europol, which are binding for Europol. Any decision to store the data after the first three years must be duly justified and the motivation must be recorded. Europol is also bound to erase the data that have been erased in the systems of the data provider as soon as it is informed thereof.

text: 24. The EDPS recommends that the future Agreement provides for a periodic review of the need for storage of the transferred personal data as well as other appropriate measures ensuring that the time limits are observed, e.g. a requirement for Europol to inform Ecuadorian authorities, to whom data have been communicated or transferred, about the moment when the data will be erased from its systems.

text: 5. Special categories of personal data and different categories of data subjects

text: 25. According to the CJEU case law, the need for safeguards applies particularly where the protection of the particular category of personal data that is sensitive data is at stake .

text: 26. In this regard, the EDPS welcomes directive 3(d) aiming to align the special categories of data and their processing with Article 30 of the Europol Regulation, as well as to ensure specific safeguards relating to the transfer of personal data on minors, victims of criminal offence, witnesses or other persons who can provide information concerning criminal offences. However, given the sensitivity of special categories of personal data, the EDPS suggests that the future Agreement adduces the safeguards provided in Article 30 of the Europol Regulation, such as the prohibition of the selection of a particular group of persons solely on the basis of such personal data.

text: 6. Automated decisions

text: 27. The EDPS welcomes directive 3(f) aiming to provide for safeguards in respect to automated processing of personal data. According to the case law of the CJEU, ‛the need for [...] safeguards is all the greater where personal data is subject to automated processing. Those considerations apply particularly where the protection of the particular category of personal data that is sensitive data is at stake’ .

text: 28. In that regard, the EDPS reminds that such safeguards should include at least the right to obtain human intervention. This would ensure that no automated decision based on the received data under the Agreement would take place without the possibility for a human being to intervene in an effective and meaningful way. This is especially important in the area of law enforcement, where the consequences of profiling on individuals are potentially even more severe.

text: 7. Data security

text: 29. The EDPS wishes to stress that ensuring the security of personal data is not only a clear requirement under EU law , but it is also considered by the CJEU as essential requirement in relation to the fundamental right to data protection . Data security is also essential for ensuring the confidentiality of criminal investigations.

text: 30. The EDPS therefore welcomes directive 3(h) of the Annex, the obligation to ensure security of personal data through appropriate technical and organisational measures, including by allowing only authorised persons to have access to personal data as well as an obligation of notification in the event of a personal data breach affecting data transferred under the Agreement. The EDPS considers it essential that security measures should cover data processed in the place of destination, as well as in transit.

text: 8. Right to information

text: 31. The EDPS welcomes the fact that directive 3(e) of the Annex requires that the future international agreement ensures “enforceable rights of individuals whose personal data are processed by laying down rules on the right of access, rectification and erasure, including the specific grounds which may allow any necessary and proportionate restrictions”. Furthermore, directive 3(f) provides for that the Agreement should lay down rules, inter alia, “on information to be made available to individuals”.

text: 32. The EDPS recalls that data subjects usually have no knowledge of the fact that their data are processed and transferred for law enforcement purposes. Therefore, the right to information, is of utmost importance as it allows the exercise of the other data protection rights, including the right to remedies, and ensures fair processing of the data .

text: 33. The EDPS recommends that the future Agreement lays down clear and detailed rules regarding the information that should be made available to the data subjects, in line with

text: Article 79

text: EUDPR. Such rules should also include information about the applicable regime for EU data subjects to exercise their rights of access, rectification and erasure in Ecuador. In the same vein, the future Agreement should also lay down mechanisms to facilitate the exercise of such rights in practice, e.g. consultations between the competent law enforcement authorities and Europol.

text: 9. Supervision

text: 34. Pursuant to Article 8(3) of the Charter, the control by an independent authority is an essential element of the right to the protection of personal data. Therefore, the EDPS welcomes directive 3(k) of the Annex, according to which the Agreement should ensure “a system of oversight by one or more independent public authorities responsible for data protection with effective powers of investigation and intervention to exercise oversight over those public authorities of the Republic of Ecuador that use personal data/exchanged information”.

text: 35. The EDPS recommends to the Commission to pay special attention during the negotiations to directive 3(k) concerning the oversight by independent public bodies responsible for data protection with effective powers vis-a-vis the law enforcement and other competent authorities of the Republic of Ecuador that will use the transferred personal data.

text: 10. Review of the Agreement

text: 36. The EDPS welcomes Article 5 of the Annex providing that the Agreement will include provisions on the monitoring and periodic evaluation of the Agreement.

text: 37. For the purposes of this review, the EDPS suggests that the Parties exchange on a regular basis information on the exercise of rights by data subjects, including statistics on the number of requests and their outcome, notably the number of cases where the right was restricted. In addition, the Parties could agree to exchange relevant information about the use of the oversight and redress mechanisms related to the application of the Agreement, including the decisions taken on that account.

text: 11. Conclusions

text: 38. In light of the above, the EDPS recommends: (1) that the future Agreement excludes explicitly transfers of personal data obtained in a manifest violation of human rights, (2) that the future Agreement explicitly lay down the list of the criminal offences regarding which personal data could be exchanged and that the transferred personal data must be related to individual cases, (3) that the future Agreement provide for a periodic review of the need for storage of the transferred personal data as well as other appropriate measures ensuring that the time limits are observed, (4) to ensure the future Agreement adduce the safeguards provided for in Article 30 of the Europol Regulation, (5) to ensure that security measures cover data processed in the place of destination, as well as in transit, 12 (6) to ensure that no automated decision based on the received data under the Agreement would take place without the possibility for a human being to intervene in an effective and meaningful way, (7) that the future Agreement lays down clear and detailed rules regarding the information that should be made available to the data subjects, (8) the Commission to pay special attention, during the negotiations to, draft directive 3(k) concerning the oversight by independent public bodies responsible for data protection with effective powers vis-a-vis the law enforcement and other competent authorities of the Republic of Ecuador that will use the transferred personal data, (9) for the purposes of this review of the Agreement, that the Parties exchange on a regular basis information on the exercise of rights by data subjects and relevant information about the use of the oversight and redress mechanisms related to the application of the Agreement. Brussels, 19 April 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 13


text: COM(2023) 930 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 930 final. 4 COM(2023) 930 final, p. 2. 4

text: COM(2023) 930 final, p. 8.

text: Article 16

text: a (5) and (6) and Recital 41 of the Proposal. 7

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1). 8

text: Article 16

text: a (5) and (6) and Recitals 40 and 41 of the Proposal. 5

text: See in particular

text: Articles 9.2

text: (b) and (g) and (i), 10.2 (b) and (g) GDPR and Articles

text: and

text: EUDPR. 6

identifier: EDPS yttrande 10/2024

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 10/2024 on the Proposal for a Council Directive on measures to facilitate protection consular protection for unrepresented citizens of the Union in third countries

serie: yttranden

text: 30 January 2024

type: rubrik

text: Opinion 10/2024

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Council Directive amending

text: Directive (EU) 2015/637

text: on the coordination and cooperation measures to facilitate consular protection for unrepresented citizens of the Union in third countries and

text: Directive (EU) 2019/997

text: establishing an EU Emergency Travel Document . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: Directive (EU) 2015/637

text: Directive (EU) 2019/997

text: establishing an EU Emergency Travel Document.

text: The objective of the Proposal is to improve the exercise by Union citizens of their fundamental right to consular protection, on the same conditions as the nationals of the Member State providing assistance, in particular in crisis situations.

text: The EDPS welcomes the fact that the Proposal includes specific provisions on data protection that, in particular, list the purposes of the personal data processing, identify the controllers involved in the processing and determine how long personal data may be processed.

text: To enhance legal certainty and foreseeability, the EDPS recommends complementing the list of the specific purposes provided for in

text: Article 16

text: a (1) with a reference to

text: Article 13(4)

text: , which concerns the processing of personal data of citizens who have used the possibility to register or inform the authorities of their travels to or residence in third countries. Furthermore, the EDPS recommends referring in both Recital 41 and in

text: Article 16

text: a (6) to data subjects’ ‘rights’, in addition to their ‘interests’ in accordance with the GDPR and EUDPR.

text: Contents

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 6 December 2023, the European Commission issued the Proposal for a Council Directive amending

text: Directive (EU) 2015/637

text: Directive (EU) 2019/997

text: establishing an EU Emergency Travel Document (‘the Proposal’).

text: 2. The objective of the Proposal is to amend

text: Directive (EU) 2015/637

text: , in order to improve the exercise by Union citizens of their fundamental right to consular protection, on the same conditions as the nationals of the Member State providing assistance. As noted in the Commission’s report of 2 September 2022 on the implementation and application of

text: Council Directive (EU) 2015/637

text: , there has been an increase in frequency and scale of crises resulting in requests for consular protection .

text: 3. In particular, the Proposal aims at clarifying the procedures and enhancing legal certainty for consular authorities and Union citizens as to the scope of the right to consular protection, ensuring clear roles, coordination and cooperation mechanisms between Member States and Union delegations, improving communication with unrepresented Union citizens through facilitated access to reliable information, and increasing the efficiency and use of the financial reimbursement procedures.

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 7 December 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 48 of the Proposal. The EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 5. The EDPS welcomes the explicit reference to the European data protection legal framework in Recitals 39 and 42, as well as in

text: Article 16

text: a the Proposal. As mentioned in the Explanatory Memorandum of the Proposal, ‘no derogation from the Union’s data protection regime is envisaged’, and ‘clear rules, conditions and safeguards must be implemented by Member States in line with the Union data protection rules’ .

text: 6. The EDPS also welcomes that the Proposal includes a number of specific safeguards, including a clear delineation of purposes and legal bases of the processing, limitations on the storage period and a clear designation of the controllers of the processing. In that regard, the EDPS positively notes that

text: Article 16

text: a (3) of the Proposal aims to determine the roles of the competent authorities of Member States and of Union institutions and bodies when processing personal data, by stating that they should be considered ‘within the scope of their respective activities’ as the controller under EU data protection law.

text: 7. Against this background, the EDPS also notes with satisfaction that

text: Article 16

text: a(1) clearly identifies which specific purposes and the corresponding provisions of

text: Directive (EU) 2015/637

text: (as amended by the Proposal) could legitimate the processing of personal data. At the same time, to ensure completeness, the EDPS recommends adding to the list in

text: Article 16

text: a(1) a reference to

text: Article 13(4)

text: as well, regarding the processing of the personal data of citizens who have used the possibility to register or inform the authorities of their travels to or residence in third countries.

text: 8. The EDPS also positively notes the introduction of specific retention periods in

text: Article 16

text: a (8), for the personal data of an assisted person. This provision should be read in conjunction with Recital 43 of the Proposal, which justifies the necessity to retain the personal data of an assisted person for such periods of time, in the light of the tasks referred to in paragraphs 1 and 2 of

text: Article 16

text: a.

text: 3. Sensitive data and data relating to criminal convictions and offences

text: 9. The EDPS notes that the Proposal foresees the processing of special categories of personal data as well as personal data relating to criminal convictions and offences of a person in need of consular protection , which are subject to specific requirements, both 7 8 in the Regulation 2016/679 (‘GDPR’) and EUDPR .

text: 10. In that regard, the EDPS welcomes that the Proposal requires Member States and Union institutions and bodies to provide for (further) appropriate safeguards for the rights of data subjects when processing special categories of personal data or when processing of personal data relating to criminal convictions and offences. The EDPS also welcomes that the recitals accompanying the Proposal offer a clear indication of the (limited) circumstance in which the processing of such special categories of data may be necessary and offers examples of specific technical measures that should be considered to protect these data.

text: 11. Finally, the EDPS notes that Recital 41 and

text: Article 16

text: a (6) of the Proposal lay down that the national and Union competent authorities should ensure suitable and specific measures to safeguard data subjects’ ‘interests’. The EDPS recommends referring both in the Recital and in the Article to data subjects’ ‘rights’, in addition to their ‘interests’, in accordance with the GDPR and EUDPR .

text: 4. Conclusions

text: 12. In light of the above, the EDPS makes the following recommendations: (2) to refer both in Recital 41 and in

text: Article 16

text: a (6) to data subjects’ ‘rights’, in addition to their ‘interests’, in accordance with the GDPR and EUDPR. Brussels, 30 January 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI

type: vagledning

utgivare: edps


text: COM(2025) 180 final 1

text: COM(2025) 180 final 2

text: OJ L 295, 21.11.2018, p. 39. 4 COM(2025) 180 final. COM(2025) 180 final, p. 1. 6 Directive

text: of the European Parliament and of the Council of 3 April 2014 on periodic roadworthiness tests for motor vehicles and their trailers and repealing Directive

text: , OJ L 127 29.4.2014, p. 51. 7 Directive

text: of the European Parliament and of the Council of 3 April 2014 on the technical roadside inspection of the roadworthiness of commercial vehicles circulating in the Union and repealing Directive

text: , OJ L 127 29.4.2014, p. 134. 8 COM(2025) 180 final, p. 3. 4

text: COM(2020) 789 final. 10 COM(2025) 180 final, p. 3. 11 Recital 2 of the Proposal. 12 Recital 2 of the Proposal. 13 COM(2025) 180 final, p. 4. 14

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (Text with EEA relevance), OJ L 119, 4.5.2016, p. 1. 5

text: Article 25

text: GDPR. 6

identifier: EDPS yttrande 10/2025

title: EDPS Opinion 10/2025 on Proposals to amend Directives on periodic roadworthiness tests for motor vehicles and their trailers and on the technical roadside inspection of the roadworthiness of commercial vehicles circulating in the Union

text: Opinion 10/2025 on the Proposal to amend Directive

text: on periodic roadworthiness tests for motor vehicles and their trailers and Directive

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Directive amending Directive

text: on the technical roadside inspection of the roadworthiness of commercial vehicles circulating in the Union . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 24 April 2025, the European Commission issued a Proposal for a Directive of the European Parliament and of the Council amending Directive

text: on the technical roadside inspection of the roadworthiness of commercial vehicles circulating in the Union (‘the Proposal’).

text: The Proposal aims to amend Directive

text: and Directive

text: in order to further improve road safety in the EU, contributing to sustainable mobility and facilitating the free movement of people and goods in the EU.

text: The EDPS notes that the Proposal would mainly entail processing of non-personal data, as specified in the two annexes to the Proposal. As exchanging information on vehicle registration certificates and roadworthiness certificates may nevertheless involve processing of personal data, the EDPS welcomes that the Proposal recalls the need to ensure that any personal data processing necessary for its implementation complies with the data protection framework of the Union. The EDPS also welcomes that the Proposal indicates that verification techniques not requiring transmission of personal data on individual certificates should be used for the verification of roadworthiness certificates, which is in line with the principle of data protection by default.

text: Given the subject matter and the provisions of the Proposal, which do not raise specific issues having regard to the protection of personal data, the EDPS does not have specific comments or recommendations on the Proposal.

text: Contents

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 24 April, the European Commission issued a Proposal for a Directive of the European Parliament and of the Council amending Directive

text: 2. The objective of the Proposal is to revise the following two Directives : 1) Directive

text: of the European Parliament and of the Council on periodic roadworthiness tests for motor vehicles and their trailers ; and 2) Directive

text: of the European Parliament and of the Council on the technical roadside inspection of the roadworthiness of commercial vehicles circulating in the Union .

text: 3. The objectives of the revision are to : 1) ensure the consistency, objectivity, quality of roadworthiness testing of today’s and tomorrow’s vehicles; 2) significantly reduce tampering and improve the detection of defective vehicles with faulty or tampered safety and emission control systems, as well as tampered odometers; 3) improve electronic storage and the exchange of relevant vehicle identification and status data to address the problem of insufficient data availability and facilitate mutual recognition by enforcement authorities.

text: 4. The Proposal is accompanied by two annexes, specifying the amendments to Annex I to Directive

text: and the amendments to Annex II to Directive

text: respectively.

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 30 April, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 39 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 6. The Sustainable and Smart Mobility Strategy called for adjustments to the roadworthiness legislative framework to ensure a vehicle’s lifetime compliance with emission and safety standards. The Proposal aims to amend the Directive

text: and the Directive

text: in order to further improve road safety in the EU, contributing to sustainable mobility and facilitating the free movement of people and goods in the EU .

text: 7. Directive

text: sets out the minimum content and frequency of testing for each vehicle category (except for motorcycles), as well as the content of the roadworthiness certificate. The validity of that certificate, as well as any other proof of testing, is to be recognised by Member States for the purposes of free circulation and re-registering a vehicle already registered in another Member State .

text: 8. Directive

text: complements the Directive

text: by requiring Member States to carry out roadside inspections on heavy commercial vehicles above 3.5 tonnes, including buses, lorries, and their trailers. Those inspections include an initial roadside inspection and, if deemed necessary by the inspector, a more detailed technical roadside inspection .

text: 9. The EDPS observes that the Proposal would mainly entail processing of non-personal data, as specified in the two annexes to the Proposal. As noted by the Explanatory Memorandum , however, rules on the protection of personal data would apply to exchanging information on vehicle registration certificates and roadworthiness certificates, as well as related vehicle registration data, in particular

text: Regulation (EU) 2016/679

text: (General Data Protection Regulation) . In this regard, the EDPS notes that

text: Article 8(9)

text: (b) of the Proposal would empower the Commission to adopt implementing acts containing the technical specifications and rules for the purpose of ensuring the ensuring the protection and security of personal data.

text: 10. Against this background, the EDPS welcomes that recital 20 of the Proposal recalls the need to ensure that personal data processing for the implementation of this Directive complies with the data protection framework of the Union, in particular the GDPR. The EDPS also welcomes that the Proposal indicates that verification techniques not requiring transmission of personal data on individual certificates should be used for the verification of roadworthiness certificates. This is in line with the principle of data protection by default , which requires from the controller the implementation of appropriate technical and organisational measures ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed.

text: 3. Conclusion

text: 11. Given the subject matter and the provisions of the Proposal, which do not raise specific issues having regard to the protection of personal data, the EDPS has no further comments on the Proposal. Brussels, 17 June 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI


text: COM (2026) 321 final 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM (2026) 321 final. 4 Article 1(2) of the Proposal - ‘Business Registers Interconnection System’ (‘BRIS’) means the system of interconnection of registers operating at the Union level, composed by the business registers of the Member States, the platform and the E-Justice portal as referred to

text: Article 22 of Directive (EU) 2017/1132

text: . 4

text: Article 1 of the Proposal. Article 1 of the Proposal. 7 Explanatory Memorandum, p. 2. 8 Explanatory Memorandum, p. 15. 9 See for instance the reference to personal data of legal representatives and other persons that can lawfully represent a company, in recital 79 of the Proposal. 10 Article 100(1) of the Proposal. 11

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (Text with EEA relevance), OJ L 119, 4.5.2016, pp. 1–88. 5

text: Article 25 of the Proposal. 13 Article 26 of the Proposal. 14 Articles 25 and 26 of the Proposal and Annex to the Proposal. 15 In its judgment of 9 March 2017, the Court of Justice of the European Union (‘CJEU’) considered that the public nature of the company register in question was intended to ensure legal certainty in dealings between companies and third parties and to protect, 15 in particular, the interests of third parties in relation to joint stock companies and limited liability companies . The CJEU considered that the interference with the fundamental rights of the persons concerned (in particular the right to respect for private life and the right to protection of personal data guaranteed by the Charter of Fundamental Rights of the Union) was not disproportionate in so far as disclosure was required only for a limited number of personal data items, and the only safeguards that joint-stock companies and limited liability companies offer to third parties were their assets. Therefore, the CJEU considered it justified that natural persons who choose to participate in trade through such a joint stock company or limited liability company should be required to disclose data relating to their identity and functions within that company. See Judgment of the Court of Justice of the European Union of 9 March 2017, Camera di Commercio, Industria, Artigianato e Agricoltura di Lecce v. Salvatore Manni,

text: Case C-398/15

text: , ECLI:EU:C:2016:652. See also EDPS Opinion 19/2023 on the Proposal for a Directive amending Directives

text: and

text: (EU) 2017/1132

text: as regards further expanding and upgrading the use of digital tools and processes in company law, 17 May 2023, paragraphs 11-13. 6

text: Articles 1(1) and 15 of the Proposal. 17 See:

text: Article 22 of Directive (EU) 2017/1132

text: of the European Parliament and of the Council of 14 June 2017 relating to certain aspects of company law (codification), OJ L 169, 30.6.2017, pp. 46–127, ELI: http://data.europa.eu/eli/dir/2017/1132/oj 18

text: Article 15

text: and Recital 21 of the Proposal. 19

text: Article 34

text: and Recital 23 of the Proposal. 20 See EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: , issued on 7 November 2019, p.8. 21 Articles 16 and 17 of the Proposal. 22 See EDPS Guidance for co-legislators on key elements of legislative Proposals, issued on 7 May 2025, p.9. 23 See EDPS Guidance for co-legislators on key elements of legislative Proposals, issued on 7 May 2025, p.18. 7

text: Article 54(1)

text: (a) of the Proposal. 25

text: Article 54(1)

text: (b) of the Proposal. 26

text: Article 54(1)

text: (l) of the Proposal. 27 See EDPS Guidance for co-legislators on key elements of legislative Proposals, issued on 7 May 2025, p.1 See also 28

text: Directive (EU) 2024/1640

text: of the European Parliament and of the Council of 31 May 2024 on the mechanisms to be put in place by Member States for the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending

text: Directive (EU) 2019/1937

text: , and amending and repealing

text: Directive (EU) 2015/849

text: (Text with EEA relevance), OJ L, 2024/1640, 19.6.2024, ELI: http://data.europa.eu/eli/dir/2024/1640/oj 29 Article 54(2) of the Proposal. 30 Article 97 of the Proposal. 31 Article 98 of the Proposal. 8

text: See EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: , issued on 7 November 2019, EDPS Guidance for co-legislators on key elements of legislative Proposals, issued on 7 May 2025, p.9. 33 Article 100(1) of the Proposal. 34 Article 100(2) of the Proposal. 35 See EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: , issued on 7 November 2019. 36 Wirtschaftsakademie v Schleswig-Holstein See: Judgment of the Court (Grand Chamber) of 5 June 2018, case

text: , , paragraph 29. 37 Article 100(4) of the Proposal. 38

text: Article 5(1)

text: (e) GDPR. 9

text: In this regard, the EDPS reminds the Commission of its obligation to consult the EDPS when preparing delegated or implementing acts that would impact on the protection of individuals' rights and freedoms with regard to the processing of personal data pursuant to Article 42(1) of the EUDPR.

identifier: EDPS yttrande 10/2026

title: EDPS Opinion 10/2026 on the Proposal for a Regulation on the 28th Regime Corporate Legal Framework – 'EU Inc.'.

text: Opinion 10/2026

text: on the Proposal for a Regulation on the 28th Regime Corporate Legal Framework – ‘EU Inc.’

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation on the 28 Regime Corporate Legal Framework – ‘EU Inc.’ . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 18 March 2026, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on the 28th Regime Corporate Legal Framework – ‘EU Inc.’ (‘the Proposal’).

text: The EDPS welcomes the overall objective of the Proposal to provide better conditions for starting a business and better opportunities for growth and scaling up in the EU, and to encourage more investment into EU companies, particularly in their early and growth stages.

text: The Proposal would require from the Member State of registration of the company to ensure that certain documents and information filed by the EU Inc. are made publicly accessible through national business registers and through the Business Registers Interconnection System (BRIS). The EDPS welcomes that the Proposal specifies in an exhaustive manner which categories of personal data must be processed in the national registers and in the BRIS.

text: The Proposal would require from the Commission to establish, operate and maintain an EU central interface and to further develop this interface towards a central digital register for EU Inc. companies. In this regard, the EDPS recommends further clarifying the roles of the Commission and Member States with regard to the EU central interface and the central digital register from a data protection perspective. In addition, the EDPS also recommends specifying the maximum storage period or the criteria to determine such storage period related to personal data processed in the EU central interface and in the central digital register.

text: The Proposal would introduce the obligation for every EU Inc. to maintain an up-to-date digital register of shares, which would contain at least the information enumerated in this provision. In this regard, the EDPS recommends ensuring that the Proposal specifies, in an exhaustive manner, which personal data should be included. The EDPS also recommends adding that access to information on beneficiaries under letter (l) of Article 54(1) of the Proposal would only be provided in accordance with the provisions in section 1 of Chapter II of

text: Directive (EU) 2024/1640

text: . In addition, the EDPS recommends clearly defining the ‘interested parties’ who may consult the digital register of shares. The maximum storage period (or the criteria to determine such storage period) of personal data stored in the digital register of shares should be specified.

text: Concerning the establishment of a system interconnecting the national electronic auction systems, the EDPS recommends to further clarify the roles and responsibilities of the entities maintaining the electronic auction platforms at national level. In addition, the EDPS recommends specifying in the enacting terms of the Proposal the maximum storage period or the criteria to determine such storage period related to personal data stored in the national auction systems operated by the Member States or other bodies.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 18 March 2026, the European Commission issued Proposal for a Regulation of the th European Parliament and of the Council on the 28 Regime Corporate Legal Framework – ‘EU Inc.’ (‘the Proposal’).

text: 2. The objective of the Proposal is to lay down rules to improve the functioning of the internal market and to create an efficient legal framework for companies and investors by: a) creating a new harmonised legal form of a limited liability company (‘EU Inc.’) provided in the legal order of every Member State; b) creating an EU central interface, based on the Business Registers Interconnection System (‘BRIS’) , for the purposes of the registration of companies taking the EU Inc. legal form, as well as for filing by EU Inc. companies; c) introducing measures to reduce obstacles to the use and acceptance of documents and information regarding EU Inc. companies including through the application of the once-only principle; d) introducing measures to reduce administrative burden in procedures covered by this Regulation throughout the lifecycle of EU Inc. companies including investment related procedures; e) removing obstacles with respect to financing of EU Inc. companies and investment in such companies; f) harmonising certain aspects of insolvency procedures applicable to specific categories of undertakings taking the legal form of EU Inc.; g) prohibiting certain discriminatory measures with respect to EU Inc. companies whose registered office is in another Member State .

text: 3. The Proposal is accompanied by an Annex containing minimum content of the articles of association of an EU Inc. company.

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 18 May 2026, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 86 of the Proposal.

text: 2. General remarks

text: 5. The EDPS acknowledges the importance of improving the functioning of the internal market and creating an efficient legal framework for companies and investors . In this regard, the EDPS notes that the overall objective of the Proposal is to provide better conditions for starting a business and better opportunities for growth and scaling up in the EU, and to encourage more investment into EU companies, particularly in their early and growth stages .

text: 6. The EDPS remarks that the implementation of the Proposal would entail the processing of personal data. In particular, the Proposal would require the public disclosure of and crossborder access to certain information in relation to EU Inc. companies in national business registers and through BRIS. Furthermore, the EU central interface for registration of and filing by EU Inc. companies would collect company related data and forward it to the national business register . The implementation of the Proposal would also entail the processing of personal data by the Commission in the system of interconnection of electronic auction platforms .

text: 7. Against this background, the EDPS welcomes recital 79 of the Proposal specifying that the Commission should process personal data in the context of the Proposal in accordance with the EUDPR.

text: 8. The EDPS also notes that Article 104 of the Proposal specifies that the processing of any personal data carried out in the context of the Proposal should be subject to the

text: Regulation (EU) 2016/679

text: (‘the GDPR’) and to the EUDPR. As both the GDPR and EUDPR in any case apply to the processing of personal the processing of any personal data carried out in the context of the Proposal, the EDPS recommends removing this specification from the enacting terms of the Proposal and retaining it only in the recitals.

text: 3. Publication of personal data in the business register

text: 9. Under the Proposal, the Member State of registration of the company must ensure that certain documents and information filed by the EU Inc. are made publicly accessible in the business register . The Proposal further sets out which documents and information should be made available at Union level through the Business Registers Interconnection System (‘BRIS’) . The EDPS welcomes that the Proposal specifies in an exhaustive manner which categories of personal data must be processed in the national registers and in the BRIS.

text: 10. The EDPS notes that the Proposal provides for public access to information of the persons who are authorised to represent the EU Inc., the identity of the first director of an EU Inc., and the identity of the founding shareholder(s) of an EU Inc.

text: 11. The EDPS recalls that, according to settled case law of the Court of Justice of the European Union (‘CJEU’), legislation providing for the public disclosure of personal data interferes with the rights to protection of personal life and to personal data. Any requirement to publish personal data should, in addition to being provided by law, also fulfil the other requirements arising from Article 52(1) of the Charter and Article 6(3) of the GDPR, and in particular must meet an objective of public interest and be proportionate to the legitimate aim pursued.

text: 12. The EDPS considers that the publication of personal envisaged by the Proposal should be considered as proportionate, as it only requires publication of a limited number of personal data items relating to specific individuals that fulfil a specific role in the company. In essence, the Proposal would require public disclosure of limited personal data concerning individuals authorized to represent the company in dealings with third parties and to represent it or take part in the administration, supervision or control of that company, or having been appointed as liquidator of that company .

text: 4. The EU central interface and the central digital register

text: 13. The Proposal would require from the Commission to establish, operate and maintain the 16 17 EU central interface as part of the European electronic access point to BRIS . The EU central interface should securely transmit the information and documents to the business register of the Member State in which the EU Inc. company is to be registered and the business registers should automatically exchange the relevant information with the preventive control authorities . The Commission should further develop the EU central interface towards a central digital register for EU Inc. companies, building on the functionalities of the registers of the Member States and the existing interconnection infrastructure . The EDPS recommends to expressly clarify the roles of the Commission and Member States with regard to the EU central interface and the central digital register from a data protection perspective. Clearly designating the controller(s) of specific processing operation(s) from the outset provides legal certainty and helps to avoid any possible problem of interpretation in assessing the role of the actors involved . When carrying out a processing operation, the controller is the one deciding on the purpose (‘why’) and on the means to carry out such processing operation (‘how’). In this regard, the EDPS observes that EU Inc. companies may be formed directly through the EU central interface and that this interface will eventually further develop towards a central register. It would therefore be logical that the Commission be designated the role of as controller with regard to the EU central interface and to the central digital register. Personal data processed in the business registers of Member States, however, remains under the control of the Member States.

text: 14. The EDPS recommends specifying in the enacting terms of the Proposal the maximum storage period (or at least the criteria to determine such storage period) related to personal data processed in the EU central interface and in the central digital register .

text: 5. Digital register of shares

text: 15. Article 54(1) of the Proposal would introduce the obligation for every EU Inc. to create upon registration and maintain an up-to-date digital register of shares, which would contain at least the information enumerated in this provision.

text: 16. The EDPS notes that the application of this provision would entail the processing of personal data in the context of the digital register of shares such as the identity and address of all the shareholders , identity and address of a common representative of the 25 26 shareholders and the name of the beneficiaries of the shares .

text: 17. The EDPS recalls that a legislative proposal which provides for the processing of personal data, should, as a rule, specify the categories of personal data in a comprehensive manner. Open-ended formulations (e.g., “any other relevant data”, “at least”, ...) should be avoided .

text: 18. Against this background, the EDPS recommends deleting “at least” in Article 54(1) of the Proposal and providing instead an exhaustive list of the information to be provided by the EU Inc. The EDPS also recommends adding that access to information on beneficiaries under letter (l) of Article 54(1) of the Proposal would only be provided in accordance with the provisions in section 1 of Chapter II of

text: Directive (EU) 2024/1640

text: 19. The EDPS notes that the Proposal would provide that the digital register of shares must be accessible to any shareholder and any other interested party with a legitimate interest in accordance with the GDPR . The EDPS recommends clearly defining in the Proposal the ‘interested parties’ to which the digital register of shares, in addition to the shareholders of the EU Inc., would be accessible and deleting the reference to “with a legitimate interest, in accordance with

text: Regulation (EU) 2016/679

text: ”. In addition, the EDPS recommends specifying in the Proposal the maximum storage period or the criteria to determine such storage period related to personal data stored in the digital register of shares, following the expiry of which the personal data should be deleted.

text: 20. Finally, the EDPS welcomes Recital 80 specifying that, to facilitate compliance with data protection rules and ensure the implementation of proportionate data protection measures, the EU templates for the articles of association would contain provisions on data protection related to the digital register of shares.

text: 6. The system of interconnection of electronic auction platforms

text: 21. According to the Proposal the Member States would be required to establish and operate one or more national electronic auction platforms for the realisation of the assets of the insolvency estate in insolvency proceedings of at least EU Inc. companies that are innovative startups . The Commission would be required to establish a system interconnecting the national electronic auction systems via the European e-Justice Portal, which should serve as a central electronic access point .

text: 7. Roles and responsibilities

text: 22. The EDPS recalls that the concepts of controller, joint controller and processor play a crucial role in the application of data protection law, since they determine who is responsible for compliance with different data protection rules, and how data subjects can exercise their rights in practice .

text: 23. The EDPS welcomes that the Proposal aims to clarify the role of the Commission as controller for the system for the interconnection of the national electronic auction systems and stipulates that the Commission must define the necessary policies and apply the necessary technical solutions to fulfil its responsibilities within the scope of the function of controller .

text: 24. The EDPS recommends also clarifying the roles and responsibilities of the entities maintaining the electronic auction platforms at national level (as controllers, joint controllers or processors) in relation to the processing of personal data in the context of the system of interconnection of electronic auction platforms.

text: 25. In line with Article 26 of the GDPR, where two or more controllers determine the purposes and means of the processing, they shall be joint controllers . Insofar as the various actors act as joint controllers, they shall in transparent manner determine their respective responsibilities for compliance with their data protection obligations, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information . In that case, the distribution of tasks between them should be laid down either by law or by an arrangement between the joint controllers.

text: 7.1. Data storage and security of personal data

text: 26. The EDPS welcomes the specification provided in the Proposal that with regard to the information from the interconnected national auction systems, no personal data relating to data subjects shall be stored in the European e-Justice Portal and that all such data shall be stored in the national auction systems operated by the Member States or other bodies .

text: 27. The EDPS recalls that the principle of storage limitation requires that personal data are stored in a form that permits identification of data subjects for no longer than is necessary for the purpose for which the personal data are processed. Therefore, the EDPS recommends specifying in the enacting terms of the Proposal the maximum storage period or the criteria to determine such storage period related to personal data stored in the national auction systems operated by the Member States or other bodies, following the expiry of which the personal data should be deleted .

text: 28. The data controllers must implement appropriate technical and organisational measures to ensure a level of security of personal data appropriate to the risk. In this context, the EDPS also welcomes that the Proposal specifies that the Commission shall implement the technical measures required to ensure the security of personal data while in transit, in particular the confidentiality and integrity of any transmission to and from the European e-Justice Portal .

text: 7.2. Implementing acts

text: 29. Pursuant to Articles 35(3) and 98(2) of the Proposal, the Commission should lay down, by means of implementing acts, multilingual templates for articles of association and application forms to establish and EU Inc., a detailed list of data to be transmitted to exchange information between registers and the availability of documents and information through BRIS as well as technical specifications and procedures necessary to provide for the interconnection of Member States’ national electronic auction systems, setting out, among other matters, specification of which personal data can be accessed and data protection safeguards.

text: 8. Conclusions

text: 31. In light of the above, the EDPS makes the following recommendations: (1) to recall that the processing of any personal data carried out in the context of the Proposal should be subject to the GDPR and to the EUDPR by way of recital only and deleting Article 104 of the Proposal; (2) to expressly clarify the roles of the Commission and Member States with regard to the EU central interface and the central digital register from a data protection perspective; (3) to specify the maximum storage period or the criteria to determine such storage period related to personal data processed in the EU central interface and in the central digital register; (5) to add that access to information on beneficiaries under letter (l) of Article 54(1) of the Proposal would only be provided in accordance with the provisions in section 1 of Chapter II of

text: Directive (EU) 2024/1640

text: ; (6) to define in the Proposal the ‘interested parties’ to which the digital register of shares, in addition to the shareholders of the EU Inc., would be accessible and deleting the reference to “with a legitimate interest, in accordance with

text: Regulation (EU) 2016/679

text: ”; (7) to specify in the Proposal the maximum storage period or the criteria to determine such storage period related to personal data stored in the digital register of shares, following the expiry of which the personal data should be deleted; (8) to clarify the roles and responsibilities of the entities maintaining the electronic auction platforms at national level (as controllers, joint controllers or processors) in relation to the processing of personal data in the context of the system of interconnection of electronic auction platforms; (9) to specify in the enacting terms of the Proposal the maximum storage period or the criteria to determine such storage period related to personal data stored in the national auction systems operated by the Member States or other bodies. Brussels, 12 May 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 11