text: COM(2023) 770 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 770 final. 4 COM(2023) 770 final, p. 2; Communication from the Commission, A Farm to Fork Strategy for a fair, healthy and environmentallyfriendly food system, COM(2020)381 final. COM(2023) 770 final, p. 2-3. 4

text: OJ C 326, 26.10.2012, p. 47–390 7 See e.g. Articles 6 and 9 of the Proposal. 8 See e.g. Articles 12-13 of the Proposal. 9 See e.g. Article 15 of the Proposal. 10 See e.g. Articles

text: , and 51 of the Proposal. 11

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1–88. 5

text: Article 51(1) of the Proposal and Article 11 of Commission Implementing

text: Regulation (EU) 2019/1715 of 30 September 2019

text: laying down rules for the functioning of the information management system for official controls and its system components (the IMSOC Regulation), C/2019/7005, OJ L 261, 14.10.2019, p. 37–96. 13 Commission Implementing

text: laying down rules for the functioning of the information management system for official controls and its system components (the IMSOC Regulation) C/2019/7005 OJ L 261, 14.10.2019, p. 37–96. 14 Articles

text: , Chapter III of the Proposal. See also

text: Article 3(10)

text: that provides that ‘TRACES’ means the computerised system for the purposes of exchanging data, information and documents referred to in

text: Articles 133(4) of Regulation (EU) 2017/625

text: . 15 Article

text: and

text: , Chapter V, of the Proposal. 16 See

text: Article 5(1)

text: (e) GDPR and

text: Article 4(1)

text: (e) EUDPR. 17 Article 51(6) of the Proposal. 6

text: Article 51(6)

text: and recital 34 of the Proposal. 19 Article 15(6) of the Proposal. 20 Article 16(2) of the Proposal. 21 Articles 15(6) and 16(2) of the Proposal and

text: Article 21 of Regulation (EU) 2017/625

text: . 22 Articles 15(6) and 16(2) of the Proposal. 7

text: Article 24(1) of the Proposal. 24 Article 3(29) of the Proposal. 25 Article 24(2) of the Proposal. 26

text: Article 24(3)

text: and (7) of the Proposal. 27

text: Article 24(4)

text: -(5) of the Proposal. 28 Article 24(4) of the Proposal. 8

text: See Articles

text: EUDPR and Decision of the European Data Protection Supervisor of 16 July 2019 on DPIA Lists issued under

text: Articles 39(4)

text: and (5) of

text: Regulation (EU) 2018/1725

text: ; see also Articles

text: GDPR and

text: Article 29

text: Working Party Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679, adopted 4 April 2017 and as last revised and adopted on 4 October 2017, endorsed by the EDPB. 30 Ibid. 31 Article 24(8) of the Proposal. 32 Article 24(8) of the Proposal. 33 Article 51(2) of the Proposal. 9

text: Recital 32 of the Proposal. 35 Recital 33 of the Proposal. See also COM(2023) 770 final, p. 12, providing that the use of location data will allow “that competent authority can access information about the timing when the truck reached certain points (place of departure, control post, border crossings between Member States, place of destination) so that the competent authorities can carry out official controls based on such information . Since the reduction of maximum journey times is one of the main measures to achieve the animal welfare policy objective, this is necessary to provide Member States’ competent authorities with tools to be able to perform official controls in an effective manner”. 36

text: Article 24(4)

text: -(5) of the Proposal. It concerns the locations of the following points of the journey: (a) place of departure; (b) control posts; (c) exit point from the Union and border crossings between Member States; and (d) place of destination. 37 Article 24(2) of the Proposal. 38 Article 24(2) of the Proposal. 39 Article 24(3) of the Proposal. 40

text: Article 24(4)

text: -(5) of the Proposal. This doubt is strengthened by several references to “real-time positioning system” in the Proposal, see e.g.

text: Article 51

text: heading,

text: Article 51(2)

text: and (4), recital 32, explanatory memorandum, p. 3, 11-12, 14-15. 41 Article 51(3) of the Proposal. 10

text: Article 51(3) of the Proposal. 43 Article 51(4) of the Proposal. See also

text: Regulation (EU) 2017/625

text: of the European Parliament and of the Council of 15 March 2017 on official controls and other official activities performed to ensure the application of food and feed law, rules on animal health and welfare, plant health and plant protection products, amending Regulations

text: (EC) No 999/2001

text: (EC) No 396/2005

text: (EC) No 1069/2009

text: (EC) No 1107/2009

text: (EU) No 1151/2012

text: (EU) No 652/2014

text: (EU) 2016/429

text: and

text: (EU) 2016/2031

text: of the European Parliament and of the Council, Council Regulations

text: (EC) No 1/2005

text: and

text: (EC) No 1099/2009

text: and Council Directives

text: and

text: , and repealing Regulations

text: (EC) No 854/2004

text: and

text: (EC) No 882/2004

text: of the European Parliament and of the Council, Council Directives

text: and

text: and

text: Council Decision 92/438/EEC

text: (Official Controls Regulation), OJ L 95, 7.4.2017, p. 1–142. 44 Articles 24 and 51(2) of the Proposal. 45 See Articles 24(5) and 51(3) of the Proposal. 46 Article 51(6) of the Proposal. 47 The EDPS applied editorial corrections to the citation. 48 Article 51(4) of the Proposal. 11

identifier: EDPS yttrande 12/2024

title: EDPS Opinion 12/2024 on the Proposal for a Regulation on the protection of animals during transport and related operations

text: 5 March 2024

text: Opinion 12/2024

text: on the Proposal for a Regulation on the protection of animals during transport and related operations

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’. Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’. This Opinion relates to Proposal for a Regulation of the European Parliament and of the Council on the protection of animals during transport and related operations, amending Council Regulation (EC) NO 1255/97 and repealing Council Regulation (EC) NO 1/2005 .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 7 December 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on the protection of animals during transport and related operations, amending Council Regulation (EC) NO 1255/97 and repealing Council Regulation (EC) NO 1/2005.

text: The EDPS recognises the legitimate objective of the Proposal of ensuring animal protection and improving animal welfare, a value enshrined in Article 13 of the Treaty on the Functioning of the European Union.

text: The EDPS considers that the Proposal adequately explains why the use of road vehicle tracking is necessary to ensure animal welfare, a public interest. The EDPS further notes that the Proposal limits the impact of the use of a positioning system on the fundamental rights of the driver by clearly defining which 4 location points will be recorded and be made available to national competent authorities. The EDPS recommends, however, to further clarify the scope of processing, by providing that not more data than records on the 4 location points will be collected by the Commission in order to be made available to national competent authorities. As the processing envisaged by the Proposal might still result in a high risk to the rights and freedoms of natural persons, the EDPS recalls that carrying out a data protection impact assessment may still be necessary.

text: The EDPS recommends assessing whether the storage duration of 6 years provided for authorisations, certificates, journey logs and road vehicle position records is necessary for the purposes it aims to achieve, and whether such periods can be shortened.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 7 December 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on the protection of animals during transport and related operations, amending Council Regulation (EC) NO 1255/97 and repealing Council Regulation (EC) NO 1/2005 (‘the Proposal’).

text: 2. The Proposal aims to contribute to sustainable agricultural and food production by ensuring a higher level of animal welfare, and avoiding distortions on the internal market, thereby contributing to a shift towards an economically, environmentally, and socially sustainable food system, as set out in the Farm to Fork strategy . The specific objectives of the Proposal are, among others, to: • reduce animal welfare problems linked to long journeys and repetitive unloading and re-loading linked to several rest periods; • ensure that animals have more space when transported; • improve the conditions of transport of vulnerable animals; • avoid exposing animals to extreme temperatures; • facilitate enforcement of EU rules on the protection of animals, including trough digitalisation; • better protect animals exported to non-EU countries; • better protect cats and dogs transported in connection with an economic activity .

text: 3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 10 January 2024, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 57 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 4. The EDPS recognises the legitimate objective of the Proposal of ensuring animal protection and improving animal welfare, a value enshrined in Article 13 of the Treaty on the Functioning of the European Union (‘TFEU’) . The EDPS understands that additional legislative measures as provided for by the Proposal, taking into account technological development, are necessary to this end.

text: 5. The Proposal would entail processing of personal data by the Commission and/or national competent authorities. Such processing is necessary to assess, among others, the 7 8 9 application for an authorisation or certificate , journey logs , and to carry out official controls . It would entail the processing personal data of e.g. the organiser, transporter, person in charge, or driver involved in animal transport.

text: 6. Any processing of personal data pursuant to the Proposal must take place in accordance with data protection legislation, and must among others be limited to what is necessary and proportionate in relation to the objectives it pursues. The EDPS therefore welcomes the reference to the GDPR and EUDPR in recital 35 of the Proposal.

text: 3. Personal data in authorisations, journey logs and certificates

text: 3.1. Categories of personal data

text: 7. The Proposal provides for the application of authorisations and certificates and requires the submission of journey logs and certain additional information upon arrival at the place of destination to competent authorities. The Annexes to the Proposal provide forms to be filled in by e.g. organisers, transporters, drivers, or keepers at the place of destination. The required information may include personal data such as name and address, name of the person in charge, telephone number, email address, and authorisation number. The EDPS welcomes that the required personal data is limited and does not go beyond what is necessary to assess and review applications and submitted information.

text: 3.2. Roles and responsibilities

text: 8. The Proposal provides that the Commission and the Member States shall be joint controllers for the processing of personal data for the authorisations referred to in Chapter II, the journey logs referred to in Chapter IV and the certificates referred to in Chapter VIII . The EDPS notes that Article 11 of Commission Implementing

text: Regulation (EU) 2019/1715

text: provides the responsibilities of the Commission and the Member States. The EDPS welcomes that the Proposal allocates the roles and the responsibilities within the meaning of data protection law.

text: 9. The EDPS notes, however, that for certain processing of personal data, no role within the meaning of data protection law has been allocated in the Proposal. In particular, the forms set out in sections 5-6 of Annex V, regarding an application for a certificate of approval to be submitted by the transporter to the competent authority in TRACES , also include personal data. In addition, sections 3 and 5 of the journey log as set out in point 1 of Annex III, to be completed by the driver or attendant and the keeper at the place of destination, include personal data . The EDPS questions why the certificates referred to in Chapter III, and the journey log as referred to in Articles

text: and

text: , are not included in Article 51(1) of the Proposal, which sets out the role of joint controllers of the Commission and the Member States for personal data processed in TRACES. The EDPS understands that the Commission and Members States are also joint controllers for such personal data in TRACES, in accordance with Article 11 of Commission Implementing

text: Regulation (EU) 2019/1715

text: . The EDPS therefore considers that Chapter III and Articles

text: and

text: should also be listed in Article 51(1) of the Proposal.

text: 3.3. Storage duration

text: 10. The EDPS notes that the Proposal provides for storage durations for personal data related to authorisations referred to in Chapter II and certificates referred to in Chapter VIII, and journey logs in Chapter IV.

text: 11. The EDPS recalls the storage limitation principle, requiring that data is kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed . In practice, this means that a maximum, proportionate storage duration, should be determined, following the expiry of which the personal data should be deleted.

text: 12. The Proposal provides that personal data related to authorisations and certificates shall be retained by TRACES throughout the validity of those authorisations and certificates and for a period of 6 years after their expiry or withdrawal .

text: 13. The EDPS has not found a justification why the 6 years retention period of personal data related to authorisations and certificates is necessary . Therefore, the EDPS recommends to assess whether a shorter storage duration than 6 years would be sufficient to achieve the envisaged purpose, or to provide a justification of why a retention period of 6 years after expiry or withdrawal or an authorisation or certificate would be necessary (e.g., by way of a recital).

text: 14. Journey logs for long journeys and short journeys to third countries are retained in TRACES for a maximum period of 6 years , and for short journeys within the Union for a period 6 years, for subsequent official controls .

text: 15. Regarding journey logs, recital 34 provides that ‘[t]he retention period of these data should be 6 years so that these data are accessible to the competent authorities, in particular with a view to checking whether the organiser or transporter fulfils the conditions required in order to obtain a renewal of an authorisation after the expiry of the 5-year period of validity’.

text: 16. The EDPS understands that the retention of journey logs for long journeys and short journeys to third countries, and for short journeys within the Union, is necessary for official controls and to assess whether a renewal of an authorisation may be granted.

text: 17. With regard to retention for official controls subsequent to the journey, the EDPS recommends to assess how long after the finalisation of the journey controls generally take place, and based on such period, whether a shorter storage period than (maximum) 6 years would be sufficient for control purposes.

text: 18. With regard to storage of journey logs to assess the renewal of an authorisation, the EDPS recommends assessing whether fewer data may be retained, e.g. only journey logs related to an official control that demonstrated abnormalities . Moreover, he understands that the start of the storage period may be linked to the moment of expiry of the validity of the authorisation. Under the Proposal, however, journey logs are retained for 6 years as of the moment they are entered into TRACES . Consequently, journey logs related to a journey carried out at the beginning of the validity of the authorisation are retained for a shorter period after expiry of the authorisation, than journey logs related to journeys carried out at the end of the validity of the authorisation.

text: 19. The EDPS recommends either providing further justification why the proposed retention scheme would contribute to the assessment or the conditions for renewal of an authorisation, or to link the storage period to the expiry of the authorisation. In the latter case, journey logs collected during the validity period of an authorisation could be stored for a certain period (e.g. 1 year) after expiry of such authorisation. In any event, the future Regulation should limit the storage period to what is necessary for the assessment of a renewal application, and should provide a justification thereof. For example, if renewal applications generally find place within 1 year after expiry, such storage period may be sufficient to achieve the envisaged purpose.

text: 4. Positioning systems of means of transport by road

text: 4.1. Risks for individuals

text: 20. The Proposal provides that means of transport by road shall be equipped with a positioning system . It defines ‘positioning systems’ as systems of infrastructures providing global, continuous, accurate and guaranteed timing and positioning services needed for the purpose of this Regulation .

text: 21. The position system shall record the position of road vehicles on short intervals and be operational during the journey from the place of departure until arrival at the place of destination . The records obtained from the positioning systems of the means of transport shall be kept in an information system accessible to TRACES, to be established by the Commission (‘Commission information system) . After the completion of the journey, TRACES shall retrieve data from the Commission information system on the time when means of transport reached the following locations as provided by organisers when completing section 1 of the journey log as set out in point 1 of Annex III : (a) place of departure; (b) control posts; (c) exit point from the Union and border crossings between Member States; and (d) place of destination .

text: 22. The EDPS considers that the tracking of road vehicles envisaged by the Proposal may interfere with the rights to privacy and data protection of the driver. Tracking road vehicles not only involves collecting data about the vehicle, it also entails processing of personal data of the driver using that vehicle (e.g. location data and other information about the movements of the driver). The tracking of the position of a road vehicle may give the driver the feeling of constantly being monitored or surveilled and may therefore be considered to be particularly intrusive. In order for in-vehicle tracking to be lawful under the EUDPR and GDPR, strict requirements must be met. The legitimate aim of using such technology may be to track or monitor the location of the vehicles, but it is important to ensure that the vehicle tracking should not be regarded as a method to track or monitor the movements or the whereabouts of drivers.

text: 23. Considering that processing of records of the position of road vehicles under the Proposal shall generally entail the processing of personal data, as it reveals the location of the driver, any of such processing must take place in accordance with the EUDPR when carried out by the Commission, and with the GDPR when carried out by national competent authorities. The EDPS would like to particularly draw the attention to the importance of informing data subjects of the processing, to ensure transparency of the processing operations.

text: 24. The EDPS recalls that where a type of processing of personal data, in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data . The EDPS considers that the type of processing envisaged by the Proposal is likely to result in a high risk to the rights and freedoms of natural persons and that a data protection impact assessment (‘DPIA’) is likely to be necessary before the processing commences. The EDPS considers that several criteria for assessing whether processing operations are likely to result in high risks are potentially met , considering that the processing may entail: • Systematic monitoring through tracking movements via location data; • Personal data processing on a large scale through TRACES and the Commission information system; • Innovative use of technological solutions that can involve novel forms of data collection, as the Commission has not yet decided what technology will be used for the positioning system ; and • Systematic profiling and analysis/predicting of data subjects’ performance/reliability at work with legal or similar effects, i.e. whether the driver respects the routes and timing to determine whether an authorisation should be renewed, in the event the driver acts as an organiser or transporter.

text: 25. Such DPIA may for example be carried out in the context of the preparation of the implementing acts establishing technical protocols . The Proposal provides that the Commission shall, by means of implementing acts, establish the technical protocols to enable the positioning systems to communicate the position of the vehicle with a defined precision of its geographical location to the Commission information system. The EDPS recalls that any such technical protocols, allowing for processing of personal data for which the Commission is the controller , must comply with the EUDPR. The EDPS recalls that, when a proposal for an implementing act has a possible impact on the protection of personal data, the Commission is required to submit it to the EDPS for consultation in accordance with

text: Article 42

text: EUDPR.

text: 4.2. Scope of processing

text: 26. The Proposal provides an explanation of the necessity of using a positioning system to effectively enforce the rules on journey duration to ensure animal welfare, a public interest. The preamble clarifies that limiting the length of the journey plays a fundamental role in the protection of animals during transport. In practice, the estimated duration of journey times in the initial planning are often exceeded, which can have serious detrimental effects on the welfare of the transported animals. As competent authorities currently lack the means to check the location of consignments during the journey, it is difficult for competent authorities to control that the actual journey duration corresponds to that declared and to target their controls and inspections. According to the Proposal, many of these challenges would to be solved with information gathered via an information system using of real-time positioning tools .

text: 27. Recital 33 further clarifies that: “Accessing information concerning the time at which road vehicles have reached certain key points in the journey, such as control posts or place of destination, would allow competent authorities to strengthen and better plan and target their controls. They could in particular better detect transports that are exceeding maximum journey times, thus identifying transports that are more likely to end with animals in compromised state of welfare’ .

text: 28. The EDPS considers that the Proposal limits the impact of the use of a positioning system on the fundamental rights of the driver by clearly defining which 4 location points will be available in TRACES , and by providing that the positioning system shall only be operational during the journey from the place of departure until arrival at the place of destination . The limitation of data elements and limitation in time contribute to the proportionality of such measure.

text: 29. The EDPS recommends however to further clarify the scope of processing, as it is unclear which data will be included in the Commission information system. The Proposal provides that the positioning system ‘shall record the position of road vehicles on short intervals’ , and that ‘[t]he records obtained from the positioning systems of the means of transport shall be kept in an information system’ . The EDPS considers it unclear whether the Commission information system will include more position records than only the 4 locations that will be available in TRACES . Considering that for the purpose of official controls, position records of only 4 locations are necessary, it appears that there is no necessity to transfer more position records to the Commission information system, as such data shall only be available to the Commission for the purpose of retrieving the data in TRACES . Against this background, the EDPS considers that the future Regulation should further clarify the scope of the processing.

text: 30. The EDPS welcomes that Proposal explicitly limits the purposes of the processing of data gathered by means of the positioning system. Specifically, the Proposal provides that the records obtained from the positioning systems recorded in the Commission information system shall only be accessible to the Commission, for the purpose of retrieving the locations of the 4 points of the journey identified in

text: Article 24(5)

text: in TRACES . The Proposal further provides that the data gathered by means of the real-time positioning system shall also be processed for the only purpose of performing official controls and other official activities as defined in

text: Article 2 of Regulation (EU) 2017/625

text: 4.3. Roles and responsibilities

text: 31. The EDPS positively notes that the Proposal provides for the roles within the meaning of data protection legislation. According to the Proposal, the Commission shall be the controller for the purposes of the real-time tracking positioning systems . The EDPS understands that as soon as the data on the position of road vehicles recorded in the Commission information system is retrieved by TRACES , the Commission and Member States shall be joint controllers of such data, pursuant to Article 11 of Implementing

text: Regulation (EU) 2019/1715

text: 4.4. Storage duration

text: 32. Lastly, the EDPS notes that the Proposal provides for retention periods for recording of positioning data on short period intervals, which shall be retained in the Commission information system for a period of 6 years . Recital 34 provides that: ‘[p]ositioning data recorded in the information system connected to TRACES should only be recorded and kept for the purposes of official controls and other official activities linked to those controls. The retention period of these data should also be 6 years’ .

text: 33. Similar as for the retention of journey logs, the EDPS considers it relevant to assess how long after the finalisation of the journey controls generally take place, and based on such period, whether a shorter storage period than 6 years would be sufficient to achieve the control purposes set out in recital 34. In addition, if no abnormalities are found in the position data records after the journey is finalised, and no further official controls and other official activities as defined in

text: Article 2 of Regulation (EU) 2017/625

text: are to take place, the retention of such data for a period of 6 years may be longer than necessary. He considers that the future Regulation should provide a justification why the relevant storage period is necessary.

text: 34. The EDPS considers it further necessary to clarify whether the records of position data available in TRACES shall be retained for the same period as the data in the Commission information system.

text: 5. Implementing and delegated acts

text: 35. The Proposal provides for several implementing and delegated acts. In addition to the implementing acts under Article 24(8) of the Proposal, referred to under paragraph 28 of this Opinion, it concerns, for example,

text: Article 13(7)

text: that provides for implementing acts regarding among others the establishment of an electronic database for the recording of inspections on livestock vessels for the purposes of this Article and the official controls performed under

text: Regulation (EU) 2017/625

text: 36. In addition, Article 47(2) of the Proposal allows for implementing acts to update the template for journey logs in Annex III;

text: Article 50

text: provides for implementing acts concerning rules for the issuance of electronic authorisations, certificates and journey logs and for the use of electronic signature; and

text: Article 53(2)

text: provides for implementing acts regarding specifications for the development of an application available to operators and competent authorities allowing the performance of administrative tasks in relation to the transport of animals.

text: 37. The EDPS recalls that, when a proposal for a delegated or implementing act has a possible impact on the protection of personal data, the European Commission is required to submit it to the EDPS for consultation in accordance with

text: Article 42

text: EUDPR.

text: 6. Conclusions

text: 38. In light of the above, the EDPS makes the following recommendations: (1) clarify the roles within the meaning of data protection law regarding the processing of personal data in the context of certificates referred to in Chapter III, and the journey logs as referred to in Articles

text: and

text: , by including a reference to this Chapter and these provisions in Article 51(1) of the Proposal; (2) assess whether a shorter storage period than 6 years is sufficient for: 1) personal data related to the authorisations referred to in Chapter II and the certificates referred to in Chapter VIII, after expiry or withdrawal or an authorisation or certificate; 2) journey logs as provided for in Articles 15(6) and 16(2) of the Proposal; and 3) recording of positioning data on short period intervals as provided for in Article 51(6) of the Proposal. The EDPS considers that the future Regulation should include a justification for the storage period; (3) clarify that the Commission information systems as referred to in Article 24(3) of the Proposal will include only position records of the locations provided for in Article 24(4) of the Proposal; and; (4) clarify whether the recording of positioning data on short period intervals available in TRACES shall be retained for the same period as the position data in the Commission information system (6 years), as provided for in Article 51(6) of the Proposal. Brussels, 5 March 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 12


text: COM(2025) 236 final 1

text: COM(2025) 236 final. 2

text: OJ L 295, 21.11.2018, p. 39. 4

text: Regulation (EU) 2021/2115

text: of the European Parliament and of the Council of 2 December 2021 establishing rules on support for strategic plans to be drawn up by Member States under the common agricultural policy (CAP Strategic Plans) and financed by the European Agricultural Guarantee Fund (EAGF) and by the European Agricultural Fund for Rural Development (EAFRD) and repealing Regulations

text: (EU) No 1305/2013

text: and

text: (EU) No 1307/2013

text: , (OJ L 435, 6.12.2021, p. 1–186).

text: Regulation (EU) 2021/2116

text: of the European Parliament and of the Council of 2 December 2021 on the financing, management and monitoring of the common agricultural policy and repealing

text: Regulation (EU) No 1306/2013

text: , (OJ L 435, 6.12.2021, p. 187–261). 6 COM(2025) 236 final. 7 Recital 3 of the Proposal. 8 COM(2025) 236 final, p. 4. 4

text: Communication from the Commission to the European Parliament, the European Council, the Council, the European Economic and Social Committee and the Committee of the Regions ‘A Competitiveness Compass for the EU’, COM(2025) 30 final. 10 Communication from the Commission to the European Parliament, the European Council, the Council, the European Economic and Social Committee and the Committee of the Regions ‘A simpler and faster Europe: Communication on implementation and simplification’, COM(2025) 47 final. 11 Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions ‘A Vision for Agriculture and Food – Shaping together an attractive farming and agri-food sector for future generations’, COM(2025) 75 final. 12 Recital 59 of Proposal. 13 Recital 59 of Proposal. 5

text: Communication from the Commission to the European Parliament, the European Council, the Council, the European Economic and Social Committee and the Committee of the Regions A European strategy for data, COM(2020)66 final. 15

text: Regulation (EU) 2024/903

text: of the European Parliament and of the Council of 13 March 2024 laying down measures for a high level of public sector interoperability across the Union (Interoperable Europe Act) (OJ L, 2024/903, 22.3.2024). 16 See proposed

text: Article 13

text: a(2). For that purpose, the designated authority should, where relevant, collaborate with other national authorities and Union institutions and bodies. To ensure a timely and appropriate follow-up by the Commission, the Member States should submit to the Commission their Roadmaps (recital 60 of the Proposal). 17 See proposed

text: Article 13

text: a(3). 18 EDPS Opinion 1/2023 on the Proposal for an Interoperable Europe Act EDPS Opinion on the Proposal for an Interoperable Europe Act, issued on 13 of June 2023, p. 3. 19

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (Text with EEA relevance) (OJ L 119, 4.5.2016, p. 1). 6

identifier: EDPS yttrande 12/2025

publisher: Europeiska datatillsynsmannen

sprak: en

title: Opinion 12/2025 on the Proposal for a Regulation amending Regulation (EU) 2021/2115 and Regulation (EU) 2021/2116, in particular as regards data and interoperability governance

serie: yttranden

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council amending

text: Regulation (EU) 2021/2115

text: as regards the conditionality system, types of intervention in the form of direct payment, types of intervention in certain sectors and rural development and annual performance reports and

text: Regulation (EU) 2021/2116

text: as regards data and interoperability governance, suspensions of payments annual performance clearance and controls and penalties . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: Regulation (EU) 2021/2115

text: Regulation (EU) 2021/2116

text: as regards data and interoperability governance, suspensions of payments annual performance clearance and controls and penalties (‘the Proposal’).

text: The general objective of the Proposal is to simplify legislation and implementation of Common Agricultural Policy (‘CAP’) Strategic Plans, contributing to administrative burden reduction and the increase of competitiveness. The Proposal introduces an obligation for each Member State to designate one authority responsible for taking or coordinating actions to achieve and maintain national and cross-border interoperability between information systems used for the implementation, administration, monitoring and evaluation of the CAP for the benefit of farmers and other CAP beneficiaries. The designated authority would also be responsible for drawing up and implementing a roadmap containing measures and actions.

text: The EDPS acknowledges the benefits that can be derived from increased interoperability in the public agriculture sector and welcomes the efforts undertaken by the Commission to organize the process towards this goal. At the same time, the EDPS recalls that when personal data need to be exchanged between public bodies, then these bodies must comply with all applicable legislation, including data protection law.

text: Regulation (EU) 2021/2116

text: already contains specific provisions on processing and protection of personal data, with reference to both the GDPR and EUDPR. The EDPS also understands that the Proposal would not introduce any new processing of personal data, nor would it affect the objectives and the purposes of the processing that already exists.

text: Given the subject matter and the provisions of the Proposal, which do not raise specific issues having regard to the protection of personal data, the EDPS does not have specific comments or recommendations on the Proposal.

text: Contents

type: rubrik

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 14 May 2025, the European Commission issued a Proposal for a Regulation amending

text: Regulation (EU) 2021/2115

text: Regulation (EU) 2021/2116

text: Regulation (EU) 2021/2115

text: establishes rules on support for strategic plans to be drawn up by Member States under the Common Agricultural Policy (‘CAP’) Strategic Plans and financed by the European Agricultural Guarantee Fund (‘EAGF’) and by the European Agricultural Fund for Rural Development (‘EAFRD’).

text: Regulation (EU) 2021/2116

text: establishes rules on the financing, management and monitoring of the common agricultural policy .

text: 3. The general objective of the Proposal is to simplify legislation and implementation of CAP Strategic Plans, contributing to administrative burden reduction and the increase of competitiveness. The Proposal aims to address the objective as follows : - on-farm simplification and streamlining of requirements to better adjust to different situations and to a variety of farming practices; - streamlining support for smaller and medium-sized farms by encouraging Member States and farmers to make greater use of simplified payments; - boosting competitiveness; - giving greater flexibility to Member States for the management of CAP Strategic Plans.

text: 4. The need for action in the field was recognised and concrete action was announced in several Commission communications, among them the Communication ‘A Competitiveness Compass for the EU’ , the Communication ‘Simpler and Faster Europe: Communication on implementation and simplification’ , and the Communication ‘A Vision for Agriculture and Food’ .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 15 May 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 81 of the Proposal.

text: 2. General remarks

text: 6. According to the Proposal, enhancing interoperability, including seamless exchange of data, between public agricultural information systems offers a range of operational, statistical, and policy-related benefits, such as reduced data collection burden and improved efficiency, automated data integration and validation, improved data accuracy and reliability, enhanced policy monitoring and more effective collaboration within Member States. However, the absence of a coordinated structure at Member State level, as well as the differences observed in the progress of digital transition among Member States inhibit the effective implementation of interoperability and its benefits .

text: 7. In line with the Commission Communication ‘A Vision for Agriculture and Food’, which underlines the ‘collect once, use multiple times’ principle, Member States should ensure that data is collected only once by the authorities responsible for the implementation, monitoring and evaluation of the CAP and re-used, without asking the farmers several times to provide the same data .

text: 8. Article 2(4) of the Proposal would introduce a new Chapter III on CAP data and interoperability governance in Title II of the

text: Regulation (EU) 2021/2116

text: . According to

text: Article 13

text: a(1) of this new Chapter, each Member State should designate one authority responsible for taking or coordinating actions to achieve and maintain national and cross-border interoperability between information systems used for the implementation, administration, monitoring and evaluation of the CAP for the benefit of farmers and other CAP beneficiaries.

text: 9. In order to achieve and maintain interoperability between information systems used for the implementation, monitoring and evaluation of the CAP, and in consideration of the European Strategy of Data and other relevant EU and national initiatives, such as the Common European Agricultural Data Space and the Interoperable Europe Act , the designated authority would be responsible for drawing up and implementing a roadmap containing measures and actions . That Roadmap should contain, among others, an assessment of the current state of interoperability, as well as assessment of digital identification systems and data sharing mechanisms currently used. To the extent possible, Member States should base their assessment of needs and the design of the measures on the principle that data is collected only once and re-used .

text: 10. The EDPS acknowledges the benefits that can be derived from increased interoperability in the public agriculture sector and welcomes the efforts undertaken by the Commission to organize the process towards this goal. At the same time, the EDPS also recalls that national and cross-border interoperability between information systems affects one of the most fundamental principles of data protection, the principle of purpose limitation. It is therefore crucial that the risks that are being created by removing barriers to information exchange are appropriately considered .

text: 11. When personal data need to be exchanged between public bodies, then these bodies must comply with all applicable legislation including data protection and deploy adequate processes to ensure data quality, access rights and transparency, so that farmers and other CAP beneficiaries are fully informed about which data has been exchanged with whom and for which purpose. In this regard, the EDPS notes that

text: Article 101 of Regulation (EU) 2021/2116

text: contains specific provisions on processing and protection of personal data, in addition to indicating that personal data should be processed in accordance with Regulations

text: (EU) 2016/679

text: (the ‘General Data Protection Regulation’) and the EUDPR. The EDPS also understands that the Proposal would not introduce any new processing of personal data, nor would it affect the objectives and the purposes of the processing that already exists.

text: 12. Given the subject matter and the provisions of the Proposal, which do not raise any specific concerns from a data protection perspective, the EDPS has no further comments on the Proposal.

text: 3. Conclusions

text: 13. In light of the above, the EDPS does not have specific comments or recommendations on the Proposal. Brussels, 9 July 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7

type: vagledning

utgivare: edps


text: OJ L 295, 21.11.2018, p. 39. 2 COM(2026) 195 final 3 COM(2026) 193 final 4 Conclusion Proposal, Recital 2. 4

text: Appendix 7 See EDPB Guidelines 2/2020 on

text: articles 46 (2)

text: (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, section 2.7. 5

text: Idem. 8 See EDPB Guidelines 2/2020 on

text: articles 46 (2)

text: (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, section 2.8. 9 CJEU, October 6, 2015, Judgment in case

text: , Maximillian Schrems v Data Protection Commissioner (“Schrems”), paras 41 and 95. See also CJEU, July 27, 2017, Opinion 1/15 on the agreement envisaged between the European Union and Canada on the transfer of Passenger Name Record data, 26 July 2017, para. 228 and seq.; CJEU, 30 April 2019, Opinion 1/17 on the Comprehensive Economic and Trade agreement between Canada and the European Union, para. 190 and seq. 10 Articles 7, 8 and 47 of the EU Charter 11

text: Article 8

text: ECHR 12

text: Article 6

text: Lisbon Treaty 13 See Appendix 7, points13 and 27 6

text: The latter must be a body that, while not external itself, carries out its functions independently, i.e. free from instructions, with sufficient human, technical and financial resources, etc. EDPB Guidelines 2/2020 on

text: articles 46 (2)

text: (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, paragraph 63. 15 See, for example, Protocol (2024-2029) implementing the Fisheries Partnership Agreement between the European Community and the Republic of Cabo Verde, appendix 6, point 3, Protocol on the implementation of the Fisheries Partnership Agreement between the Democratic Republic of São Tomé and Príncipe and the European Community (2025-2029), appendix 6, point 3 7

text: EDPB Guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, para 41. 17 See EDPB Guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, section 2.5 18 See, for example, Protocol (2024-2029) implementing the Fisheries Partnership Agreement between the European Community and the Republic of Cabo Verde, appendix 6, point 2.3, Protocol on the implementation of the Fisheries Partnership Agreement between the Democratic Republic of São Tomé and Príncipe and the European Community (2025-2029), Appendix 6, point 2.3. 8

identifier: EDPS yttrande 12/2026

title: EDPS Opinion 12/2026 on the signing, provisional application and conclusion of the Protocol on the implementation of the Fisheries Partnership Agreement between the European Union and the Government of Seychelles

text: Opinion 12/2026

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to (1) the Proposal for a Council Decision on the signing, on behalf of the European Union, and provisional application of the Protocol on the implementation of the Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Seychelles (2026-2030) and (2) the Proposal for a Council Decision on the conclusion, on behalf of the European Union, of the Protocol on the implementation of the Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Seychelles. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: The EDPS is consulted on the Commission proposal to sign, provisionally apply and conclude the new Protocol on the implementation of the Fisheries Partnership Agreement between the European Union and the Republic of Seychelles.

text: The EDPS welcomes the inclusion of an article dedicated to data protection, which is supplemented by an appendix to the Annex to the Protocol, expanding the data protection provisions and detailing the conditions relating to the processing of personal data.

text: At the same time, the EDPS notes that a number of relevant specifications and safeguards are not included, in particular as regards the need for an independent supervision and redress mechanism, the rights of the persons concerned, the modalities of onward transfers, and the storage limitation principle.

text: In this regard, the EDPS recommends providing for effective oversight and for a system that enables data subjects to continue to benefit from redress mechanisms after their data has been transferred to the Republic of Seychelles, taking into account the EDPB Guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies.

text: The EDPS also recommends detailing the modalities for the accommodation of data subject rights, as well providing for specific safeguards in case of processing of personal data relating to criminal convictions and offences.

text: The EDPS also invites to further specify additional safeguards for onward transfers of personal data between the Seychelles Authorities and third authorities. Finally, the EDPS recommends clearly defining the maximum duration for which the data may be stored and made available.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 12 May 2026, the European Commission issued: - A Proposal for a Council Decision on the signing, on behalf of the European Union, and provisional application of the Protocol on the implementation of the Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Seychelles (2026-2030) (‘the Signing Proposal’ ) and - A Proposal for a Council Decision on the conclusion, on behalf of the European Union, of the Protocol on the implementation of the Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Seychelles Proposal for a Council Decision on the conclusion, on behalf of the European Union, of the Protocol on the implementation of the Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Seychelles (2026-2030) (‘the Conclusion Proposal’).

text: 2. The objective of the Signing Proposal is (i) to authorise the signing, on behalf of the Union, of the new Protocol on the implementation of Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Seychelles (‘the Protocol’) and (ii) to provide for the provisional application of the Protocol.

text: 3. The objective of the Conclusion Proposal is to approve the Protocol.

text: 4. The aim of the Protocol is to allow Union vessels to fish in Seychelles’ fishing zone, to enable the Union and Seychelles to work closely together to further promote the development of a sustainable fisheries policy and the responsible exploitation of fisheries resources in Seychelles’ fishing zone and in the Indian Ocean. That cooperation will also contribute to the creation of decent working conditions in the fishing industry .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 12 May 2026, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 7 of the Signing Proposal and in Recital 5 of the Conclusion Proposal.

text: 2. General remarks

text: 6. The EDPS welcomes the inclusion in the Protocol of a specific article on data protection. Indeed,

text: Article 11

text: provides that the data shall be processed by the competent authorities ‘solely for the purpose of implementing the Agreement, and in particular, for management purposes and for fisheries monitoring, control and surveillance’. It also specifies that personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject.

text: Article 11

text: is supplemented by an Appendix to the Annex, which expands the data protection provisions of the draft Protocol. The EDPS notes with satisfaction that these provisions include the definitions of ‘personal data’ and ‘processing’, the categories of personal data to be processed, the designation of authorities responsible for the processing of data, the principles of purpose limitation and data minimisation, and the designation of the EDPS and national data protection supervisory authorities as authorities in charge of the supervision of compliance of the processing of personal data, where such processing falls respectively within the competence of the Commission or that of the flag Member State.

text: 8. The EDPS recalls that in absence of an adequacy decision, transfers of personal data to a third country may be based on a legally binding and enforceable instrument between public authorities or bodies. In such a case, such instrument should provide appropriate safeguards and ensure that enforceable data subjects’ rights and effective legal remedies for data subjects are available.

text: 9. The EDPS notes that a number of relevant specifications and safeguards have not yet been provided for, in particular with respect to the need for effective oversight and to provide data subjects with the possibility to obtain effective administrative redress before an independent oversight body where the processing of personal data falls under the competence of the Republic of Seychelles, the rights of the persons concerned, the modalities of onward transfers and the storage limitation principle.

text: 3. Supervision and redress mechanisms

text: 10. In order to guarantee enforceable and effective data subjects rights, the international agreement should provide for a system that enables data subjects to continue to benefit from redress mechanisms after their data has been transferred to a non-EEA country or an international organisation . These redress mechanisms should provide data subjects with the possibility to complain to the public bodies that are parties to the international agreement and (either directly or after having addressed the relevant party) to an independent oversight body, including, where available, an independent data protection authority .

text: 11. In order to make sure that all obligations created under an international agreement are fulfilled, the international agreement should also provide for independent supervision monitoring the proper application of the agreement and interferences with the rights provided under the agreement .

text: 12. The necessity of having an independent redress and supervision mechanism in charge of the compliance of the personal data processing with the provisions set out in the agreement has been underlined by the European Court of Justice . In this regard, the EDPS notes that such a mechanism is ensured when the processing of personal data falls under the competence of the Commission or of a flag Member State.

text: 13. For the Seychelles, on the other hand, the responsible authority for such supervision seems to be the same authority as the one responsible for the processing of data, namely the Seychelles Fisheries Authority. In light of the information available to the EDPS, the proposed Fisheries Partnership Agreement does not detail how the conditions for effective supervision and redress mechanisms would be met within the meaning of EU Charter and the European Convention of Human Rights (ECHR) in accordance with the jurisprudence of the European Court of Human Rights (ECtHR) and in the terms established in primary law as well as the corresponding case law. Indeed, this authority seems to be also the one designated as the authority responsible for the processing of data .

text: 14. The EDPS invites the Commission to clarify and specify how the need for an independent, effective and impartial supervisory oversight mechanism can be fulfilled in the Seychelles, in the light of the EDPB guidelines 2/2020 on

text: Articles 46(2)

text: 15. Point 29 of the Appendix indicates data subjects may seek redress for any non-compliance with the safeguards set out in Article 11 of this Protocol and this Appendix ‘to the extent permitted by the relevant laws of each Party’.

text: 16. The EDPS recalls that - in line with the EDPB Guidelines 02/2020 - in case there is no possibility to ensure effective judicial redress, such as because of limitations in domestic law, the international agreement should include alternative safeguards that provide protections essentially equivalent to the right to an effective remedy under Article 47 of the Charter of Fundamental Rights of the European Union (EU Charter). Against this background, the EDPS also underlines that in the absence of a supervisory authority specifically in charge with the supervision of data protection law in the third country, independent, effective and impartial supervisory oversight mechanism should still be ensured through alternative mechanisms. This could involve relying on other existing oversight bodies or creating functionally autonomous mechanisms that operate independently , whose decisions shall be binding for the receiving party.

text: 4. Data subjects’ rights

text: 17. The EDPS considers point 25 of the Appendix, concerning the ‘access to personal data and request for correction and deletion’, should be further detailed, as it is the case in similar Protocols on the implementation of the sustainable fisheries partnership agreement between the European Union and third countries . In particular, in the context of access to personal data, each receiving authority should, at the request of data subjects, confirm whether or not personal data relating to them is being processed, provide information on the purpose of the processing, types of personal data, storage period to the extent possible, right to request rectification or deletion, right to lodge a complaint, provide a copy of the personal data processed, and provide general information on the applicable safeguards. Moreover, the procedures applicable to respond to requests from data subjects should be specified in the appendix.

text: 18. The EDPS acknowledges that, under point 23 of the Appendix (‘Transparency’), ‘the European Union shall ensure that data subjects are informed (…) of the type of data transferred and further processed, the manner in which personal data is processed, the relevant tool used for the transfer, the purpose of the processing, the third parties or categories of third parties to which the information may be further transferred, the individual rights and mechanisms available to them to exercise their rights and obtain redress, and details of where they can bring proceedings or lodge complaints’. However, such information seems to be only available when the authority responsible for the processing of personal data is the Union or a Member State. The Agreement should also specify transparency obligations when the authorities from Seychelles are the ones responsible for the processing.

text: 5. Personal data relating to criminal convictions and offences

text: 19. Chapter VII of the annex, which is entitled ‘Infringement’ foresees cases of offences committed by a Union vessel in Seychelles’ fishing zone. The EDPS recalls that data processed to prevent and fight against illegal fishing may constitute personal data relating to criminal convictions and offences, in which case appropriate safeguards for the rights and freedoms of data subjects should be provided, in accordance with

text: Article 10

text: GDPR and/or

text: Article 11

text: EUDPR. The EDPS recommends adding in the Appendix a provision that would specify these specific safeguards.

text: 6. Onward transfers of personal data

text: 20. Point 24 of the Appendix (‘Onward transfer’) indicates that the receiving authority may only transfer personal data received under this Protocol to a third party if this is justified by an important public interest objective and if the other requirements laid down in this Appendix are met.

text: 21. The EDPS notes that the provision laid down in point 24 of the Appendix does not specify what constitutes an ‘important public interest objective’ that could justify the receiving authority transferring data received under the draft protocol to a third authority.

text: 22. The EDPS recalls that, should the parties to the agreement consider it necessary to allow for onward transfers, the agreement should foresee that such transfers can only take place if the transferring public body has given its prior and express authorisation and the receiving third parties commit to respect the same data protection principles and safeguards as included in the international agreement . The EDPS also recommends to list the different cases allowing the onward transfers of personal data received under the draft Protocol to third authorities .

text: 7. Storage limitation

text: 23. According to the storage limitation principle, personal data should be kept in a form which permits identification of data subjects for no longer than necessary for the purposes for which the personal data are processed. The period of time should be as short as possible in relation to the purpose pursued and must be justified so as to ensure that the storage is limited to what is strictly necessary for the purposes pursued. The EDPS recommends clearly defining the maximum duration for which the data may be stored and made available, as it is the case as it is the case in the other Protocols already quoted in this Opinion .

text: 8. Conclusions

text: 24. In light of the above, the EDPS makes the following recommendations: (1) to amend the Proposed Agreement or where relevant make use of the Joint Committee referred to in application of Article 13(2) of the Protocol to specify effective supervision and redress mechanisms in the light of the EDPB Guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, (2) to amend the Proposed Agreement or where relevant to make use of the Joint Committee to further detail the modalities for the exercise of data subjects’ rights under point 25 of Appendix 7, and to specify the modalities of exercise of the right of redress provided under point 29 of the same Appendix, (3) to amend the Proposed Agreement or where relevant to make use of the Joint Committee to add in Appendix 7 to the Annex a provision that would specify the safeguards to be provided in the context of the processing of data relating to criminal convictions and offences, (4) to amend the Proposed Agreement or where relevant to make use of the Joint Committee to detail in point 24 of Appendix 7 the different cases allowing the onward transfers of personal data received under the draft Protocol to third authorities in the light of the EDPB guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, (5) to amend the Proposed Agreement or where relevant to make use of the Joint Committee to clearly define in point 18 of Appendix 7 to the Annex the maximum duration for which the data may be stored and made available. Brussels, 3 July 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 9