text: COM(2025) 415 final. COM(2025) 417 final. 1

text: OJ L 295, 21.11.2018, p. 39. 4 COM(2025) 415 final. 5 COM(2025) 417 final. See COM(2025) 415 and 417 final, p.1. 7 See COM(2025) 415 and 417 final, p.2 and Article 1 of the Convention. 8 Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions on ProtectEU: a European Internal Security Strategy, COM/2025/148 final. 9 Resolution adopted by the General Assembly on 24 December 2024; A/RES/79/243. 5

text: See Article 64(4) of the Convention and COM(2025) 415 and 417 final, p.4. 11 EDPS Opinion 9/2022 on the Recommendation for a Council Decision authorising the negotiations for a comprehensive international convention on countering the use of information and communications technologies for criminal purposes, issued on 18 May 2022. 12 See COM(2025) 415 and 417 final, p.1. 13 CETS No. 185. 6

text: CETS No. 224. 15 The Council adopted decisions authorising Member States to sign and ratify the Second Additional Protocol in the interest of the EU:

text: Council Decision (EU) 2022/722 of 5 April 2022

text: authorising Member States to sign, in the interest of the European Union, the Second Additional Protocol to the Convention on Cybercrime on enhanced co-operation and disclosure of electronic evidence (OJ L 134, 11.5.2022, p. 15–20, ELI: http://data.europa.eu/eli/dec/2022/722/oj) and

text: Council Decision (EU) 2023/436 of 14 February 2023

text: authorising Member States to ratify, in the interest of the European Union, the Second Additional Protocol to the Convention on Cybercrime on enhanced cooperation and disclosure of electronic evidence (OJ L 63, 28.2.2023, p. 48–53, ELI: http://data.europa.eu/eli/dec/2023/436/oj). 16 The Protocol will enter into force on the first day of the month following the expiration of a period of three months after the date on which five Parties to the Cybercrime Convention have expressed their consent to be bound by the Protocol in accordance with the provisions of

text: Article 16(1)

text: and (2) of the Protocol. Up until the issuing of this Opinion, two Parties have ratified the Protocol. 17 See COM(2025) 415 and 417 final, p. 3. 18 Judgment of the Court of Justice of 30 April 1974, R. & V. Haegeman v. Belgian State,

text: , ECLI:EU:C:1974:41, par. 5. 19 Judgment of the Court of Justice of 3 June 2008, Intertanko and Others,

text: , ECLI:EU:C:2008:312, par. 42. 20 Judgment of the Court of Justice of 3 September 2008, Kadi and Al Barakaat International Foundation v. Council,

text: P and

text: , ECLI:EU:C:2008:461, par. 285. 21 See also the EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data, issued on 19 December 2019. 22 PNR Canada Opinion of the Court of Justice of 26 July 2017, , ECLI:EU:C:2017:592, par. 214. 7

text: See COM(2025) 415 and 417 final, Part 2, p. 6. 24 See Opinions of the Court of Justice of 6 October 2021, A-1/19 par. 284-285 and of 26 July 2017, PNR Canada, ECLI:EU:C:2017:592, par. 96. See also EDPB- EDPS Joint Opinion 5/2021 on the proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), issued on 18 June 2021, par. 11. 8

text: In line with its

text: Article 1

text: , the main purpose of the Convention is the fight against cybercrime and cooperation in the criminal field. 26

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, pp. 89). 9

text: Judgment of the Court of Justice of 2 October 2018, Ministerio Fiscal,

text: , ECLI:EU:C:2018:788, par. 54, see also par. 56. 32 Ibid, par. 62. 33

text: Article 40(21)

text: (c) of the Convention. See also Section 4.3. of this Opinion. 34

text: Regulation (EU) 2023/1543

text: of the European Parliament and of the Council of 12 July 2023 on European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings and for the execution of custodial sentences following criminal proceedings (OJ L 191, 28.7.2023, pp. 118). 35 See EDPS Opinion 9/2022, par. 34. 36 See EDPS Opinion 9/2022, par. 24. 12

text: Article 2

text: (h) defines “serious crime” as conduct constituting an offence punishable by a maximum deprivation of liberty of at least four years or a more serious penalty. It should also be noted that the e-Evidence Regulation, considers as “serious crime” offences that carry at least a three-year maximum custodial sentence (see recital 40 and

text: Article 5

text: ). In this sense, the Convention provides a higher threshold for the definition of a serious crime. 38 See Article 25(1) of the Budapest Convention. 39 See EDPS Opinion 9/2022, par. 26. 13

text: It should be noted that the Budapest Convention contains a similar provision (

text: Article 19(4)

text: ). Paragraph 202 of the Explanatory Report to the Budapest Convention notes that “The information that can be ordered to be provided is that which is necessary to enable the undertaking of the search and seizure, or the similarly accessing or securing. The provision of this information, however, is restricted to that which is "reasonable". In some circumstances, reasonable provision may include disclosing a password or other security measure to the investigating authorities. However, in other circumstances, this may not be reasonable; for example, where the disclosure of the password or other security measure would unreasonably threaten the privacy of other users or other data that is not authorised to be searched.” 41 Judgment of the Court of Justice of 8 April 2014, Digital Rights Ireland and Seitlinger and others,

text: and

text: , par. 40. 42 ECtHR judgment of 13 February 2024, 33696/19, § 79. 43 See Human Rights Council, Resolution 47/16 on the promotion, protection and enjoyment of human rights on the Internet, UN Doc. A/HRC/RES/47/16 (26 July 2021). 44 See also EDPB-EDPS Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse, adopted on 28 July 2022, par. 13. 45 See EDPS Opinion 9/2022, par. 38. 14

text: See EDPS Opinion 9/2022, par. 21-22. 15

text: Resolution A/79/460 of 27 November 2024. 16

identifier: EDPS yttrande 23/2025

amnesord:
Cybercrime Convention
International Cooperation

title: EDPS Opinion 23/2025 on the two Proposals for Council Decisions on the signing and conclusion of the United Nations Convention against Cybercrime

text: Opinion 23/2025

text: on the two Proposals for Council Decisions on the signing and conclusion of the United Nations Convention against Cybercrime

text: The European Data Protection Supervisor (EDPS) is an independent institution of the European Union (EU), responsible under

text: Article 52(2) of Regulation (EU) 2018/1725

text: ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3) of Regulation (EU) 2018/1725

text: ‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under

text: Article 42(1) of Regulation (EU) 2018/1725

text: , the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Council Decision on the signing, on behalf of the European Union, of the United Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes and the Proposal for a Council Decision on the conclusion, on behalf of the European Union, of the United Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposals that are relevant from a data protection perspective.

text: Executive Summary

text: On 16 July 2025, the European Commission issued two Proposals for Council Decisions on the signing and conclusion of the United Nations Convention against Cybercrime. The Convention aims to provide common rules at global level to enhance cooperation on cybercrime and the collection of evidence in electronic form for the purpose of criminal investigations or proceedings.

text: The EDPS is aware that cybercrime is a global and cross-border phenomenon, thus requiring close cooperation between authorities in different countries. The EDPS therefore supports the efforts to devise new models of co-operation, including in the context of co-operation with third countries through international instruments, provided they are compatible with the EU laws and values.

text: The EDPS recalls the vast number of countries within the United Nations and their highly heterogeneous legal systems as regard the respect of fundamental rights and freedoms, including the fundamental rights to privacy and data protection. Against this background, the EDPS considers of paramount importance to ensure that cooperation with third countries under the Convention does not lead to weakening or otherwise prejudicing the protection of fundamental rights and freedoms of natural persons guaranteed under EU law, in particular their rights to data protection and privacy.

text: The EDPS positively notes that the Convention expressly states that States Parties are not required to transfer personal data if the data cannot be provided in compliance with their applicable laws concerning the protection of personal data. Member States implementing and applying the Convention should therefore carefully assess whether the conditions of Chapter V of the Law Enforcement Directive are fulfilled before transferring personal data to a third country in each specific case. Member States competent authorities should also carefully consider whether the transfer of personal data to a third country that is Party to the Convention is fully consistent with their own obligations under international human rights law and the fundamental rights and freedoms of the individuals concerned.

text: Where appropriate, Member States’ competent authorities should make use of the grounds to refuse cooperation. Cooperation should be refused, for example, in relation to crimes that are nonexistent in their legal system, or if Member States’ competent authorities would not be allowed to carry out the action requested with regard to any similar offence under their own jurisdiction, taking into account the relevant case law of the Court of Justice of the European Union. If they do decide to cooperate, Member States competent authorities should make use of the international cooperation mechanism that offers the most robust data protection safeguards in that particular case.

text: When adopting measures to enable the search and seizure of stored electronic data, Member States should carefully assess the potential impact, in particular on fundamental rights and cybersecurity, of any measure that may result in the weakening or degrading of encryption.

text: As the protection of personal data is not one of the essential aims or components of the Convention, the EDPS recommends to remove Article 16 of the Treaty on the Functioning of the

text: European Union as a legal basis for the Proposals to sign and conclude the Convention. Finally, the EDPS recommends to carefully assess the effects of the current text of the Convention in practice and to involve data protection experts in future reviews. Any possible future attempts to include in the Convention offences that are not in line with EU law or values should be strongly opposed.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union (TFEU),

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 16 July 2025, the European Commission issued the Proposal for a Council Decision on the signing, on behalf of the European Union, of the United Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes and the Proposal for a Council Decision on the conclusion, on behalf of the European Union, of the United Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes (‘the Proposals’).

text: 2. The objective of the Proposals is to obtain from the Council of the European Union the authorisation for the European Commission to sign and conclude the United Nations Convention against Cybercrime (‘the Convention') on behalf of the European Union .

text: 3. The Convention aims to provide common rules at global level to enhance cooperation to prevent and combat cybercrime and on the collection of evidence in electronic form for the purpose of criminal investigations or proceedings, creating a basis for cooperation with many countries with whom neither the EU nor its Member States have agreements in place . As such, the Convention is in line with the objectives set out in ProtectEU – the European Internal Security Strategy .

text: 4. The United Nations’ (UN) General Assembly adopted the text of the Convention and the resolution accompanying it by consensus, on 24 December 2024 . The Convention is envisaged to be opened for signature in Hanoi, Vietnam on 25 October 2025, and thereafter at United Nations Headquarters in New York until 31 December 2026. The Convention will enter into force once 40 States Parties have expressed their consent to be bound by the Convention in accordance with

text: Article 65

text: , paragraphs 1 and 2, of the Convention.

text: 5. The Convention also provides that a regional economic integration organization, such as the European Union, can sign and ratify the Convention if at least one of the Member States signs and ratifies it .

text: 6. On 18 May 2022, the EDPS issued his Opinion 9/2022 on the Recommendation for a Council Decision authorising the negotiations for the Convention. The EDPS welcomes that most of the recommendations made in that Opinion have been incorporated or otherwise addressed in the final text of the Convention.

text: 7. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 16 July 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 18 of the Proposals.

text: 2. General remarks

text: 8. The EDPS understands that cybercrime continues to be a growing threat to the security of citizens and businesses in the European Union and globally, and that electronic evidence is increasingly important for criminal investigations, both into online and traditional crimes . The EDPS is also aware that cybercrime is a global and almost always cross-border phenomenon, thus requiring close cooperation between authorities in different countries. The EDPS therefore supports the efforts to devise new models of co-operation, including in the context of co-operation with third countries through international instruments, provided they are compatible with the EU laws and values.

text: 9. The EDPS recalls that the UN Convention is not the first international instrument for cooperation in the field of cybercrime. The 2001 Council of Europe Convention on Cybercrime (the ‘Budapest Convention’) already facilitates the fight against criminal offences making use of computer networks. The Budapest Convention is open to Member States of the Council of Europe, as well as non-members upon invitation. To date, it has 80 States Parties, including 26 European Union Member States. Moreover, the Second Additional Protocol to the Budapest Convention includes updated rules on the exchange 15 16 of electronic evidence , which, however, are not yet in force .

text: 10. The EDPS furthermore notes that the European Union and its Member States are also parties to two of the main United Nations’ criminal justice instruments of almost universal adoption, the United Nations Convention against Organised Crime (UNTOC) and the United Nations Convention against Corruption (UNCAC) .

text: 11. Pursuant to

text: Article 216(2)

text: TFEU, international agreements concluded by the European Union “are binding upon the institutions of the Union and on the Member States”. Moreover, according to the settled case law of the Court of Justice of the European Union (CJEU), international agreements become ‛an integral part of Community law’ from their coming into force and they have primacy over acts of secondary Union legislation .

text: 12. Since the Convention is a binding international instrument, the EDPS reminds that, in line with the case law of the CJEU, the “obligations imposed by an international agreement cannot have the effect of prejudicing the constitutional principles of the EC Treaty, which include the principle that all Community acts must respect fundamental rights, that respect constituting a condition of their lawfulness” .

text: 13. Transfers of personal data in the context of criminal investigations are liable to have a significant impact on the lives of the individuals concerned, as they will be used in prosecution cases in the receiving country, under its national law. Any interference with the fundamental rights to privacy and data protection guaranteed by Articles 7 and 8 of the Charter of Fundamental Rights of the EU (the ‘Charter’), caused by the application of the Convention, must fulfil the requirements of Article 52(1) of the Charter .

text: 14. In this context, the EDPS recalls that the CJEU, in Opinion 1/15 on the international agreement between the EU and Canada regarding the transfer of Passenger Name Records (PNR) data to Canada, found that “a transfer of personal data from the European Union to a non member country may take place only if that country ensures a level of protection of fundamental rights and freedoms that is essentially equivalent to that guaranteed within the European Union” .

text: 15. The EDPS finally recalls the vast number of countries within the UN and their highly heterogeneous legal systems as regard the respect of fundamental rights and freedoms, including the fundamental rights to privacy and data protection. Against this background, the EDPS considers of paramount importance to ensure that cooperation with third countries under the Convention does not lead to weakening or otherwise prejudicing the protection of fundamental rights and freedoms of natural persons guaranteed under EU law, in particular their rights to data protection and privacy. This Opinion aims to provide constructive and objective advice with a view of ensuring that the level of data protection guaranteed by EU law is not undermined.

text: 3. Legal basis

text: 16. According to the Explanatory Memorandum of the Proposals , the legal basis for the Proposals are the following provisions of the TFEU:

text: Article 16(2)

text: Article 82(1)

text: , Article (83)(1),

text: Article 87(1)

text: and

text: Article 218(5)

text: Article 218

text: TFEU lays down the procedure for the negotiation and conclusion of agreements between the European Union and third countries or international organisations.

text: Article 82(1)

text: TFEU regulates matters on the facilitation of the cooperation between judicial or equivalent authorities in relation to proceedings in criminal matters and the enforcement of decisions.

text: Article 83(1)

text: TFEU regulates the definition of criminal offences in the area of cybercrime and

text: Article 87(2)

text: TFEU regulates measures concerning law enforcement cooperation.

text: 18. Under

text: Article 16(2)

text: TFEU, the Union has the power to adopt measures relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies and by Member States when carrying out activities which fall within the scope of Union law.

text: 19. In line with the jurisprudence of the CJEU,

text: Article 16

text: TFEU provides an appropriate legal basis in cases where the protection of personal data is one of the essential aims or components of the rules adopted by the EU legislature .

text: 20. The EDPS welcomes that the Convention, already in its Preamble, acknowledges the right to protection against arbitrary or unlawful interference with one’s privacy, and the importance of protecting personal data. This is a novelty in the UN criminal justice instruments, as the UNTOC and UNCAC do not contain such statements.

text: 21. At the same time, as will be further explained in Section 4.1 of this Opinion, the protection of personal data does not seem to be one of the essential aims or components of the Convention. The Convention contains one provision on personal data protection (

text: Article 36

text: ) and this provision mainly consists in preserving domestic legal regimes on the protection of personal data when it comes to transfers of personal data. The Convention itself does not contain any other safeguards specifically for the protection of personal data. It is therefore an accessory provision that does not alter the centre of gravity of the Convention which is clearly criminal law matters .

text: 22. As the protection of personal data is not one of the essential aims or components of the Convention, the EDPS recommends removing

text: Article 16

text: TFEU as a substantive legal basis from the Proposals.

text: 4. Relevant safeguards in the Convention

text: Article 36

text: on protection of personal data

text: 23. Article 36 of the Convention provides that States Parties are not required to transfer personal data if the data cannot be provided in compliance with their applicable laws concerning the protection of personal data. States Parties must also ensure that the personal data received in accordance with the Convention are subject to effective and appropriate safeguards. In addition, in case of onward transfers of personal data obtained in accordance with the Convention to a third country or an international organization, the concerned State Party must notify and request the authorization of the original transferring State Party.

text: 24. Even if the scope of Article 36 of the Convention is limited to transfers only, the EDPS positively notes the inclusion of a provision explicitly referring to data protection. As far as the EDPS is aware, this is a novelty in the UN legal framework dealing with cooperation in the criminal justice field and should therefore be welcomed.

text: 25. Transfers of personal data by competent authorities of EU Member States to third country authorities competent in the field of law enforcement are primarily regulated by

text: Directive (EU) 2016/680

text: (the ‘LED’), in particular by its Chapter V.

text: 26. In order to ensure that the level of protection of natural persons guaranteed by EU law is not undermined, Chapter V of the LED lays down specific conditions for the transfer of personal data to third countries. The transfer must be based on a transfer instrument, such as an adequacy decision, an instrument ensuring appropriate safeguards (e.g. an international agreement), an assessment by the competent law enforcement authority that such safeguards are ensured in the third country, or, failing the above, one of the derogations available for specific cases (the latter should not be relied upon for systematic sharing of personal data).

text: 27. In the absence of an adequacy decision issued by the European Commission to enable personal data to be transferred to a given third country, transfers of personal data can still take place if appropriate data protection safeguards are provided in a legally binding instrument .

text: 28. As the European Data Protection Board (EDPB) explains in its Guidelines 01/2023 on

text: Article 37

text: LED, it is important to clarify from the outset what might constitute a legally binding instrument under

text: Article 37(1)

text: (a) LED. First, it should be distinguished between the mere existence of an agreement on cooperation between Parties that entails the exchange of personal data, on the one hand and, on the other hand, the existence of an agreement that regulates the processing of personal data and adduces the necessary safeguards. It is not sufficient to have an agreement in place which provides for a legal basis for the judicial cooperation on criminal matters between the Parties and the inherent data exchanges. Such an agreement does not qualify as a lawful mechanism for the international transfer of personal data under this provision of the LED, unless it contains appropriate data protection safeguards .

text: 29. Having this in mind, the EDPS emphasises that, while the Convention itself, as a typical criminal law cooperation instrument, can entail a legal basis for processing in the sense of

text: Article 8

text: LED, it does not (and does not purport to) provide the necessary appropriate safeguards to serve as a basis for transfer within the meaning of

text: Article 37(1)

text: (a) LED. Therefore, when deciding on a request from a third country, another basis for transfer under Chapter V of the LED should always be identified in order to ensure appropriate data protection safeguards for the transfer of personal data.

text: Article 6

text: on respect for human rights

text: 30. Article 6 of the Convention lays down an overarching requirement for States Parties to respect their obligations under international human rights law when implementing the Convention. Moreover,

text: Article 6

text: prohibits any interpretation of the Convention permitting suppression of human rights or fundamental freedoms, including the rights related to the freedoms of expression, conscience, opinion, religion or belief, peaceful assembly and association, in accordance and in a manner consistent with applicable international human rights law. As far as the EDPS is aware, such a provision is also a novelty in the UN legal framework dealing with cooperation in the criminal justice field and should therefore also be welcomed.

text: 31. While a dedicated provision aiming to ensure respect for human rights is indeed a positive development, the EDPS also notes that the requirement for States to implement their obligations under the UN Convention “consistent with their obligations under international human rights law” could be implemented differently by States Parties as not all of them have adhered to the same (if any) international agreements providing for the protection of human rights or have implemented the same (or similar) human rights standards.

text: 32. The EDPS therefore calls on the competent authorities of Member States to carefully consider whether the transfer of personal data to a third country that is Party to the Convention is fully consistent with their own obligations under international human rights law and the fundamental rights and freedoms of the individuals concerned.

text: 4.3. Grounds to refuse cooperation

text: 33. Article 40 of the Convention enables States Parties to refuse requests for international cooperation for a variety of reasons, including: - if the requested State Party considers that execution of the request is likely to prejudice its sovereignty, security, ordre public or other essential interests (which is often internationally interpreted to cover also human rights considerations ) (

text: Article 40(21)

text: (b)); - if the authorities of the requested State Party would be prohibited by its domestic law from carrying out the action requested with regard to any similar offence (

text: Article 40(21)

text: (c)); - if the requested State Party has substantial grounds for believing that the request has been made for the purpose of prosecuting or punishing a person on account of that person’s sex, race, language, religion, nationality, ethnic origin or political opinions, or that compliance with the request would cause prejudice to that person’s position for any one of these reasons (

text: Article 40(22)

text: 34. The EDPS notes that similar grounds for refusal exist in the Budapest Convention and considers that proper application of these grounds can contribute to the protection of fundamental rights, including the right to the protection of personal data. Notwithstanding this, the EDPS calls on the competent authorities of Member States to carefully scrutinise every request for mutual assistance on a case-by-case basis. Where appropriate, competent authorities should make use of the grounds to refuse cooperation, especially if such cooperation would be incompatible with the fundamental rights, freedoms and general principles of EU law as enshrined in the Treaties and in the Charter.

text: Article 24

text: on conditions and safeguards in national law

text: 35. The EDPS notes that Chapter IV of the Convention, “Procedural Measures and Law Enforcement”, prescribes a range of powers and procedures that States Parties must have in place for purposes of investigating and prosecuting cybercrime.

text: Article 24

text: requires that the establishment, implementation and application in national law of those powers and procedures should be subject to conditions and safeguards. Similarly to Article 6 of the Convention, these safeguards are to be provided by State Parties’ domestic law, in accordance with their obligations under international human rights law.

text: 36. The EDPS also notes that Article 23 of the Convention provides that these procedural measures in principle should be available not only for the offenses criminalized under Chapter II of the Convention, but also for other criminal offenses committed by means of an information and communication technology system as well as for the collection of electronic evidence of any criminal offense.

text: 37. The EDPS recalls that, in accordance with CJEU case law, only the objective of fighting serious crime is capable of justifying access by public authorities to personal data retained by service providers “which taken as a whole, allows very precise conclusions to be drawn concerning the private lives of the persons concerned” . Where such conclusions cannot be drawn and therefore access could not “be defined as a serious interference with the fundamental rights of the persons whose data is concerned”, the Court further held that “the interference that access to such data entails is capable of being justified by the objective of (...) preventing, investigating, detecting and prosecuting ‘criminal offences’ generally without it being necessary that those offences be defined as ‘serious’” .

text: 38. The EDPS therefore reminds that any establishment, implementation and application of powers and procedures in national law of Member States, must fully comply with EU law and CJEU jurisprudence. In addition, when assessing a request emanating from a third country that is a State Party to the Convention, Member States’ competent authorities should carefully assess the subject matter of the request, as well as conditions and safeguards provided for in a specific third country. Where relevant, Member States should use the possibility to refuse cooperation in accordance with Articles 36 and 40 of the Convention, including the possibility to refuse such cooperation if the authorities of the requested State Party would be prohibited by their domestic law from carrying out the action requested with regard to any similar offence . In this regard, the EDPS welcomes that the Convention, in its

text: Article 2

text: (c), (d) and (f) distinguishes between specific data categories that may be the subject matter of a request, similarly to the Budapest Convention and

text: Regulation (EU) 2023/1543

text: (the ‘e-Evidence Regulation’), as this should contribute to ensure legal certainty for all stakeholders involved .

text: 5. Scope of the Convention

text: 5.1. Criminal offences covered by the Convention

text: 39. In his Opinion 9/2022, the EDPS recommended limiting the scope of the international cooperation provisions to crimes defined in the Convention, as this would constitute an important additional guarantee of the necessity and proportionality of the measures provided for by the Convention, having in mind the highly heterogeneous legal systems of the possible future Parties to the Convention . However, Article 40(1) of the Convention provides for the possibility for mutual legal assistance in investigations, prosecutions and judicial proceedings not only in relation to the offences established in accordance with the Convention, and for the purposes of the collection of evidence in electronic form of offences established in accordance with the Convention, but also for (other) serious crimes.

text: 40. While the EDPS would have preferred the scope of the cooperation under the Convention to be limited to crimes defined in the Convention, the EDPS is also aware that this “expanded” scope for cooperation is not entirely new in international criminal law instruments.

text: 41. In this regard, the EDPS positively notes that the scope of cooperation under the Convention is actually more limited than the one provided for in the Budapest Convention as the cooperation under the Convention is limited to serious crimes only, while the Budapest Convention allows for cooperation for the collection of evidence in electronic form for any type of crime .

text: 42. Even though the scope of cooperation under the Convention is limited to serious crimes only, the EDPS recommends that, before cooperating with third countries, Member States’ competent authorities, carefully analyse what constitutes a ‘serious crime’ in the third country in question. Where relevant, Member States should make use the possibility to refuse cooperation in accordance with Article 40 of the Convention. In particular, they should refuse cooperation for crimes that are non-existent in the EU and Member States legal systems, or if they would be prohibited by their domestic law from carrying out the action requested with regard to any similar offence, had it been subject to investigation, prosecution or judicial proceedings under their own jurisdiction.

text: 5.2. Excluding direct access to data and direct cooperation with service providers by law enforcement authorities

text: 43. In his Opinion 9/2022, the EDPS recommended that the EU should oppose any provisions in the Convention that would provide for cross-border direct access to data or cross-border direct cooperation with service providers, as the EDPS considers cross-border direct access to data by law enforcement authorities of third countries as a particularly intrusive measure and consequently having a bigger impact on the fundamental rights to privacy and data protection .

text: 44. In that sense, the EDPS is satisfied that the Convention does not provide for any provisions on direct cross-border access to data or direct cross-border cooperation with service providers.

text: 6. Search and seizure of stored electronic data

text: 45. Article 28(4) of the Convention provides that each State Party must adopt such legislative and other measures as may be necessary to empower its competent authorities to order any person who has knowledge about the functioning of the information and communications technology system in question, the information and telecommunications network, or their component parts, or measures applied to protect the electronic data therein, to provide, as is reasonable, the necessary information to enable the undertaking of the measures referred to in paragraphs 1 to 3 of that Article.

text: 46. The EDPS observes that Article 28(4) of the Convention may result in States Parties imposing obligations upon third parties, such as communication services providers to effectively provide competent authorities with access to encrypted communications .

text: 47. In that regard, the EDPS recalls that the CJEU has considered that data security measures play a key role to ensure that the essence of the fundamental right to the protection of personal data in Article 8 of the Charter is not adversely affected . In addition, in the case of Podchasov v. Russia , the European Court of Human Rights (ECtHR) considered that an “obligation to decrypt end-to-end encrypted communications risks amounting to a requirement that providers of such services weaken the encryption mechanism for all users; it is accordingly not proportionate to the legitimate aims pursued”.

text: 48. In the digital age, technical solutions to secure and protect the confidentiality of electronic communications, including measures for encryption, are key to ensure the enjoyment of all fundamental rights . The EDPS therefore calls on Member States to carefully consider the potential impact, in particular on fundamental rights and cybersecurity, of any measures that might result in the weakening or degrading of encryption . In particular, Member States should abstain from imposing any obligations that would weaken data security for all users of an electronic communications service.

text: 7. List of competent authorities

text: 49. In his Opinion 9/2022, the EDPS recommended that the Convention be accompanied by an exhaustive list of competent authorities in the receiving countries to which data would be transferred as well as a short description of their competences .

text: 50. The EDPS considered this as a useful safeguard in order to enable EU authorities to easily identify to which specific authorities the data would be transferred and to ensure that they would also be competent for the purposes of the transfer.

text: 51. The EDPS notes that Article 40(12) of the Convention provides that each State Party shall designate a central authority or authorities that would have the responsibility and power to receive requests for mutual legal assistance and either to execute them or to transmit them to the competent authorities for execution. In addition,

text: Article 40(15)

text: (b) requires that a request for mutual assistance also contains “the name and functions of the authority conducting the investigation, prosecution or judicial proceeding”. The EDPS considers that this information should enable Member States’ central authorities to easily identify to which specific authorities data would be transferred and to ensure that they would also be competent for the purposes of the transfer.

text: 8. Relationship with other instruments

text: 52. The Convention is not the first and only international instrument for cooperation in the field of cybercrime. Already in his Opinion 9/2022, the EDPS recommended that other agreements with third countries should apply in lieu of the Convention, should these agreements ensure higher standards with regard to the protection of fundamental rights, in particular the right to privacy and data protection, and that it should be ensured that, between EU Member States, EU secondary law still applies in order to preserve the EU legal order .

text: 53. The EDPS welcomes Article 60 of the Convention, which confirms that States Parties that have already concluded an agreement or treaty on the matters dealt with in the Convention, or have otherwise established their relations on such matters, or should they in future do so, are entitled to apply that agreement or treaty or to regulate those relations accordingly.

text: 54. In addition to the application of EU secondary law between themselves, the EDPS recommends Member States to use the cooperation mechanism that offers the most robust data protection safeguards when cooperating with third countries.

text: 9. Review of the Convention

text: 55. The EDPS notes Article 57 of the Convention, which establishes a Conference of the States Parties to the Convention, a body that should convene no later than one year after the entry in force of the Convention. Amongst other, the Conference must review periodically the implementation of the Convention and make recommendations for improvement, as well as considering possible supplementation or amendment of the Convention.

text: 56. The EDPS welcomes this possibility for review of the practical implementation of the Convention and recommends including data protection experts, including representatives of national data protection authorities, in these reviews.

text: 10. Additional protocols to the Convention

text: 57. Point 5 of the Resolution A/79/460 , tied to the Convention, requires the UN ad hoc Committee to already begin negotiating a supplementary protocol that would include additional criminal offenses. The Committee would hold two sessions of a duration of 10 days each, with the first session taking place two years after the adoption of the Convention by the General Assembly and the second session in the following calendar year.

text: 58. The EDPS would like to caution against rushing into the start of negotiations for expanding the scope of the Convention before having carefully assessed the effects of the current text of the Convention in practice.

text: 59. In addition, if the negotiations were to start in the near future and the EU is to join these future negotiations, the EU should strongly oppose any possible attempt to include in the Convention offences that are not in line with the EU laws or values.

text: 11. Conclusions

text: 60. In light of the above, the EDPS recommends to remove

text: Article 16

text: TFEU as a legal basis for the Proposals.

text: 61. In addition, the EDPS makes the following recommendations to Member States implementing and applying the Convention: (1) before transferring personal data to a third country that is a State Party to the Convention, Member States’ competent authorities should carefully assess whether the conditions of Chapter V of the LED are fulfilled (as the Convention does not provide the necessary appropriate safeguards to serve as a basis for transfer within the meaning of

text: Article 37(1)

text: (a) LED); (2) where appropriate, Member States’ competent authorities should make use of the grounds to refuse cooperation, in line with Articles 36 and 40 of the Convention. In particular, Member States competent authorities should refuse cooperation in relation to crimes that are nonexistent in their legal system, or if they would be prohibited by their domestic law from carrying out the action requested with regard to any similar offence, had it been subject to investigation, prosecution or judicial proceedings under their own jurisdiction; (3) when adopting measures to enable the search and seizure of stored electronic data, Member States should carefully assess the potential impact, in particular on fundamental rights and cybersecurity, of any measure that may result in the weakening or degrading of encryption; (4) when handling a third country request for international cooperation, Member States competent authorities should carefully consider whether the transfer of personal data to a third country that is Party to the Convention is fully consistent with their own obligations under international human rights law and the fundamental rights and freedoms of the individuals concerned and make use of the international cooperation mechanism that offers the most robust data protection safeguards in that particular case; (5) to involve data protection experts, including representatives of national data protection authorities, in the reviews of the Convention.

text: 62. Finally, the EDPS recommends to carefully assess the effects of the current text of the Convention in practice and oppose any attempts to include in the Convention offences that are not in line with EU law or values. Brussels, 4 September 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 17


text: OJ L 295, 21.11.2018, p. 39. 2 COM(2022) 457 final.

text: COM(2022) 457 final, p.3. 4 COM(2022) 457 final, p.1. 5

text: Ibid, p. 2 6 COM(2022) 457 final, p.2. See the EDPS Preliminary remarks on modern spyware, issued on 15 February 2022.

text: Explanatory Memorandum to the Proposal, p.5. 9 EDPS Opinion 3/2018 on online manipulation and personal data, issued on 19 March 2018, p. 22. 10 Ibid, p.22. 11 See Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, 2022 Rule of Law Report, COM(2022) 500 final, p. 2 and section 3.2., p.17 and onwards. 6

text: OJ L 119, 4.5.2016, p. 1.

text: See CJEU judgment of 14 February 2019, Sergejs Buivids,

text: , ECLI:EU:C:2019:122, para. 51-53, or CJEU judgment of 16 December 2008, Satakunnan Markkinapörssi and Satamedia, C 73/07, EU:C:2008:727, para. 56, 58, 61. 7

text: OJ L 95, 15.4.2010, p. 1. 15 OJ L 201, 31.7.2002, p. 37–47. 16 OJ L 119, 4.5.2016, p. 89–131. 17 COM(2022) 457 final, p.5, last paragraph. 8

text: COM(2022) 457 final, p.3 19 SWD(2022) 286 final 20 On 10 March 2022 the European Parliament set up a special PEGA Committee to investigate alleged infringement or maladministration in application of EU law in relation to the use of Pegasus and equivalent spyware surveillance software. 21 See also the case law of the European Court of Human Rights, inter alia, Judgment of 25 May 2021 (Grand Chamber), Big Brother Watch and Others v. the United Kingdom,

text: , 62322/14 and 24960/15. The Court found a violation of Article 10 of the European Convention of Human Rights and specifically pointed out at the lack of sufficient protections for confidential journalistic material (see in particular § 442-450). 22 See for example the case law of the European Court of Human Rights, inter alia judgment of 27 March 1996, Goodwin v. the United Kingdom, C- 17488/90, § 39, decision on the admissibility of 8 December 2005, Nordisk Film & TV A/S v. Denmark,C- 40485/02 or decision on the admissibility of 27 May 2014, Stichting Ostade Blade v. the Netherlands,

text: . 23 See recital 17 of the Proposal. 9

text: EDPS Preliminary remarks on modern spyware, issued on 15 February 2022, p. 9. 25 See for example the ENISA Glossary available at https://www.enisa.europa.eu/topics/csirts-in-europe/glossary/malware

text: According to Amnesty International’s Security Lab, “Pegasus can do more than what the owner of the device can do”, https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/ 27 See above, footnote 24, p. 3 and 4. 10

text: See above, footnote 24, p. 8.

text: See

text: Article 2(12)

text: and

text: Article 7(1)

text: . 30 See pending case before the European Court of Human Rights, Follorou v. France (no. 30635/17) and Johannes v. France (no. 30636/17). 31 See for example Chapter VI, Section 1 “Independent status" of the GDPR. 11

text: See FRA report Surveillance by intelligence services: fundamental rights safeguards and remedies in the EU - Volume II: field perspectives and legal update, Chapter 14. 12

text: OJ L 245, 22.9.2022, p. 56. The Recommendation provides that: “(20) Media service providers are encouraged to ensure that detailed, comprehensive and up-to-date information on their ownership is easily and directly accessible to the public, including, to the extent possible, to persons with disabilities. In particular, it is recommended that media service providers ensure access to the information related to: (a) whether and if so to what extent their direct or beneficial ownership is held by the government, a state institution, state-owned enterprise or other public body; (b )the interests, links or activities of their owners in other media or non-media businesses; (c) any other interests that could influence their strategic decision-making or their editorial line; (d) any changes to their ownership or control arrangements. (21)Member States are encouraged to take action to effectively implement the Recommendation CM/Rec(2018)1 of the Committee of Ministers to member States on media pluralism and transparency of media ownership. In particular, Member States are encouraged to entrust a relevant national regulatory authority or body with developing and maintaining a dedicated online media ownership database, containing disaggregated data about different types of media, including at regional and/or local levels, to which the public would have easy, swift and effective access free of charge, and producing regular reports on the ownership of media services under the jurisdiction of a given Member State. (22)Member States and their national regulatory authorities or bodies are encouraged to hold regular exchanges of best practices in the area of media ownership transparency. In particular, such exchanges should focus on identifying and promoting the most effective measures or tools to increase the transparency of media ownership and to improve administrative cooperation in this area.” See the Commission impact assessment report accompanying the Proposal, page30 : The revised AVMSD encourages Member States to adopt measures to make accessible information on the ownership structure of (only) audiovisual media. The

text: Directive (EU) 2015/849

text: of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing amending

text: Regulation (EU) No 648/2012

text: , and repealing Directive

text: Directive

text: (OJ L 141, 5.6.2015, p. 73) aims to ensure the beneficial ownership transparency of corporate and other legal entities incorporated within the EU. In particular, it requires that information on beneficial ownership is available to the general public through central registers in each Member State. The Proposal for a Regulation of the European

text: Parliament and of the Council on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (COM/2021/420 final) under negotiations would further harmonise the beneficial ownership transparency obligations. In addition, the

text: Directive (EU) 2017/1132 of 14 June 2017

text: relating to certain aspects of company law (OJ L 169, 30.6.2017, p.46) harmonises disclosure requirements for EU limited liability companies and requires that such information is publicly available in the national business registers and can be accessed through the Business Registers Interconnection System. These EU legislation and legal initiatives are not media-specific but apply to media companies as well.

text: Article 30 Directive

text: sets out the obligation for Member States to ‛take appropriate measures to provide each other and the Commission with the information necessary for the application of this Directive, in particular Articles

text: and

text: , in particular through their competent independent regulatory bodies’. According to the impact assessment report of the Commission accompanying the Proposal (SWD(2022)286 final) (p. 257), this Directive as amended by

text: Directive (EU) 2018/1808

text: (the revised AVMSD) ‛created the European Regulators Group for Audiovisual Media Services (ERGA) as a technical advisory group to the Commission. While ERGA concluded a voluntary Memorandum of Understanding to strengthen cooperation between its members, its current status as an expert group and the non-binding character of its cooperation does not allow it to resolve cross-border issues, issue guidance (in particular on media pluralism issues), or take collective action”. The aim of the Proposal is therefore to “step up the current cooperation by giving powers to ERGA to resolve effectively cross-border cases through cooperation, to issue opinions or guidance in regulatory areas relevant to media pluralism, and to coordinate actions against third country service providers’. 14

text: EDPS Preliminary remarks on modern spyware, issued on 15 February 2022. 15

identifier: EDPS yttrande 24/2022

publisher: Europeiska datatillsynsmannen

sprak: en

title: Opinion on the European Media Freedom Act

serie: yttranden

text: 11 November 2022

type: rubrik

text: Opinion 24/2022

text: on the Proposal for a Regulation establishing a common framework for media services in the internal market (European Media Freedom Act) and amending Directive

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under

text: Article 52(2) of Regulation (EU) 2018/1725

text: ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under

text: Article 42(1) of Regulation (EU) 2018/1725

text: , the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council establishing a common framework for media services in the internal market (European Media Freedom Act) and amending Directive

text: . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the draft Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 16 September 2022, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council establishing a common framework for media services in the internal market (European Media Freedom Act) and amending Directive

text: The Proposal aims to improve the functioning of the internal media market, particularly by fostering cross-border activity and investment in media services, increasing regulatory cooperation and convergence, facilitating the provision of quality media services and ensuring a transparent and fair allocation of economic resources in the internal media market.

text: The EDPS welcomes the aim of the Proposal to protect media freedom and pluralism, as a precondition for the functioning of the EU internal market for media services and, equally important, a key enabler for the rule of law and democratic accountability in the Union.

text: However, the EDPS recommends to first clarify the scope of the future Regulation, both personal and material. In particular, he notes that, despite the intention of the Commission, clearly expressed in the Proposal, to lay down rules ensuring the protection at EU level of the sources of journalists including freelancers, the scope of the Proposal as currently defined only includes media service providers and does not encompass all journalists. The EDPS recommends adding an explicit reference to journalists to the relevant provisions of the future Regulation, so as to clarify that any journalist, including free-lance or self-employed, would fall within the scope of the future Regulation and thus could also be able to rely on a robust protection of journalistic sources and communication. In addition he recommends clarifying the criteria for determining when a journalist falls within the jurisdiction of a Member State. The EDPS also recommends to horizontally clarify that the future Regulation is without prejudice to and does not affect the EU legislation on personal data protection and privacy, in particular the General Data Protection Regulation, the ePrivacy Directive and the Law Enforcement Directive.

text: Secondly, while the EDPS fully supports the objective of the Proposal to provide specific guarantees for media freedom and pluralism, he has doubts about how effective the proposed measures would be in practice to achieve the objective pursued. In particular, the EDPS considers that, as it stands,

text: Article 4(2)

text: (b) and (c) of the Proposal, in particular regarding the exceptions to the prohibition of intercepting, subject to surveillance media service providers, including by deploying spyware on their devices, do not provide enough safeguards and lack legal clarity. The EDPS invites the colegislators to further define and restrict the possibility to waive the protection of journalistic sources and communications, in line with the principles of strict necessity and proportionality as interpreted in the case law of the CJEU and the ECtHR. In particular, he remains convinced that the only viable and effective option to protect the fundamental rights and freedoms in the Union, including media freedom, against highly advanced military-grade spyware is a general ban on its development and deployment with very limited and exhaustively defined exceptions, complemented by robust safeguards, such as those suggested in the EDPS Preliminary remarks on modern spyware.

text: Thirdly, with regard to the national independent authority or body in charge of handling complaints in relation to breaches of

text: Article 4(2)

text: (b) and (c) of the Proposal, the EDPS recommends 2

text: ensuring that the future Regulation explicitly set out specific guarantees of independence and provide for an explicit legal basis for cooperation between the relevant supervisory authorities, each acting within their respective areas of competence. In addition, the EDPS recommends that the future Regulation require a structured cooperation between the competent supervisory authorities, including data protection authorities and make explicit reference to the national competent supervisory authorities involved in the cooperation and identify the circumstances in which cooperation should take place. In particular, the EDPS recommends ensuring that the independent competent authorities designated under the future Regulation have the power and duty to consult with the relevant other national competent supervisory authorities, including data protection authorities, in the context of their investigations and compliance assessments. With regard to national data protection authorities, the EDPS specifically recommends clarifying that competent independent authorities under the future Regulation should be able to provide to the competent supervisory authorities under the GDPR and the LED, upon request or on their own initiative, any information obtained in the context of any audits and investigations that relate to the processing of personal data and to include an explicit legal basis to that effect.

text: Moreover, regarding the publication of information concerning the media service providers and in particular their owners and beneficial owners, the EDPS recommends explicitly specifying in the Proposal the objective(s) of public interest pursued and ensuring that the list of categories of information to be made available under Article 6(1) of the Proposal be clearly defined and explicitly listed in the future Regulation.

text: Lastly, the EDPS recommends clarifying whether any personal data would be processed throughout the cooperation or mutual assistance between national regulatory authorities or bodies set out in the Proposal and, if so, to explicitly lay down the purposes of the processing, the specific categories of personal data to be processed, the data retention period and the identification of the roles and responsibilities of the national regulatory authorities and bodies within the meaning of data protection law.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 16 September 2022 the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council establishing a common framework for media services in the internal market (European Media Freedom Act) and amending Directive

text: (‘the Proposal’) .

text: 2. The Proposal is articulated around four specific objectives, namely: 1) fostering cross-border activity and investment in media services by harmonising certain elements of the diverging national media pluralism frameworks, in particular to facilitate cross-border service provision; 2) increasing regulatory cooperation and convergence through cross-border coordination tools and EU-level opinions and guidelines; 3) facilitating the provision of quality media services by mitigating the risk of undue public and private interference in editorial freedom and 4) ensuring a transparent and fair allocation of economic resources in the internal media market by enhancing transparency and fairness in audience measurement and allocation of state advertising .

text: 3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 16 September 2022, pursuant to Article 42(1) of the EUDPR. The EDPS welcomes the reference to this consultation in recital 54 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of the EUDPR.

text: 2. General remarks

text: 4. According to the Explanatory Memorandum to the Proposal, the media sector is not only an important economic sector, but also essential for a healthy civic sphere and for economic freedoms and fundamental rights . Moreover, the independent media and news media particularly have a crucial role in preserving the integrity of the European information space and are key to the functioning of democratic societies and economies .

text: 5. However, as reflected in the Explanatory Memorandum to the Proposal, media independence and pluralism are increasingly faced with various challenges which affect the ability to provide quality media services, such as interference in the editorial decisions, uneven guarantees of independence for public service media, opaque and unfair allocation of state advertising, rogue media service providers financially or editorially controlled by certain third countries . Furthermore, in the light of the revelations about the unprecedented risks posed by the modern surveillance technologies on fundamental rights , the Proposal aims to add ‛targeted safeguards against deployment of spyware in the devices used by the media service providers or journalists’ .

text: 6. In addition, recital 4 of the Proposal underlines the challenges raised by some providers which systematically engage in disinformation, including information manipulation and interference. In this regard, the EDPS recalls the risks created by online manipulation, often powered by modern technologies like artificial intelligence. In his 2018 Opinion on Online Manipulation, the EDPS recalled that “[o]nline manipulation poses a threat to society because filter bubbles and walled communities make it harder for people to understand each other and share experiences” and that “[t]he weakening of this ‘social glue’ may undermine democracy as well as several other fundamental rights and freedoms” . In the Opinion, the EDPS also highlighted that part of the solution to tackle the issue of online manipulation not only consists in enforcing existing rules, but also in tandem with other norms for elections and media pluralism .

text: 7. The EDPS firmly believes that the protection of media freedom and pluralism is not only a fundamental right enshrined in the Charter and a condition for the functioning of the EU internal market for media services but, equally important, a key enabler for the rule of law and democratic accountability in the Union, as evidenced by Commission 2022 Rule of Law Report .

text: 8. Therefore, the EDPS welcomes the aim of the Proposal to address the abovementioned challenges and to provide additional safeguards for media freedom and pluralism.

text: 9. Against this background, the comments and the recommendations in the current Opinion strive to promote, as far as the fundamental rights to privacy and data protection are impacted, on the one hand, additional legal clarity and certainty of the future Regulation, and on the other hand, the effectiveness of the proposed measures for enhancing the fundamental right to freedom of expression and information, democracy and rule of law through independent and pluralistic media in the EU.

text: 3. Specific remarks

text: 3.1. Subject matter and scope

text: 10. The EDPS notes that the personal and the material scope of the Proposal are not clearly defined and may lead to different interpretations, thus affecting the legal certainty. This observation relates more specifically to the status of self-employed journalists and the relationship with the EU legal framework on personal data and privacy.

text: 11. According to recital 16 of the Proposal, journalists and editors are considered the main actors in the production and provision of trustworthy media content. Moreover, the same recital underlines the need for a robust protection of journalistic sources and communications, including against deployment of surveillance technologies, for media service providers and journalists. In this context, the Proposal clarifies that the notion of ‘journalist’ includes also those operating in non-standard forms of employment, such as freelancers. The EDPS fully supports this approach, which corresponds also to the interpretation in

text: recital 153

text: of

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (‛the GDPR’), last sentence: “[i]n order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary to interpret notions relating to that freedom, such as journalism, broadly”.

text: 12. However, the EDPS notes that, while Article 2 of the Proposal (‘Definitions’) in points (1), (2) and (3) defines media service, media service provider and public media service provider respectively, thus clearly including them within the scope of the Proposal, no such definition is provided for ‘journalist’.

text: 13. Despite the statement in recital 16, the main body of the Proposal does not seem to include all journalists, and in particular, does not explicitly clarify the situation of journalists in non-standard forms of employment (such as freelance or self-employed investigative journalists) . This omission is particularly problematic in the context of

text: Article 4(2)

text: (b) and (c) of the Proposal, where the proposed specific safeguards against interception and surveillance and against deployment of spyware are afforded only to “media service providers or, if applicable, their family members, their employees or their family members”. As the personal scope of these measures seems exhaustively defined, it may be interpreted as excluding self-employed/freelance journalists.

text: 14. In this regard, the EDPS recommends clarifying in the main body of the future Regulation that all journalists, including free-lance or self-employed, would fall within the scope of the future Regulation and thus could also be able to rely on a robust protection of journalistic sources and communication. To this end, an explicit reference to journalists should be added to the relevant provisions of the future Regulation, and not only to media service providers.

text: 15. Furthermore, the EDPS notes that, contrary to Directive

text: of the European Parliament and of the Council of 10 March 2010 on the coordination of certain provisions laid down by law, regulation or administrative action in Member States concerning the provision of audiovisual media services (Audiovisual Media Services Directive) , the Proposal does not contain any provision establishing the criteria for determining the journalists falling within the jurisdiction of the Member States. The EDPS recommends clarifying such criteria in the future Regulation.

text: 16. Additionally, pursuant to Article 1(2) of the Proposal, the proposed Regulation should not affect the rules laid down in a number of related Directives and Regulations therein. However, the EU legal framework on personal data protection and GDPR, Directive

text: of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (‘ePrivacy Directive’) and

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (‘LED’) are not included in the list.

text: 17. The EDPS recalls that the rules on data protection and privacy and the rules on freedom of expression and information may sometimes lead to tension, therefore,

text: Article 85

text: GDPR explicitly obliges the Member States to “reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes”. The EDPS welcomes Article 23(2) of the Proposal, according to which the right to data protection and privacy would not be affected by the obligation set out under this provision on providers of proprietary audience measurement systems to provide, without undue delay, to the affected third parties with a legitimate economic interest, accurate, detailed, comprehensive, intelligible and up-to-date information on the methodology used by their audience measurement systems.

text: 18. However, in the absence of any horizontal reference to the respect of data protection and privacy rights and obligations, other than the aforementioned provision, the EDPS considers that there is no sufficient clarity about the relationship of the Proposal with the EU legal framework on personal data and privacy.

text: 19. In this regard, also in the light of the Explanatory Memorandum to the Proposal , the EDPS recommends that the future Regulation horizontally clarifies that it is without prejudice to and does not affect the data protection and privacy rights and obligations under EU law, in particular the GDPR, the ePrivacy Directive and the LED.

text: 3.2. Deployment of surveillance technologies

text: 20. Under the specific policy objective of ‛[f]acilitating provision of quality media services’ , the Proposal lays down targeted safeguards for media service providers, their family members, their employees or their family members against interference by public authorities and bodies, including, inter alia, protection against interception and surveillance (

text: Article 4(2)

text: (b) of the Proposal) and against deployment of spyware (

text: Article 4(2)

text: (c) of the Proposal).

text: 21. The EDPS fully supports the objective of the Proposal to provide specific guarantees for media freedom and pluralism. However, he has doubts on how effective the proposed measures would be in practice in achieving the objective pursued to protect the fundamental rights of the targeted individuals, including their right to data protection and privacy.

text: 22. First of all, the EDPS notes with regret that such a complex and sensitive matter like the protection of journalistic sources and communication against interception and surveillance is only barely mentioned in the Impact Assessment Report accompanying the Proposal without any proper assessment of the necessity and proportionality of the envisaged measures. Even more deplorable is the fact that the issue of spyware, despite its political and media prominence in the EU and globally, is not referred to and analysed at all in the Impact Assessment.

text: 23. The EDPS welcomes the call in recital 17 of the Proposal for harmonisation and further strengthening at Union level of the protection of journalistic sources and communications and the related provision under

text: Article 4(2)

text: (b) of the Proposal prohibiting Members States, including their national regulatory authorities or bodies, “to detain, sanction, intercept, subject to surveillance or search and seizure, or inspect media service providers or, if applicable, their family members, their employees or their family members, or their corporate and private premises, on the ground that they refuse to disclose information on their source”’.

text: 24. The EDPS also understands that such prohibition cannot be absolute and unconditional and thus exceptions could be justified by an “overriding requirement in the public interest, in accordance with Article 52(1) of the Charter and in compliance with other Union law” . At the same time, the lack of further legal details framing such limitations and adducing safeguards in relation to the fundamental rights of the affected individuals actually could undermine the added value of the provision of

text: Article 4(2)

text: (b). Given the heterogeneous regulatory frameworks on the protection of journalistic sources at national level at the moment , it is not clear whether an ‘overriding requirement in the public interest’ should be understood narrowly, e.g. investigation of a serious crime or prevention of an imminent threat, or broadly, i.e. including also administrative inquiries. Therefore, the EDPS considers that, as it stands, the provision of

text: Article 4(2)

text: (b) of the Proposal does not provide enough safeguards and lacks legal clarity. In this regard, he invites the legislators to further define and restrict the possibility to waive the protection of journalistic sources and communications, in line with the principles of strict necessity and proportionality, taking into account the case law of the Court of Justice of the European Union and of the European Court of Human Rights.

text: 25. With regard to the measures against spyware in

text: Article 4(2)

text: (c) of the Proposal, in addition to the above mentioned considerations, the EDPS would like to draw the attention on other important open questions and potential risks for the effective protection of the fundamental rights journalists and media service providers, including the right to personal data and privacy.

text: 26. The EDPS recalls that, as already stated in his Preliminary remarks on modern spyware , highly advanced spyware (such as Pegasus) has the potential of causing unprecedented risks and damages not only to fundamental rights and the freedoms of individuals but also to democracy and the rule of law. Moreover, in his Preliminary remarks, the EDPS recommended a ban on the development and deployment of such spywares in the EU in order to effectively protect the fundamental rights and freedoms of citizens in the EU. Therefore, the EDPS strongly supports the Proposal’s aim to forbid the deployment of spyware in any device or machine used by media service providers or journalists.

text: 27. At the same time, the EDPS considers that it is necessary to make a clear distinction between the ‘traditional’ interception and surveillance measures referred in

text: Article 4(2)

text: (b) of the Proposal and the deployment of spyware pursuant to

text: Article 4(2)

text: (c) of the Proposal.

text: 28. The EDPS notes that, according to the definition of Article 2(16) of the Proposal, the term spyware is introduced as a 'product with digital elements specially designed to exploit vulnerabilities in other products with digital elements', while other publicly available definitions of spyware mostly focus on its nature as a type of malicious software (or malware), intended to perform harmful and undesirable operations such as the ones already described in the current definition . Furthermore, in his Preliminary remarks on modern spyware, the EDPS highlighted a number of other features of hacking tools like Pegasus which make them ‘a paradigm shift’ in terms of access to private communications and devices, able to affect the very essence of our fundamental rights, especially the right to privacy. In particular, the EDPS underlined the ability of such tools to grant complete and unrestricted access to the targeted device, to be deployed via “zero-click” attack, i.e. a hacking attack that does not require any action by the user to be triggered, and the difficulty to detect them .

text: 29. In addition, as reflected in his Preliminary remarks on modern spyware , the EDPS considers that if such spyware tools are nevertheless used, such cases must be of an exceptional nature in order to be compatible with the EU legal order, such as the prevention of imminent terrorist attacks. However, despite the effort in

text: Article 4(2)

text: (c) of the Proposal to limit the exceptions to the prohibition of spyware, the EDPS is not convinced that the legal provision sufficiently defines the exceptional nature of any possible use of such highly intrusive technology and is able to prevent its wider or systematic deployment. Therefore, the EDPS considers that, as it stands, the provision of

text: Article 4(2)

text: (c) of the Proposal lacks precision, does not provide enough safeguards and thus could even be counterproductive to its objective by actually regularising the use of highly intrusive spyware technology beyond a very limited number of exceptional cases.

text: 30. The EDPS remains convinced that the only viable and effective option to protect the fundamental rights and freedoms in the Union, including media freedom, against highly advanced military-grade spyware is a general ban on its development and deployment with very limited and exhaustively defined exceptions, complemented by robust safeguards, such as those suggested in the EDPS Preliminary remarks on modern spyware .

text: 3.3. Independent oversight and cooperation between supervisory authorities

text: 31. The EDPS notes that Article 4(3) of the Proposal provides for as an additional safeguard an obligation for Member States to designate an independent authority or body to handle complaints for breaches of

text: Article 4

text: , (2), points (b) and (c).

text: 32. However, the EDPS considers that the Proposal lacks clarity as to how such designated independent authorities or bodies would differ from and/or relate to the already-existing national audio-visual regulators (provided for in Directive

text: and whose tasks and powers are extended under the Proposal ) and the relevant national data protection authorities or other national authorities .

text: 33. Furthermore, the EDPS notes that, while the Proposal provides for the designation of such national independent authorities or bodies, it does not set out any form of guarantee of independence of such authorities or bodies (including specific independence criteria) in order to reconcile the various interests and rights at stake. Therefore, the EDPS strongly recommends that the future Regulation explicitly set out specific independence guarantees of the designated authorities or bodies under

text: Article 4(3)

text: , such as protection against direct or indirect external influence, sufficient resources, etc. .

text: 34. In addition, the EDPS would like to remind the inherent challenges, both legal and practical, for the effective supervision of surveillance measures, especially when carried out for national security purposes by intelligence agencies. In this regard, the EU Fundamental Rights Agency (‘FRA’), building on its research, highlighted several specific aspects, directly related to the ability of an oversight or supervisory body to investigate the complaints, such as the access to classified information and the relevant expertise of the staff of the supervisory authority, given the highly technical nature and sophistication of the surveillance measures . These elements, in addition to the requirements for independence, should be taken into account when Member States are designating the respective national authority or body.

text: 35. The EDPS considers it necessary to ensure effective cooperation and complementarity with already-existing national supervisory authorities, this being necessary to also increase transparency and accountability of the actors regulated by the Proposal. In this regard, the EDPS strongly recommends that the future Regulation: (1) provide for an explicit legal basis for cooperation between the relevant supervisory authorities, each acting within their respective areas of competence; (2) require a structured cooperation between the competent supervisory authorities, including data protection authorities; (3) make explicit reference to the national competent supervisory authorities involved in the cooperation and identify the circumstances in which cooperation should take place.

text: 36. In addition, the EDPS also recommends ensuring that the independent competent authorities designated under the future Regulation have the power and duty to consult with the relevant other national competent supervisory authorities, including data protection authorities, in the context of their investigations and compliance assessments. With regards to national data protection authorities, the EDPS also recommends clarifying that competent independent authorities under the future Regulation should be able to provide to the competent supervisory authorities under the GDPR and the LED, upon request or on their own initiative, any information obtained in the context of any audits and investigations that relate to the processing of personal data and to include an explicit legal basis to that this effect.

text: 37. In any event, the EDPS stresses the need to avoid possible interference or other conflict by the designated authority or body under 4(3) of the Proposal with the activities of the existing supervisory authorities, in particular those competent under the GDPR, the LED, and the ePrivacy Directive.

text: 38. Lastly, the EDPS notes a potential gap in the scope of the supervision of the various obligations envisaged in the Proposal. The independent authority or body designated pursuant to Article 4(3) of the Proposal would be only competent to handle complaints about regarding breaches of paragraph 2, points (b) and (c) of that Article. At the same time, according to Article 7 of the Proposal, the national regulatory authorities or bodies referred to in

text: Article 30 of Directive 2010/13/EU

text: would only be responsible for the application of Chapter III of the future Regulation. Thus it seems that no national authority or body would actually be competent for the supervision of enforcement of important rules in the Proposal, in particular the prohibition to interfere in or try to influence in any way, directly or indirectly, editorial policies and decisions by media service providers pursuant to

text: Article 4(2)

text: (a) of the Proposal or the transparency obligations pursuant to Article 6(1) of the Proposal.

text: 3.4. Publication of personal data of beneficial owners

text: 39. The EDPS notes that Article 6(1) of the Proposal provides that “[m]edia service providers providing news and current affairs content shall make easily, directly and permanently accessible to the recipients of their services at least the following information: a) their legal name and contact details, b) the name(s) of their direct or indirect owner(s) with shareholdings enabling them to exercise influence on the operation and strategic decision making and c) the name(s) of beneficial owners within the meaning of

text: Article 3(6) of Directive (EU) 2015/849

text: ” (‘the anti-money laundering Directive’). It stems from the impact assessment report accompanying the Proposal, that the rationale for such access by recipients of media services is to ensure transparency on the factors that can influence editorial decisions and media accountability vis-à-vis their audiences. The EDPS understands and welcomes the obligation to make certain categories of personal data public in order to achieve transparency and specific objectives of public interest. However, given the interference to the fundamental rights to privacy and data protection stemming from the publication of such personal data, the EDPS recommends specifying explicitly in the future Regulation the objective(s) of public interest pursued with this provision.

text: 40. Such access would enhance the effects of

text: Commission Recommendation (EU) 2022/1634 of 16 September 2022

text: on internal safeguards for editorial independence and ownership transparency in the media sector, as per its section III on media ownership transparency . It would also enhance the effects of the revised AVMSD by establishing an obligation to make such information accessible and by expanding both its personal scope (it would apply to any media company and not only audiovisual) and material scope (it would ensure the availability of information on the interests and activities of media companies’ owners in other media or non-media economic sectors). Additionally, it would complement the horizontal instruments, which do not require the disclosure of such information . 13

text: 41. However, the EDPS understands that, as Article 6(1) of the Proposal refers to ‘at least the following information’ with reference to the categories of information to be made available, the list may not be exhaustive. In this regard, the EDPS notes that the categories of personal data to be made publicly available should be clearly and exhaustively defined as well, taking into account the principles of necessity and proportionality . To this end, for the sake of clarity and foreseeability of provisions laying down limitations to fundamental rights the EDPS recommends ensuring that the list of categories of information to be made available be clearly defined and explicitly outlined in the future Regulation.

text: 3.5. Exchange of information between national regulatory authorities or bodies

text: 42. The EDPS notes that Article 13(1) of the Proposal provides, within the section on regulatory cooperation and convergence, that ‛[a] national regulatory authority or body may request (‘requesting authority’) cooperation or mutual assistance at any time from one or more national regulatory authorities or bodies (‘requested authorities’) for the purposes of exchange of information or taking measures relevant for the consistent and effective application of this Regulation or the national measures implementing Directive

text: 43. In this regard, the EDPS understands that, due to the nature and purpose of such cooperation between two (or more) national regulatory authorities or bodies, personal data may also be processed. However, the EDPS notes that no reference is made to the categories of information that would be processed within the cooperation, including personal data.

text: 44. Moreover, the EDPS also underlines that, should any personal data be processed throughout the cooperation or mutual assistance mechanism, this would require specific clarification as to the roles and responsibilities within the meaning of data protection law between the national regulatory authorities and bodies involved. This is also particularly relevant in order to ensure that the data subjects can fully exercise their rights under the GDPR.

text: 45. Consequently, the EDPS considers that the future Regulation should explicitly clarify whether any personal data would be processed. If so, the Proposal should also specify the purpose for processing, the specific categories of personal data to be processed, the data retention period and the identification of the roles and responsibilities of the national regulatory authorities and bodies within the meaning of data protection law.

text: 4. Conclusions

text: 46. In light of the above, the EDPS makes the following recommendations: (1) to add an explicit reference to ‘journalists’ to the relevant provisions of the future Regulation, so as to any journalist, including free-lance or self-employed, would fall within the scope of the future Regulation and thus could also be able to rely on a robust protection of journalistic sources and communication and to clarify the criteria for determining when a journalist falls within the jurisdiction of a Member State; (2) to horizontally clarify that the future Regulation is without prejudice to and does not affect the EU legislation on personal data protection and privacy, in particular the GDPR, the ePrivacy Directive and the LED; (3) to further define and restrict the possibility to waive the protection of journalistic sources and communications under

text: Article 4

text: (b) and(c) of the Proposal, in line with the principles of strict necessity and proportionality. In particular, the EDPS remains convinced that the only viable and effective option to protect the fundamental rights and freedoms in the Union, including media freedom, against highly advanced military-grade spyware is a general ban on its development and deployment with very limited and exhaustively defined exceptions, complemented by robust safeguards, such as those suggested in the EDPS Preliminary remarks on modern spyware ; (4) to ensure that future Regulation explicitly set out specific guarantees of independence for the authorities or bodies in charge of handling complaints in relation to breaches of

text: Article 4(2)

text: (b) and (c) of the Proposal; (5) to ensure that the future Regulation: (1) provide for an explicit legal basis for cooperation between the relevant supervisory authorities, each acting within their respective areas of competence; (2) require a structured cooperation between the competent supervisory authorities, including data protection authorities; (3) make explicit reference to the national competent supervisory authorities involved in the cooperation and identify the circumstances in which cooperation should take place. In particular, the EDPS recommends ensuring that the independent competent authorities designated under the future Regulation have the power and duty to consult with the relevant other national competent supervisory authorities, including data protection authorities, in the context of their investigations and compliance assessments. With regard to national data protection authorities, the EDPS also recommends clarifying that competent independent authorities under the future Regulation should be able to provide to the competent supervisory authorities under the GDPR and the LED, upon request or on their own initiative, any information obtained in the context of any audits and investigations that relate to the processing of personal data and to include an explicit legal basis to that effect; (6) to specify explicitly in the future Regulation the objective(s) of public interest pursued with

text: Article 6(1)

text: on the information that media service providers should make accessible concerning their owners and beneficial owners and to ensure that the list of categories of information to be made available under Article 6(1) of the Proposal be clearly defined and explicitly listed in the future Regulation; and (7) to explicitly clarify whether any personal data would be processed in the context of the cooperation between national regulatory bodies under Article 13 of the Proposal and, if so, to also specify the purpose for processing, the specific categories of personal data to be processed, the data retention period and the identification of the roles and responsibilities of the national regulatory authorities and bodies within the meaning of data protection law. Brussels, 11 November 2022 (e-signed) Wojciech Rafał WIEWIÓROWSKI 16

type: vagledning

utgivare: edps