text: COM(2023) 234 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 234 final. 4 See Article 1 of the Proposal. United Nations 2003, United Nations Convention Against Corruption, Treaty Series 2349 (October): 41, https://www.unodc.org/unodc/en/treaties/CAC. 6 See COM(2023) 234 final, p. 3. 7 https://commission.europa.eu/system/files/2022-10/cwp_2023.pdf 8 Commission Communication on the EU Security Union Strategy, COM/2020/605 final. 9 Commission Communication on the EU Strategy to Tackle Organised Crime 2021-2025, COM(2021) 170 final. 4

text: See e.g. the Joint Handbook of the EP, the Council and the Commission for the presentation and drafting of acts subject to the ordinary legislative procedure, March 2022 edition, page 37. 11 See COM(2023) 234 final, p. 15. 12 For more information see EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data, 2019, available at https://edps.europa.eu/sites/edp/files/publication/19-12- 19_edps_proportionality_guidelines_en.pdf 5

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89–131. 14

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1. 15 See for example the EDPS Opinion of 14 January 2011 on the Communication “A comprehensive approach on personal data in the European Union”, the EDPS Opinion 5/2017 of 15 March 2017 on upgrading data protection rules for EU institutions and bodies and the Contribution by the EDPS to the Report on the application of the EUDPR, 21 December 2021. 6

text: See COM(2023) 234 final, p. 2. 17 Article 3(3) of the Proposal. 18 See e.g. CJEU judgment of 22 November 2022, Luxembourg Business Registers,

text: Case C-37/20

text: (Joined Cases

text: ), ECLI:EU:C:2022:912; CJEU judgment of 1 August 2022, Vilniaus apygardos administracinis teismas,

text: , ECLI:EU:C:2022:601 19 CJEU judgment of 1 August 2022, Vilniaus apygardos administracinis teismas,

text: , ECLI:EU:C:2022:601, paragraphs 100-104. 20 Idem, paragraph 128. 21

text: , Opinion 02/2016 on the publication of personal data for transparency purposes in the public sector, available at https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2016/wp239_en.pdf 7

text: See

text: Article 3

text: , paragraph 4 of the Proposal. 23 See

text: Directive (EU) 2016/681

text: of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (OJ L 119, 4.5.2016, p. 132). 8

text: 25 26 (ETIAS) , Eurodac and the Visa Information System (VIS) , which have very different objectives and scope from the current Proposal, are unclear, may create legal uncertainty and could be misinterpreted. Given the wording of Article 24 of the Proposal, EDPS understands the scope of cooperation in

text: Article 24

text: to be limited to providing “technical and operational assistance in accordance with their respective mandates”.

text: p.o. Leonardo CRVERA NAVAS Acting Head of EDPS Secretariat

text: See

text: Regulation (EU) 2018/1240

text: of the European Parliament and of the Council of 12 September 2018 establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations

text: (EU) No 1077/2011

text: (EU) No 515/2014

text: (EU) 2016/399

text: (EU) 2016/1624

text: and

text: (EU) 2017/2226

text: (OJ L 236, 19.9.2018, p. 1). 25 See

text: Regulation (EU) No 603/2013

text: of the European Parliament and of the Council of 26 June 2013 on the establishment of 'Eurodac' for the comparison of fingerprints for the effective application of

text: Regulation (EU) No 604/2013

text: establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person and on requests for the comparison with Eurodac data by Member States' law enforcement authorities and Europol for law enforcement purposes, and amending

text: Regulation (EU) No 1077/2011

text: establishing a European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice (OJ L 180, 29.6.2013, p. 1). 26 Council Decision 2008/633/JHA of 23 June 2008 concerning access for consultation of the Visa Information System (VIS) by designated authorities of Member States and by Europol for the purposes of the prevention, detection and investigation of terrorist offences and of other serious criminal offences (OJ L 218, 13.8.2008, p. 129).

text: See also the remarks on

text: Article 24

text: on pages 19-20 of the Explanatory Memorandum of the Proposal. 9

identifier: EDPS yttrande 29/2023

title: EDPS Opinion 29/2023 on the Proposal for a Directive on combating corruption

text: 28 June 2023

text: Opinion 29/2023

text: on the Proposal for a Directive on combating corruption

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Directive of the European Parliament and of the Council on combating corruption, replacing Council Framework Decision 2003/568/JHA and the Convention on the fight against corruption involving officials of the European Communities or officials of Member States of the European Union and amending

text: Directive (EU) 2017/1371

text: of the European Parliament and of the Council .

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 3 May 2023, the European Commission issued a Proposal for a Directive of the European Parliament and of the Council on combating corruption, replacing Council Framework Decision 2003/568/JHA and the Convention on the fight against corruption involving officials of the European Commgunities or officials of Member States of the European Union and amending

text: Directive (EU) 2017/1371

text: of the European Parliament and of the Council (‘the Proposal’). Its objective is to establish minimum rules concerning the definition of criminal offences and sanctions in the area of corruption, as well as measures to better prevent and fight corruption. It also aims to update the EU legislative framework, including by incorporating international standards binding on the EU, such as those of the United Nations Convention against Corruption (UNCAC).

text: The EDPS strongly supports the objective of the Proposal to further enhance and harmonise the legal framework on the fight against corruption in the EU. Corruption is an endemic phenomenon that takes multiple shapes and forms and may affect virtually all spheres and aspects of public life. It is highly damaging to society, to the economy and to individuals. In this regard, the EDPS shares the view of the Commission that the fight against corruption and the protection of fundamental rights are complementary, not conflicting, objectives. Nevertheless, any limitation on the exercise of fundamental rights and freedoms should be subject to the conditions set out in Article 52(1) of the Charter of Fundamental Rights, in particular the principle of proportionality. This is particularly relevant with regard to preventive measures such as publication online of conflict of interest and assets declarations.

text: The EDPS considers that, further to the envisaged criminal law measures (i.e. the approximation of definitions of criminal offences and alignment of criminal sanctions), the Proposal also provides an opportunity for setting common standards and thus harmonisation of the national legal frameworks of Member States in the area of prevention of corruption. To this end, the EDPS invites the Union legislators to enhance Article 3 of the Proposal in order to establish a comprehensive legal basis under Union law for the processing of personal data that is necessary to prevent corruption. In any event, the EDPS considers that the Proposal should clearly define what categories of personal data and of which categories of data subjects may be publicly disclosed as part of the measures for prevention of corruption, and under what circumstances, as well as the necessary safeguards applicable in such cases.

text: In addition, the EDPS recalls the applicability of the existing EU data protection legal rules in the field of prevention and fight against corruption. Finally, as regards the cooperation and exchange of information between competent national and EU authorities, the Proposal should clarify the suggested links between the Proposal and a number of other EU legal acts with very different objectives and scope, such as the passenger name record (PNR), European Travel Information and Authorisation System (ETIAS), Eurodac, and the Visa Information System (VIS).

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 3 May 2023, the European Commission issued a Proposal for a Directive of the European Parliament and of the Council on combating corruption, replacing Council Framework Decision 2003/568/JHA and the Convention on the fight against corruption involving officials of the European Communities or officials of Member States of the European Union and amending

text: Directive (EU) 2017/1371

text: of the European Parliament and of the Council (‘the Proposal’).

text: 2. The objective of the Proposal is to establish minimum rules concerning the definition of criminal offences and sanctions in the area of corruption, as well as measures to better prevent and fight corruption . It strives to update the EU legislative framework, including by incorporating international standards binding on the EU, such as those of the United Nations Convention Against Corruption (UNCAC) . The aim is to ensure that all forms of corruption are criminalised in all Member States, that legal persons may also be held responsible for such offences, and that offences incur effective, proportionate and dissuasive penalties. In addition, the Proposal lays down measures to prevent corruption and to facilitate cross-border cooperation .

text: 3. This initiative is included in the Commission’s 2023 work programme and is related to a number of EU strategic policies and initiatives, such as the EU Security Union Strategy 8 9 (2020-2025) , the EU strategy to tackle organised crime (2021-2025) , the annual Rule of Law Report cycle, asset recovery and confiscation, anti-money laundering, protection of the Union’s financial interests, and others.

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 5 May 2023, pursuant to Article 42(1) of EUDPR. The EDPS recommends adding a reference to this consultation in recitals of the Proposal in accordance with the established practice .

text: 2. General remarks

text: 5. The EDPS strongly supports the objective of the Proposal to further enhance and harmonise the legal framework on the fight against corruption in the EU. Corruption is an endemic phenomenon that takes multiple shapes and forms and may affect virtually all spheres and aspects of public life, from the single market and the financial interests of the EU, through internal security, to rule of law, democracy and fundamental rights. Therefore, corruption is highly damaging to society, to the economy and to individuals.

text: 6. The EDPS shares the view of the Commission that the fight against corruption and the protection of fundamental rights are complementary, not conflicting, objectives . Nevertheless, any limitation on the exercise of fundamental rights and freedoms should be subject to the conditions set out in Article 52(1) of the Charter of Fundamental Rights, in particular the principle of proportionality . From data protection perspective, this is specifically relevant with regard to preventive measures such as publication online of conflict of interest and assets declarations.

text: 7. In this context, the EDPS believes that similarly to the envisaged criminal law measures, i.e. the approximation of definitions of criminal offences and alignment of criminal sanctions, the Proposal also provides an opportunity to set common standards and thus to harmonise the respective legal frameworks of Member States in the area of prevention of corruption.

text: 3. Applicable data protection rules

text: 8. The EDPS positively notes that Recital 38 of the Proposal, which indicates that the Proposal “respects fundamental rights and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union (the ‘Charter’) and in particular [...], the protection of personal data, [...]”. At the same time, the EDPS considers that the Proposal should be enhanced in order to ensure compliance with the Articles 7 and 8 of the Charter in the implementation the Proposal in domestic legislation (more on the topic in Section 4 of this Opinion).

text: 9. Given the transversal and multifaceted nature of corruption, the various measures to prevent and suppress corruption fall within different policy and legal areas, such as criminal justice and law enforcement, administrative law, financial rules, public procurement, etc. This fact inevitably creates complexity and potential legal uncertainty, in particular as concerns the applicable data protection rules.

text: 10. Personal data processing for criminal justice and law enforcement purposes must comply with the rules laid down in

text: Directive (EU) 2016/680

text: (Law Enforcement Directive) . Furthermore, when operational personal data is processed by Union bodies, offices and agencies when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part Three TFEU, Chapter IX of the EUDPR applies. Processing of personal data by Europol or Eurojust, e.g. in the context of the cooperation envisaged in Article 24 of the Proposal, would therefore be subject to Chapter IX of the EUDPR, together with the specific data protection rules laid down in their respective basic acts. Adding further to the complexity, the European Public Prosecutor's Office (EPPO), which plays an essential role in the fight against corruption offences affecting the financial interests of the Union, still applies a stand-alone data protection regime.

text: 11. At the same time, the processing of personal data in the context of administrative measures against corruption is also regulated by different data protection acts - the GDPR , if implemented by Member States authorities, and by the EUDPR, when carried out by an EU institution, body or agency.

text: 12. The EDPS recalls that the overall intention of the Union legislator is to provide for a strong and coherent data protection framework in the Union. In this regard, Recital 5 EUDPR confirms that it is in the interest of a coherent approach to personal data protection throughout the Union, and of the free movement of personal data within the Union, to align as far as possible the data protection rules for Union institutions, bodies, offices and agencies with the data protection rules adopted for the public sector in the Member States. In the same spirit, Recital 10 EUDPR explicitly clarifies that the rules for the processing of operational personal data by Union bodies, offices or agencies should be consistent with

text: Directive (EU) 2016/680

text: 13. In view of the above, in the interest of legal certainty, the EDPS recommends adding a recital clarifying the application of the various existing EU data protection legal rules in the context of the prevention and the fight against corruption.

text: 14. On a more general note, the EDPS considers that the Proposal illustrates the need for further harmonization and consistency of Union data protection rules. Essentially, the rights and safeguards for individuals, as well as the accountability obligations throughout the EU data protection framework, should be consistent irrespective of who happens to be the data controller. The EDPS therefore reiterates his call for a comprehensive alignment of the EU data protection framework .

text: 4. Prevention of corruption measures

text: 15. The EDPS shares the view of the Commission that to root out corruption, repressive mechanisms alone may not be sufficient and that measures to prevent corruption, addressing in particular failings in integrity, undisclosed conflicts of interests or serious breaches of ethical rules may mitigate the need for criminal repression and may have wider benefits in promoting public trust and managing the conduct of public officials .

text: 16. The EDPS notes that the Proposal contains one provision dedicated to the prevention of corruption, namely

text: Article 3

text: Article 3

text: would require Member States to adopt a number of measures, including to ensure that key preventive tools such as an open access to information of public interest, effective rules for the disclosure and management of conflicts of interests in the public sector, effective rules for the disclosure and verification of assets of public officials and effective rules regulating the interaction between the private and the public sector are in place .

text: 17. The EDPS is concerned by the relatively general language of Article 3 of the Proposal, which creates a risk of varying interpretations and divergent practices across Member States. In its current form, it is unclear what Member States must do to ensure “the highest degree of transparency” in public administration, or which measures would amount to “effective rules” for either the disclosure and management of conflicts of interests in the public sector or for the disclosure and verification of assets of public officials.

text: 18. While transparency is undoubtedly one of the key guarantees for a democratically accountable public administration, it often has to be reconciled with the fundamental rights to privacy and data protection enshrined in

text: Article 7

text: and Article 8 of the Charter. The EDPS is well aware that such balancing might be a difficult and complex exercise. At the same time, settled case law of the Court of Justice of the EU already provides important guidance to the Union and Member State legislators .

text: 19. In particular, the CJEU judgment of 1 August 2022 in

text: Case C-184/20

text: assesses, among other things, the impact on individual rights of public disclosure online of personal data included in the declarations on conflict of interests (or similar). The Court highlights that publication of such declaration has the effect of making the personal data freely accessible on the internet to the whole of the general public and, accordingly, to a potentially unlimited number of persons, with all the ensuing risks . Moreover, the publication of the content of declarations of private interests might be liable to disclose indirectly sensitive data of a natural person, which would constitute processing of special categories of personal data pursuant to Article 9(1) of the GDPR .

text: 20. In addition, useful practical guidance can be found in Opinion 02/2016 on the publication of personal data for transparency purposes in the public sector of the former

text: Article 29

text: Data Protection Working Party, succeeded by the European Data Protection Board (EDPB). In the document, the EU data protection authorities explain how to apply the data protection principles to the processing and publication of personal data for transparency purposes in the public sector, in particular when related to anti-corruption measures and the management and prevention of conflicts of interest. More specifically, when deciding whether to make information publicly available online, competent institutions should always bear in mind the consequences of doing so.

text: 21. The EDPS invites the Union legislators to enhance Article 3 of the Proposal in order to establish a comprehensive legal basis under Union law for the processing of personal data that is necessary to prevent corruption.

text: 22. In particular, Article 3 of the Proposal should be further developed in line with the case law of the CJEU, laying down common requirements that achieve a proper balance between the objective of general interest pursued and the fundamental rights enshrined in Articles 7 and 8 of the Charter.

text: 23. In any event, the EDPS considers that the Proposal should clearly define what categories of personal data and belonging to which categories of data subjects (e.g. high level officials, members of law enforcement and the judiciary , etc.), may be publicly disclosed as part of the measures for prevention of corruption, and under what circumstances, as well as the necessary safeguards applicable in such cases.

text: 5. Cooperation and exchange of information

text: 24. The EDPS notes that the Article 24 of the Proposal envisages cooperation between Member States’ authorities, the Commission, Europol, Eurojust, the European Anti-Fraud Office (OLAF) and the European Public Prosecutor's Office (EPPO) in the fight against the criminal offences referred to in this Directive. In this respect, he notes that the scope of this cooperation is restricted to “their competence” and is "without prejudice to the rules on cross-border cooperation and mutual legal assistance in criminal matters".

text: 25. The EDPS considers that Article 24 of the Proposal is not intended to provide any new legal basis, nor would it create any new mechanism for the exchange of operational personal data. Any processing of personal data in the context of the cooperation mentioned in

text: Article 24

text: must be compliant with the relevant data protection legislation, as identified in Section 3 of this Opinion.

text: 26. Against this background, the EDPS considers that Recital 33 of the Proposal does not accurately reflect the content of Article 24 of the Proposal. In particular, references to the passenger name record (PNR) , European Travel Information and Authorisation System

text: 27. The EDPS therefore recommends revising Recital 33, in particular to clarify the links, if any, between the proposed Directive on combating corruption and the aforementioned legal acts, including those from the area of migration and asylum.

text: 6. Conclusions

text: 28. In light of the above, the EDPS makes the following recommendations: (1) to recall and clarify the applicability of the existing EU data protection legal rules in the context of the prevention and the fight against corruption; (2) to amend Article 3 of the Proposal in order to establish a comprehensive legal basis under Union law for the processing of personal data that is necessary to prevent corruption; (3) to clearly define what categories of personal data and of which categories of data subjects may publicly be disclosed as part of the measures for prevention of corruption, and under what circumstances, as well as the necessary safeguards in such cases; (4) to clarify the suggested links in Recital 33 between the proposed Directive on combating corruption and the referred legal acts, especially those from the area of migration and asylum; (5) to add a reference to this consultation with the EDPS in the recitals of the Proposal. Brussels, 28 June 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 10


text: OJ L 295, 21.11.2018, p. 39. 2 COM(2025) 512 final. 3 COM(2025)511 final.

text: Conclusion Proposal, Recital 2. 5 Appendix 4. 6 See, for example, Protocol (2024-2029) implementing the Fisheries Partnership Agreement between the European Community and the Republic of Cabo Verde (

text: Article 14

text: and appendix 6, point 2.1), and Protocol on the implementation of the Fisheries Partnership Agreement between the European Community and the Republic of Guinea-Bissau (2024–2029), (

text: Article 14

text: and Appendix 3 point 2.1).

text: See, for example Protocol on the implementation of the Fisheries Partnership Agreement between the European Community and the Republic of Guinea-Bissau (2024–2029), appendix 3, point 2.3, and Protocol (2024-2029) implementing the Fisheries Partnership Agreement between the European Community and the Republic of Cabo Verde, appendix 6, point 2.3.

text: The EDPS notes that the cross-reference to Article 12 of the Protocol (which refers to obligations on expiry or termination of the Protocol) included in point 20 should be revised.

identifier: EDPS yttrande 29/2025

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 29/2025 on the signing, provisional application and conclusion of the Protocol on the implementation of the Fisheries Partnership Agreement between the European Union and the Government of the Cook Islands

serie: yttranden

text: Opinion 29/2025

type: rubrik

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to (1) the Proposal for a Council Decision on the signing, on behalf of the Union, and provisional application of the Protocol on the implementation of the Sustainable Fisheries Partnership Agreement between the European Union and the Government of the Cook Islands (2025- 2032), and (2) the Proposal for a Council Decision on the conclusion, on behalf of the Union, of the Protocol on the implementation of the Sustainable Fisheries Partnership Agreement between the European Union and the Government of the Cook Islands. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: The EDPS is consulted on the Commission proposal to sign, provisionally apply and conclude the new Protocol on the implementation of the Fisheries Partnership Agreement between the European Union and the Government of the Cook Islands.

text: The EDPS welcomes the inclusion of an article dedicated to data protection, which is supplemented by an appendix to the Annex to the Protocol, expanding the data protection provisions and detailing the conditions relating to the processing of personal data.

text: At the same time, the EDPS notes that a number of relevant specifications are not included, in particular as regards the purpose limitation and storage limitation principles, the modalities of onward transfers, and the rights of the persons concerned. In this regard, the EDPS recommends specifying that the personal data requested and transferred under this Protocol should be limited to what is necessary for the sole purpose of its implementation. The EDPS also recommends to clearly define the maximum duration for which the data may be stored and made available.

text: Furthermore, the EDPS invites to further specify what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, taking into account the EDPB Guidelines 2/2020 on

text: Articles 46(2)

text: Finally, the EDPS recommends detailing the data subjects’ rights, as well as the procedures applicable to respond to data subjects’ requests and including a provision that would refer to the specific safeguards to be provided in case of processing of personal data relating to criminal convictions and offences.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 23 September 2025, the European Commission issued:  a Proposal for a Council Decision on the signing, on behalf of the Union, and provisional application of the Protocol on the implementation of the Sustainable Fisheries Partnership Agreement between the European Union and the Government of the Cook Islands (2025-2032) (‘the Signing Proposal’); and  a Proposal for a Council Decision on the conclusion, on behalf of the Union, of the Protocol on the implementation of the Sustainable Fisheries Partnership Agreement between the European Union and the Government of the Cook Islands (2025-2032) (‘the Conclusion Proposal’).

text: 2. The objective of the Signing Proposal is (i) to authorize the signing, on behalf of the Union, of the new Protocol on the implementation of Sustainable Fisheries Partnership Agreement between the European Union and the Government of the Cook Islands (‘the Protocol’) and (ii) to provide for the provisional application of the Protocol.

text: 3. The objective of the Conclusion Proposal is to approve the Protocol.

text: 4. The aims of the Protocol are to enable Union vessels to fish in the fishing zone of the Cook Islands and to enable the Union and the Cook Islands to work closely together to further 5 promote the development of a sustainable fisheries policy and the responsible exploitation of fishery resources in the fishing zone of the Cook Islands. This cooperation will also contribute to decent working conditions in the fisheries sector .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 23 September 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 8 of both the Signing Proposal and the Conclusion Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 6. The EDPS welcomes the inclusion in the Protocol of a specific article on data protection. In particular,

text: Article 8(3)

text: provides that personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject. Moreover, this article is supplemented by an appendix to Annex I, which expands the data protection provisions of the draft Protocol. The EDPS also welcomes the inclusion in these provisions of the definitions of ‘personal data’ and ‘processing’, the categories of personal data to be processed, and the designation of authorities responsible for the processing of data.

text: 7. At the same time, the EDPS notes that a number of relevant specifications are not included, in particular as regards the purpose limitation and storage limitation principles, the modalities of onward transfers, and the rights of the persons concerned.

text: 3. Purpose limitation

text: 8. Article 8(1) of the draft Protocol does not specify that the data shall be processed by the competent authorities “solely” for the purposes of implementing the Agreement, but also refers to the national laws of the competent authority, which creates uncertainty as regards the possibility to process these data for other purposes. The additional provisions in the appendix to the Annex do not clarify this point, since they do not define the specific purposes for which the personal data can be processed.

text: 9. Against this background, the EDPS recommends using a similar wording to that of other Protocols implementing fisheries partnership agreements between the EU and third countries . In particular, the EDPS suggests specifying that the personal data requested and 6 transferred under this Protocol should be limited to what is necessary for processing fishing authorisations, monitoring and controlling the activities of Union vessels.

text: 4. Storage limitation

text: 10. According to the storage limitation principle, personal data should be kept in a form which permits identification of data subjects for no longer than necessary for the purposes for which the personal data are processed. The period of time should be as short as possible in relation to the purpose pursued and must be justified to ensure that the storage is limited to what is strictly necessary for such purposes. The EDPS recommends clearly defining the maximum duration for which the data may be stored and made available, as it is the case in similar Protocols on the implementation of the sustainable fisheries partnership agreement between the European Union and third countries .

text: 5. International transfers of personal data

text: 11. As regards onward transfers, the EDPS notes that the provision laid down in point 15 of Appendix 4 to the Annex does not specify in which cases the receiving authority may onward share or transfer data received under the draft Protocol to a third authority. In this context, the EDPS recalls that in absence of an adequacy decision, transfers of personal data to a third country may be based on a legally binding and enforceable instrument between public authorities or bodies. In such a case, such instrument should provide appropriate safeguards and ensure that enforceable data subjects’ rights and effective legal remedies for data subjects are available.

text: 12. The EDPS invites the Commission to list the different cases allowing the transfers of personal data received under the Protocol to third authorities. In addition, the Protocol should specify which safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, taking into account the EDPB guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies. 7

text: 6. Data subjects’ rights

text: 13. The EDPS notes that the data subjects’ rights mentioned under point 16 of Appendix 4 to the Annex, namely the ‘right to request to access, correct or delete personal data’, should be detailed, as it is the case in the other Protocols already mentioned. In particular, in the context of access to personal data, the receiving authority should, at the request of data subjects, confirm whether or not personal data relating to them is being processed, provide information on the purpose of the processing, types of personal data, storage period to the extent possible, right to request rectification or deletion, right to lodge a complaint, etc., provide a copy of the personal data processed, and provide general information on the applicable safeguards. Moreover, the procedures applicable to respond to requests from data subjects should be specified in the appendix.

text: 14. As regards the supervision of compliance of the processing of personal data, the EDPS recommends specifying the modalities of exercise of the right of redress provided under point 20 of appendix 4 in a similar way as that of the Protocols already mentioned.

text: 7. Personal data relating to criminal convictions and offences

text: 15. The EDPS notes that the Annex to the Protocol ‘Fishing terms and conditions for Union vessels authorised to fish in the Cook Islands’ includes a chapter on ‘control’ which provides penalties in case of failure to comply with any provision of the Protocol. The EDPS recalls that in case data processed in this context would constitute personal data relating to criminal convictions and offences, appropriate safeguards for the rights and freedoms of data subjects should be provided, in accordance with

text: Article 10

text: GDPR and/or

text: Article 11

text: EUDPR. The EDPS recommends the Joint Committee to also add in Appendix 4 to the Annex a provision that would mention these specific safeguards.

text: 8. Conclusions

text: 16. In light of the above, the EDPS makes the following recommendations: (1) to make use of the Joint Committee to specify in point 5 of Appendix 4 to the Annex the specific purposes for which the personal data can be processed under the Protocol, (2) to make use of the Joint Committee to clearly define in point 9 of Appendix 4 to the Annex the maximum duration for which the data may be stored and made available, 8 (3) to make use of the Joint Committee to detail in point 20 of Appendix 4 to the Annex the data subjects’ rights, and specify the modalities of exercise of the right of redress provided under point 20 of the same Appendix, (4) to make use of the Joint Committee to detail in point 15 of Appendix 4 to the Annex which safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, (5) to make also use of the Joint Committee to add in Appendix 6 to the Annex a provision that would specify the safeguards to be provided in the context of the processing of data relating to criminal convictions and offences. Brussels, 10 November 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 9

type: vagledning

utgivare: edps


text: COM(2023) 244 final.

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 244 final. 4

text: Council Regulation (EC) No 515/97 of 13 March 1997

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ l 119, 4.5.2016, p. 89. 6 COM(2023) 244 final, p. 1. 7 Communication from the Commission to the European Parliament and the Council, Way forward on aligning the former third pillar acquis with data protection rules, COM/2020/262 final.

text: See for example

text: Article 65 of Regulation (EU) 2018/1862

text: (SIS),

text: Article 31 of Regulation (EC) No 767/2008

text: (VIS),

text: Article 41 of Regulation (EU) 2017/2226

text: (EES),

text: Article 65 of Regulation (EU) 2018/1240

text: (ETIAS) and others. 9 cf.

text: Article 37 of Council Regulation (EC) No 515/97 of 13 March 1997

text: on mutual assistance between the administrative authorities of the Member States and cooperation between the latter and the Commission to ensure the correct application of the law on customs and agricultural matters, OJ L 82, 22.3.1997, p. 1–16, as amended. 10 Under Article 52(3) of the EUDPR, the European Data Protection Supervisor shall be responsible for monitoring and ensuring the application of the provisions of this Regulation and of any other Union act relating to the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data by a Union institution or body, and for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data. As the Commission will be the processor for all data in the CIS, there will be a dual competence, together with the supervisory authorities of the Member States, to supervise this processing. 11 In contrast,

text: Council Regulation (EC) No 515/97

text: , which established the CIS in the former first pillar of the EU, provides in

text: Article 37

text: (3a) that the European Data Protection Supervisor shall supervise compliance of the CIS with the EUDPR (and provides for a coordination between EDPS and Member States’ supervisory authorities in para. 4 of the same Article).

text: Regulation (EU) 2018/1862

text: of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending and repealing Council Decision 2007/533/JHA, and repealing

text: Regulation (EC) No 1986/2006

text: of the European Parliament and of the Council and

text: Commission Decision 2010/261/EU

text: , OJ L 312, 7.12.2018, p. 56–106.

text: Regulation (EU) 2016/794

text: of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA, OJ L 135, 24.5.2016, p. 53–114, as amended by

text: Regulation (EU) 2022/991

text: of the European Parliament and of the Council of 8 June 2022 amending

text: Regulation (EU) 2016/794

text: , as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role in research and innovation, OJ L 169, 27.6.2022, p. 1–42.

text: Regulation (EC) No 767/2008

text: of the European Parliament and of the Council of 9 July 2008 concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas (VIS Regulation), OJ L 218, 13.8.2008, p. 60–81, as amended by

text: Article 1(42) of Regulation (EU) 2021/1134

text: of the European Parliament and of the Council of 7 July 2021 amending Regulations

text: (EC) No 767/2008

text: (EC) No 810/2009

text: (EU) 2016/399

text: (EU) 2017/2226

text: (EU) 2018/1240

text: (EU) 2018/1860

text: (EU) 2018/1861

text: (EU) 2019/817

text: and

text: (EU) 2019/1896

text: of the European Parliament and of the Council and repealing Council Decisions

text: and 2008/633/JHA, for the purpose of reforming the Visa Information System, OJ L 248, 13.7.2021, p. 11–87.

text: Regulation (EU) 2017/2226

text: of the European Parliament and of the Council of 30 November 2017 establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third-country nationals crossing the external borders of the Member States and determining the conditions for access to the EES for law enforcement purposes, and amending the Convention implementing the Schengen Agreement and Regulations

text: (EC) No 767/2008

text: and

text: (EU) No 1077/2011

text: , OJ L 327, 9.12.2017, p. 20–82.

text: Regulation (EU) 2018/1240

text: of the European Parliament and of the Council of 12 September 2018 establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations

text: (EU) No 1077/2011

text: (EU) No 515/2014

text: (EU) 2016/399

text: (EU) 2016/1624

text: and

text: (EU) 2017/2226

text: , OJ L 236, 19.9.2018, p. 1–71.

text: Regulation (EU) No 952/2013

text: of the European Parliament and of the Council of 9 October 2013 laying down the Union Customs Code (recast), OJ L 269, 10.10.2013, p. 1–101. 18 Article 107(2) of Commission Implementing

text: Regulation (EU) 2023/1070 of 1 June 2023

text: on technical arrangements for developing, maintaining and employing electronic systems for the exchange and storage of information under

text: Regulation (EU) No 952/2013

text: of the European Parliament and the Council, OJ L 143, 2.6.2023, p. 65–104.

identifier: EDPS yttrande 30/2023

title: EDPS Opinion 30/2023 on the Proposal for a Regulation amending Council Decision 2009/917/JHA, as regards its alignment with data protection

text: 4 July 2023

text: Opinion 30/2023

text: on the Proposal for a Regulation amending Council Decision 2009/917/JHA as regards its alignment with data protection rules

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council amending Council Decision 2009/917/JHA, as regards its alignment with Union rules on the protection of personal data . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 11 May 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council amending Council Decision 2009/917/JHA, as regards its alignment with Union rules on the protection of personal data. Council Decision 2009/917/JHA is the legal act establishing the Customs Information System (CIS) in the former third pillar of the EU. Besides this legal act, there is

text: Council Regulation (EC) No 515/97

text: which established the CIS of the former first pillar. The latter legal act is not affected by the Proposal.

text: Directive (EU) 2016/680

text: (‘the LED’), in order to provide a strong and coherent personal data protection framework in the Union.

text: While the EDPS welcomes the introduction of certain additional safeguards as regards access by international or regional organisations, he also recommends laying down further substantive conditions that would go beyond the provisions on international transfers. The EDPS further recommends clarifying the role of the EDPS in the supervision of the CIS, as well as the applicable data protection rules. Lastly, the EDPS invites the EU co-legislators to examine how supervision coordination for the two different CIS under Council Decision 2009/917/JHA and

text: Council Regulation (EC) No 515/97

text: can be reconciled in one body.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 11 May 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council amending Council Decision 2009/917/JHA, as regards its alignment with Union rules on the protection of personal data (‘the Proposal’). Council Decision 2009/917/JHA is the legal act establishing the Customs Information System (CIS) in the former third pillar of the EU. Besides this legal act, there is the

text: Council Regulation (EC) No 515/97

text: 2. The objective of the Proposal is to align the data protection rules in Council Decision 2009/917/JHA with the principles and rules laid down in

text: Directive (EU) 2016/680

text: (‘the LED’), in order to provide a strong and coherent personal data protection framework in the Union .

text: 3. A legislative proposal to this effect was already envisaged in the Commission Communication of 24 June 2020 entitled ‘Way forward on aligning the former third pillar acquis with data protection rules’ . That Communication identified current Council Decision 2009/917/JHA on the use of information technology for customs purposes [CIS former third pillar] and nine other legal acts that should be aligned with the LED. Pursuant to Article 62(6) of the LED, the Commission is required to review acts of Union law which regulate the processing of personal data by the competent authorities for the purposes set 4 out in Article 1(1) of the LED, in order to assess the need to align those acts with the LED and to make, where appropriate, the necessary proposals to amend these acts to ensure a consistent approach to the protection of personal data within the scope of the LED.

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 11 May 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 8 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 5. The EDPS welcomes the alignment of the Council Decision with the LED as proposed by the Commission and in particular with regard to purpose specification, limitation to specific categories of data subjects and categories of personal data, and conditions for subsequent processing.

text: 6. The EDPS further welcomes the decision to replace the term ‘serious contravention’ by the term ‘criminal offences’ throughout the text, including in Articles

text: and

text: , and the additional clarifications provided in Recital 3 of the Proposal. The EDPS considers it particularly important and welcomes that the Commission recalls that the objective of the CIS should remain limited to assisting in connection to the prevention, investigation, detection or prosecution of the criminal offences under national laws in respect of which national customs administrations are competent. In conclusion, the Commission alludes to the fact that as a result, not all criminal offences should be considered to be covered, but only those which are particularly relevant in the context of customs (e.g., illicit drugs trafficking, illicit weapons trafficking and money laundering). In the same vein, it is also useful that the recital recalls that the introduction of the term ‘criminal offences’ would not affect the specific requirements set out in Council Decision 2009/917/JA regarding the establishment and sending of a list of relevant criminal offences under national law.

text: 7. The EDPS focuses in this Opinion on the matter of granting international or regional organisations access to the CIS, on the need for further clarity regarding applicable law and supervision, and on the potential to further harmonize supervision coordination with regard to the CIS.

text: 3. Access to the CIS by international or regional organisations

text: 8. The EDPS notes that Article 1(6) of the Proposal would introduce changes to Article 7(3) of the Council Decision regarding access to the Customs Information System by international or regional organisations. While the provision currently requires the Council to take into account any reciprocal arrangements and any opinion on the adequacy of data protection measures by the Joint Supervisory Authority, the Proposal would make access dependent 5 on compliance with the conditions for international transfers of data under the LED. In addition, and in line with the new model of coordinated supervision, the opinion of the Joint Supervisory Authority would be replaced by consultation of the EDPB.

text: 9. While the EDPS welcomes the clarification that access to the CIS by international or regional organisations should be “exceptional”, he considers that the Proposal should also specify substantive criteria on the basis of which such exceptional access would be granted.

text: 10. The EDPS recalls that providing access to large-scale IT systems of the Union to international organisations should remain an exception. In fact, most of the legal acts establishing Union large-scale IT systems in the field of the JHA actually lay down a prohibition of the transfer of the data stored in them to third countries or international organisations, with some clearly defined exceptions .

text: 11. Therefore, the EDPS recommends further enhancing Article 7(3) of the Council Decision by ensuring that access to CIS by international or regional organisations would be possible only if specific substantive conditions, defining especially the types of cooperation that could warrant such access, the types of international or regional organisations, the specific purposes that could justify granting of access, the types of personal data to be accessed, as well as technical and organisational safeguards applicable in that context.

text: 4. Role of the European Data Protection Supervisor

text: 12. The EDPS welcomes the decision to abandon the model of joint supervision of the CIS by a Joint Supervisory Authority, in line with the CIS for the former first pillar , and have the processing activities at European level monitored by the EDPS. The general competence for the EDPS to supervise the CIS follows from

text: Article 52(3)

text: EUDPR in the absence of a specific provision. The new Article 26 of the Council Decision, as amended by the Proposal, would only address the necessary coordinated supervision, without clarifying the role of the EDPS .

text: 13. However, as a rule, the co-legislators have so far not relied on

text: Article 52(3)

text: EUDPR alone when establishing coordinated supervision within the framework of the EDPB, but clarified 6 explicitly that the EDPS is responsible for monitoring the processing of personal data by the respective EU institution or agency and for ensuring that it is carried out in accordance with the respective legal act, for example in

text: Article 70 of Regulation (EU) 2018/1862

text: Article 43 of Regulation (EU) 2016/794

text: Article 42 of Regulation (EC) No 767/2008

text: Article 56 of Regulation (EU) 2017/2226

text: and

text: Article 67 of Regulation (EU) 2018/1240

text: . For the sake of clarity and legal security, the EDPS recommends to maintain this practice and clarify the role of the EDPS in the Proposal, using the cited provisions as a blueprint.

text: 5. Applicable data protection law

text: 14. In the same vein, the EDPS takes note of

text: Article 1(11)

text: which would provide for an amendment of

text: Article 20

text: according to which

text: Directive (EU) 2016/680

text: shall apply to the processing of personal data under this Decision. However, the LED cannot apply to the activities of the Commission as processor of the CIS directly. While it is possible that the Member States as controllers reach agreements with the Commission as processor on the basis of national laws implementing the LED, the processing activities of the Commission, including the CIS as such, would still fall under the EUDPR (whereas the processing operations in the CIS by the competent authorities of the Member States fall under the national laws implementing the LED).

text: 15. Therefore, the EDPS recommends to amend Article 1(11) of the Proposal to also refer to the EUDPR in addition of the LED, as applicable. As both legal acts would apply de lege, alternatively

text: Article 1(11)

text: could also provide for the deletion of

text: Article 20

text: , and instead of a provision in the enacting terms, a recital could confirm the applicability of the relevant data protection rules. 7

text: 6. Undivided supervision coordination for the CIS as a whole

text: 16. The dissolution of the Joint Supervisory Authority and supervision at EU level vested in the EDPS, would bring about the need to coordinate supervision at Member State level with the EDPS. The Proposal provides that the model of coordinated supervision pursuant to Article 62 of the EUDPR should apply to the CIS of the former third pillar. That means the framework of the EDPB would be used to coordinate among Member States’ supervisory authorities and with the EDPS, rather than setting up a specific coordination group. The EDPS welcomes the choice for this horizontal model of supervision which applies to a steadily growing number of important electronic systems. In the customs sector, the electronic systems established under the Union Customs Code already follow this model of supervision coordination .

text: 17. However, it should be noted that the replacement of the joint supervision model by coordinated supervision provides for an opportunity to consolidate supervision coordination for the two different CIS under Council Decision 2009/917/JHA and

text: Council Regulation (EC) No 515/97

text: Council Regulation (EC) No 515/97

text: provides already for coordinated supervision, but follows the model of system-specific supervision coordination. A specific body, the CIS Supervision Coordination Group, has been set up for this purpose. The EDPS regrets that, at this point in time, there is still no prospect of transferring the supervision coordination for the CIS of the former first pillar to the framework of

text: Article 62

text: EUDPR. As a result, two parallel formats co-exist in which CIS data protection matters are discussed and coordinated among supervisory authorities.

text: 18. The EDPS therefore invites the co-legislators to examine if

text: Article 37 of Council Regulation (EC) No 515/97

text: could not be brought in line with the horizontal model of coordinated supervision, on the occasion of this Proposal.

text: 7. Conclusions

text: 19. In light of the above, the EDPS makes the following recommendations: (1) to specify the substantive conditions, in addition to the provisions on international transfers, that must be fulfilled so that the Council may permit under exceptional circumstances an international or regional organisation to have direct access to data in the CIS, (2) to clarify the role of the EDPS in the supervision of the CIS, 8 (3) to modify Article 1(11) of the Proposal as to either add a reference to the EUDPR, as applicable, or to delete Article 20 of Council Decision 2009/917/JHA and recall the applicable law in a recital, and (4) to examine how to reconcile supervision coordination for the two different CIS under Council Decision 2009/917/JHA and

text: Council Regulation (EC) No 515/97

text: in one body. Brussels, 4 July 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI p.o. Leonardo CERVERA NAVAS Head of EDPS Secretariat 9


text: OJ L 295, 21.11.2018, p. 39. 3 COM(2025) 676 final and COM(2025) 678 final. 4 COM(2025) 676 final and COM(2025) 678 final, p. 3. 5 COM/2025/282 final; COM/2025/279 final (12.6.2025) and COM/2025/294 final; COM/2025/295 final (12.6.2025).

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1.

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89–131. 8

text: Directive (EU) 2016/681

text: of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, OJ L 119, 4.5.2016, p. 132– 149. 9 See Annex to the Proposals, p. 4. 10 Opinion 1/15 of the Court of Justice (Grand Chamber) of 26 July 2017, EU:C:2017:592. 11 Judgment of the Court of Justice of 21 June 2022, Ligue des droits humains,

text: , ECLI:EU:C:2022:491.

text: See https://www.icao.int/safety/airnavigation/nationalitymarks/annexes_booklet_en.pdf. 13 Annex 9, Chapter 9, Section D to the International Convention on Civil Aviation. 14 See COM(2025) 676 final and COM(2025) 678 final, p. 2. 15 COM(2025) 678 final, p. 2. 16 EDPS Opinion 47/2023 on the negotiating mandate for an Agreement between the EU and Switzerland on the transfer of Passenger Name Record data, issued on 30 October 2023.

text: Regulation (EU) 2025/13

text: of the European Parliament and of the Council of 19 December 2024 on the collection and transfer of advance passenger information for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, and amending

text: Regulation (EU) 2019/818

text: , OJ L, 2025/13, 8.1.2025. 18 EDPS Opinion 6/2023 on the Proposals for Regulations on the collection and transfer of advance passenger information (API), issued on 8 February 2023.

identifier: EDPS yttrande 30/2025

amnesord:
International Cooperation
Transfers of data
EU Passengers Name Record

title: Opinion 30/2025 on the signing and conclusion of an Agreement between the EU and the Swiss Confederation on the transfer of Passenger Name Record data

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposals for Council decisions on the signing and conclusion of the Agreement between the European Union and the Swiss Confederation on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime .

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 12 November 2025, the European Commission issued two Proposals for Council Decisions on the signing and on the conclusion, on behalf of the European Union, of the Agreement between the European Union and the Swiss Confederation on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. The aim of the draft Agreement is to enable the transfer of PNR data from the EU to Switzerland in recognition of the necessity to use PNR data as an essential tool in the fight against terrorism and other forms of serious crime.

text: In the Opinion, the EDPS recalls the legal situation of Switzerland as a Schengen associated country as regards the application of the Union legal framework on data protection. Pursuant to the Schengen Association Agreement between the EU and Swiss Confederation of 1999, Switzerland is bound by the Union acts which constitute a development of the provisions of the Schengen acquis. Therefore, Switzerland is supposed to apply

text: Directive (EU) 2016/680

text: in a similar manner as EU Member States. However, the EU PNR Directive does not constitute a development of the provisions of the Schengen acquis and therefore Switzerland is not bound by its provisions. Consequently, the Agreement between the EU and Switzerland must adduce all the appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the Court of Justice of the European Union.

text: Following an assessment of the draft Agreement, including the implementation of previous specific recommendations of the EDPS on the negotiating mandate, the EDPS concludes that the draft Agreement between the European Union and Switzerland on the transfer of PNR data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime contains the necessary safeguards required in order for it to be compatible with the EU legal framework on data protection.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 12 November 2025, the European Commission issued two Proposals for Council decisions on the signing and conclusion of the Agreement between the European Union and the Swiss Confederation on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (‘the Proposals’).

text: 2. The objective of the Proposals is to enable the transfer of PNR data from the EU to Switzerland in recognition of the necessity to use PNR data as an essential tool in the fight against terrorism and other forms of serious crime .

text: 3. The negotiations with Switzerland, as well as with Iceland and Norway, began on 21 March 2024. Following the finalization of negotiations and subsequent proposals by the European Commission on 12 June 2025 , the Council of the EU has already authorised the signing and conclusion of two PNR Agreements with Norway and Iceland on 22 September 2025. Negotiations between the EU and Switzerland were concluded on 7 October 2025 with the initialling of the draft agreement text between lead negotiators.

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 12 November 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 6 of the Proposals. 5

text: 2. General remarks

text: 5. PNR data is information provided by passengers and collected by and held in the air carriers’ reservation and departure control systems for air carriers’ commercial purposes. While useful for combating terrorism and serious crime, the transfer of PNR data to third countries and the subsequent processing by their authorities constitutes an interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter of Fundamental Rights (the Charter). For this reason, it requires a legal basis under EU law and must be necessary, proportionate and subject to strict limitations and effective safeguards.

text: 6. In addition to the Charter, the applicable legal rules in case of transfer and processing of PNR data within the EU include also the horizontal EU legal framework on data protection, 6 7 namely

text: Regulation (EU) 2016/679

text: (the GDPR) and

text: Directive (EU) 2016/680

text: (the LED) , as well as the specific

text: Directive (EU) 2016/681

text: (the EU PNR Directive) . In that regard the EDPS welcomes the Joint Declaration contained in the Annex to the Proposals, recalling that this legal framework guarantees a high level of protection of fundamental rights, in particular the rights to privacy and the protection of personal data .

text: 7. Furthermore, the Court of Justice of the EU (CJEU) on two occasions interpreted the legal framework on PNR and provided guidance as regards proportionality and the necessity of PNR data processing, namely in Opinion 1/15 of 26 July 2017 and, for what concerns the EU PNR Directive, in case

text: . The requirements laid down by the CJEU in the cited case law constitute an important point of reference for the assessment of the current Proposals and the draft Agreement on the transfer of PNR data.

text: 8. The EDPS also recalls that, in addition, PNR data is subject to international rules and standards. The United Nations Security Council Resolution 2396 (2017) on threats to international peace and security caused by returning foreign terrorist fighters, adopted on 21 December 2017, and the subsequent UN Security Council Resolution 2482 (2019) of 19 July 2019, called on UN Member States to develop the capability to collect and use PNR data, based on Standards and Recommended Practices on PNR (SARPs) of the International Civil Aviation Organization (ICAO) in 2020, by means of Amendment 28 to Annex 9 to the 6 Convention on International Civil Aviation (Chicago Convention) , which became applicable in February 2021 .

text: 9. An important legal aspect to be noted, which is also expressly highlighted in the Proposals, is the legal situation of Switzerland as a Schengen associated country as regards the application of the Union legal framework on data protection . Pursuant to the Schengen Association Agreement between the EU and Swiss Confederation of 1999, Switzerland is bound by the Union acts which constitute a development of the provisions of the Schengen acquis. Therefore, Switzerland is supposed to apply the LED in a similar manner as EU Member States. At the same time, the EU PNR Directive does not constitute a development of the Schengen acquis, hence Switzerland does not participate in the implementation of this legal instrument. In these circumstances, namely in the absence of appropriate safeguards in relation to the specific processing of PNR data, that are to be established by means of a valid legal basis as required by EU law, Switzerland may not lawfully receive and process PNR data on flights operated by air carriers between the Union and Switzerland . Therefore, the agreement between the EU and Switzerland on the transfer of PNR data for preventing, detecting, investigating and prosecuting terrorist offences and serious crime needs to adduce all the appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU.

text: 10. The EDPS has already issued an Opinion on the negotiating mandate for an Agreement between the EU and Switzerland on the transfer of PNR data , where the EDPS made two specific recommendations: a. to align the definition of sensitive data in the future Agreement with the definitions of special categories of data in Article 9(1) of the GDPR and Article 10 of the LED; and b. to provide in the Agreement for the legal possibilities to suspend it in case of breaches of its provisions, as well as to terminate it if the non-compliance is serious and persistent.

text: 11. The EDPS notes with satisfaction that these recommendations have been considered during the negotiations and are subsequently reflected in the draft Agreement, as follows: a. Article 8 of the draft Agreement provides for a prohibition to process special categories of PNR data in line with how this concept has been defined in the EU data protection acquis; b. Article 20 of the draft Agreement provides for a suspension mechanisms and

text: Article 21

text: provides for the possibility for either Party to terminate the Agreement at any time. 7

text: 3. Use of the API-PNR router

text: 12. The EDPS notes that Article 4 of the draft Agreement provides for the possibility for Switzerland to make use of the API-PNR router established by

text: Regulation (EU) 2025/13

text: , as envisaged by

text: Article 10

text: (c) of that Regulation, which was not previously included in the negotiating directives on which the EDPS issued his Opinion.

text: 13. The EDPS recalls that he has issued an Opinion on the proposals for the so-called API Regulations , which were subsequently adopted as

text: Regulation (EU) 2025/12

text: and

text: Regulation (EU) 2025/13

text: , where he commented, among others, on the router.

text: 14. In view of the fact that Switzerland is a Schengen associated country with direct access to the EU large-scale IT systems in the area of justice and home affairs, the EDPS considers the possible use of a common technical solution for the exchange of PNR data as appropriate. In this context, the EDPS welcomes the provision of

text: Article 4(1)

text: (b) of the draft Agreement, which explicitly clarifies that Switzerland would be bound by the rules on the functioning and the conditions for the use of the API-PNR router, as established by the API Regulations, if it decides to use this common technical solution.

text: 4. Access to PNR data by Europol and Eurojust

text: 15. The EDPS notes that, according to Article 15 of the draft Agreement, Switzerland will share with Europol or Eurojust, within the scope of their respective mandates, the results of processing of PNR data, or analytical information based on PNR data, in specific cases where necessary to prevent, detect, investigate, or prosecute terrorist offences or serious crime. Such exchange may be carried out on its own initiative or at the request of the Union Agencies.

text: 16. In this context, the EDPS reminds that, in as far as the data concerns flights between the EU and Switzerland, as these flights are considered as extra-EU flights, this information should be processed in line with the EU PNR Directive, by the Member States' Passenger Information Units (PIU). The EDPS reminds that the EU PNR Directive provides for the possibility for Europol to request the PNR data or the result of processing those data from PIUs of the Member States, under strict conditions. However, the EU PNR Directive does not provide such possibility for Eurojust.

text: 17. In view of the above, it is the understanding of the EDPS that regarding Europol or Eurojust, the condition “within the scope of their respective mandates” refers not only to the tasks 8 and powers of the two Agencies provided for in the EU regulations establishing them but also the specific rules laid down in the EU PNR Directive. Consequently, the draft Agreement should not lead to situations where Union Agencies request PNR data from Switzerland which they would not be able to request from an EU Member State.

text: 5. Conclusions

text: 18. In light of the above, the EDPS concludes that the draft Agreement between the European Union and Switzerland on the transfer of PNR data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime contains the necessary safeguards required in order for it to be compatible with the EU legal framework on data protection. Brussels, 19 December 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 9