text: COM(2023) 754 final 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 754 final. 4 See p. 3 of COM(2023) 754 final (Explanatory Memorandum of the Proposal). 5

text: Regulation (EU) 2016/794

text: of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ L 135 24.5.2016, p. 53. See p. 3-4 of COM(2023) 754 final. 5

text: Proposal for a Directive of the European Parliament and of the Council laying down minimum rules to prevent and counter the facilitation of unauthorised entry, transit and stay in the Union, and replacing

text: Council Directive 2002/90/EC

text: and Council Framework Decision 2002/946 JHA, COM(2023) 755 final. 8 See more at https://home-affairs.ec.europa.eu/policies/migration-and-asylum/irregular-migration-and-return/internationalconference-global-alliance-counter-migrant-smuggling_en#more-information 9 See p. 1 of COM(2023) 754 final. 10 See p. 8 of COM(2023) 754 final. 6

text: See COM(2023) 754 final, LEGISLATIVE FINANCIAL STATEMENT ‘AGENCIES’, p. 7. 16 See Judgment of 26/01/2023 - Ministerstvo na vatreshnite raboti (Biometric and genetic data registration by the police), C- 205/21, ECLI:EU:C:2023:49, p. 117, 118 and 125. 8

text: See for instance

text: Article 42(5) of Regulation (EU) 2018/1862

text: of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending and repealing Council Decision 2007/533/JHA, and repealing

text: Regulation (EC) No 1986/2006

text: of the European Parliament and of the Council and

text: Commission Decision 2010/261/EU

text: , or

text: Article 29

text: (2a) of

text: Regulation (EC) No 767/2008

text: of the European Parliament and of the Council of 9 July 2008 concerning the Visa Information System (VIS). 18

text: Regulation (EU) 2019/1896

text: of the European Parliament and of the Council of 13 November 2019 on the European Border and Coast Guard and repealing Regulations

text: (EU) No 1052/2013

text: and

text: (EU) 2016/1624

text: (OJ L 295, 14.11.2019, p. 1. 9

text: See the Executive Summary of the EDPS Audit Report on the European Border and Coast Guard Agency of 24.05.2023 20 https://edps.europa.eu/data-protection/our-work/publications/supervisory-opinions/international-data-transfers-frontex_en 10

text: This concept is also referred in Article 9 of the Proposal under new

text: Article 5

text: a(6) of Europol Regulation as well as in the LEGISLATIVE FINANCIAL STATEMENT ‘AGENCIES’, COM(2023) 754 final, p. 6. 22

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89). 11

identifier: EDPS yttrande 04/2024

title: EDPS Opinion 4/2024 on the Proposal for a Regulation on enhancing police cooperation in relation to the prevention, detection and investigation of migrant smuggling and trafficking in human beings

text: 23 January 2024

text: Opinion 4/2024

text: on the Proposal for a Regulation on enhancing police cooperation in relation to the prevention, detection and investigation of migrant smuggling and trafficking in human beings, and on enhancing Europol’s support to preventing and combating such crimes and amending

text: Regulation (EU) 2016/794

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on enhancing police cooperation in relation to the prevention, detection and investigation of migrant smuggling and trafficking in human beings, and on enhancing Europol’s support to preventing and combating such crimes and amending

text: Regulation (EU) 2016/794

text: . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 28 November 2023, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on enhancing police cooperation in relation to the prevention, detection and investigation of migrant smuggling and trafficking in human beings, and on enhancing Europol’s support to preventing and combating such crimes and amending

text: Regulation (EU) 2016/794

text: (‘the Proposal’). The main objective of the Proposal is to reinforce Europol’s role in the fight against migrant smuggling and trafficking in human beings, in particular through an enhanced role of the European Centre Against Migrant Smuggling at Europol. To this end, several amendments of

text: Regulation (EU) 2016/794

text: (‘Europol Regulation’) have been proposed, which would further extend the tasks and powers of the Agency.

text: While the EDPS recognises that effective fight against migrant smuggling and trafficking in human beings represents an important objective of general interest, and thus it may justify limitations on the exercise of the fundamental rights and freedoms of the individual, in accordance with Article 52(1) of the EU Charter of Fundamental Rights, he nevertheless considers that the necessity and proportionality of the proposed measures must be carefully assessed, also in view of the expected practical impact on the rights and freedoms of the affected data subjects. Moreover, the comments and recommendations in the Opinion are based not only on the legislative proposal and its accompanying documents, but also take into account the findings of the supervisory activities of the EDPS vis-a-vis Europol and Frontex.

text: The EDPS notes with regret that the Proposal is not accompanied and supported by an Impact Assessment, This is deeply worrying given the nature of the personal data at stake (sensitive biometric data) and that vulnerable people may be involved (migrants). The EDPS considers that this should not constitute a precedent for any future legislation having comparable impact on the fundamental rights to privacy and data protection.

text: Consequently, the EDPS makes several recommendations on the elements of the Proposal, which the EDPS considers of particular importance for the protection of the right to data protection, namely: (a) the increased processing of biometric data, including facial recognition; (b) the role of the European Border and Coast Guard Agency (‘Frontex’); (c) the transfers of data by Europol to third countries based on derogations; and (d) the execution of investigative non-coercive measures related to data processing by Europol.

text: In particular, the EDPS underlines the need to establish mechanisms for mitigation of data protection risks stemming from the increased processing of biometric data, including the adoption of clear binding rules providing for appropriate safeguards, especially with regard to the strict necessity and proportionality of the processing of biometric data by Europol and the quality of the

text: data. He also recommends further clarifying and circumscribing the role of Frontex in the fight against migrant smuggling and traffic in human being, in order to avoid Frontex being turned de facto into a law enforcement agency. The EDPS furthermore highlights the risk Recital 8 of the Proposal to be interpreted as promoting or recommending regular and systemic use of derogations for transfer of data to third countries. Finally, the EDPS recommends that Europol should define clearly, together with the concerned Member State(s), the allocation of responsibility as regards the processing of personal data, in accordance with the relevant provisions of Europol Regulation, the EUDPR and the Law Enforcement Directive, in cases when Europol provides operational support to Member States pursuant to the proposed new

text: Articles 5

text: a and 5b of Europol Regulation.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 28 November 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on enhancing police cooperation in relation to the prevention, detection and investigation of migrant smuggling and trafficking in human beings, and on enhancing Europol’s support to preventing and combating such crimes and amending

text: Regulation (EU) 2016/794

text: (‘the Proposal’).

text: 2. The main objective of the Proposal is to reinforce Europol’s role in the fight against migrant smuggling and trafficking in human beings, in particular through an enhanced role of the European Centre Against Migrant Smuggling at the Agency . To this end, several amendments of

text: Regulation (EU) 2016/794

text: (‘Europol Regulation’) have been proposed, which would further extend the tasks and powers of Europol.

text: 3. In addition, the Proposal pursues several specific objectives, namely: (1) Strengthening inter-agency cooperation on migrant smuggling and trafficking in human beings; (2) Strengthening steer and coordination on countering migrant smuggling and trafficking in human beings at EU level; (3) Improving information sharing on migrant smuggling and trafficking in human beings; (4) Reinforcing Member States’ resources to prevent and combat migrant smuggling and trafficking in human beings; and (5) Reinforcing Europol’s support to the prevention and combatting of migrant smuggling and trafficking in human beings through operational task forces and Europol deployments for operational support .

text: 4. The Proposal is part of a package of measures aiming to modernise and strengthen the existing legal framework with regards to countering migrant smuggling and trafficking in human beings. It is accompanied by a proposal for a Directive on preventing and countering the facilitation of unauthorised entry, transit and stay in the EU , and a Call to Action for a Global Alliance to Counter Migrant Smuggling .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 28 November 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 24 of the Proposal.

text: 2. General remarks

text: 6. Human trafficking and migrant smuggling are global and widespread crimes that abuse human beings for profit. In that regard, the EDPS fully recognizes that fighting and preventing these crimes are among the priorities of the European Union and are considered crucial to addressing irregular migration in a comprehensive way . The EDPS also understands that effective fight against such crimes represents an important objective of general interest, and thus it may justify limitations on the exercise of the fundamental rights and freedoms of the individual, in accordance with Article 52(1) of the EU Charter of Fundamental Rights.

text: 7. While it is without doubt that cooperation between relevant EU Agencies and the competent authorities of Member States and of third countries, including information sharing, is of crucial importance in the fight against such crimes, the necessity and proportionality of the proposed measures must be carefully assessed, also in view of the expected practical impact on the rights and freedoms of the affected data subjects, which is highly relevant for assessing their conformity with the EU legal framework, and in particular with the proportionality principle.

text: 8. The EDPS notes with regret that the Proposal is not accompanied and supported by an Impact Assessment, which is explained by the Commission with the fact that it “had little or no choice available, notably due to the urgent operational needs to improve Europol’s support to Member States on countering migrant smuggling” . This is deeply worrying given the nature of the personal data at stake (sensitive biometric data) and that vulnerable people may be involved (migrants). The EDPS considers that this should not constitute a precedent for any future legislation having comparable impact on the fundamental rights to privacy and data protection. The lack of Impact Assessment makes the assessment of necessity and proportionality more difficult. Moreover, some of the envisaged measures e.g. on biometric data, or operational support by Europol on the territory of Member States, do not seem to be directly and specifically linked to migrant smuggling but concern the activities of Europol more horizontally.

text: 9. In this context, the current Opinion focuses on the following aspects, which the EDPS considers of particular importance for the protection of the right to data protection: (a) the increased processing of biometric data, including facial recognition; (b) the role of the European Border and Coast Guard Agency (‘Frontex’); (c) the transfers of data by Europol to third countries based on derogations; and (d) the execution of investigative non-coercive measures related to data processing by Europol.

text: 10. It should be borne in mind that the comments and recommendations in this Opinion are based not only on the legislative proposal itself, but also having in mind its accompanying documents, such as the legislative financial statement, as well as the findings of the supervisory activities of the EDPS vis-a-vis Europol and Frontex. The EDPS regrets that the actual impact of the proposed provisions on fundamental rights cannot be fully foreseen from the enacting terms of the legislative text, which remain too vague in this regard and details about such impact are revealed by a document such as the financial statement, which will not form part of the legislative text. This is all the more concerning given the lack of an Impact Assessment before the issuance of the Proposal.

text: 11. Furthermore, the EDPS would like to draw the attention on the impact of the proposed measures on the budget and staff needs. In the explanatory memorandum the Commission estimates that for Europol an additional budget of around EUR 50 million and around 50 additional posts would be needed for the overall period of the current Multiannual Financial Framework 2021-2027 . Given the fact that most of the envisaged measures entail extensive processing of personal data, including sensitive data like biometrics, the EDPS would like to stress the corresponding need for additional supervisory resources.

text: 12. Finally, the EDPS notes that, unrelated to migrant smuggling and trafficking in human beings, the proposed Regulation extends the list of crimes which fall within Europol’s competence by including in Annex I to the Europol Regulation the “violation of Union restrictive measures” . In this regard, the EDPS fully agrees that Union restrictive measures are an essential tool for safeguarding the Union’s values, security, independence and integrity, consolidating and supporting democracy, the rule of law, human rights and the principles of international law and maintaining international peace, preventing conflicts and strengthening international security . For these reasons, the EDPS supports the view that the violations of Union restrictive measures constitute a form of crime which affects the common interests of the Union and, therefore, Europol should have competence to act in order to support and strengthen action by the Member States.

text: 3. Processing of biometric data, including facial recognition

text: 13. Article 9 of the Proposal envisages amendments to Article 4(1) of Europol Regulation on the tasks of Europol by adding new point (za) “support Member States with the effective and efficient processing of biometric data”. The explanatory memorandum to the Proposal clarifies that such processing would be carried out “in accordance with the existing safeguards on the processing of biometrics” .

text: 14. In that regard, the EDPS recalls that, in addition to

text: Article 76

text: EUDPR, specific conditions for processing biometric data by Europol are laid down in Article 30(2) of Europol Regulation, which is not affected by the amendment proposed by the Commission and therefore should be fully respected. In particular, according to this provision, processing of biometric data is allowed “only where strictly necessary and proportionate for the purposes of research and innovation projects [...] and for operational purposes, within Europol’s objectives, and only for preventing or combating crime that falls within Europol’s objectives. Such processing shall also be subject to appropriate safeguards laid down in [Europol] Regulation with regard to the rights and freedoms of the data subject”.

text: 15. The EDPS notes that more details about the future role of Europol for “the effective and efficient processing of biometric data” are provided in the legislative financial statement accompanying the Proposal . Some of the envisaged measures include significant upgrade/procurement of new Automated Fingerprint Identification System (AFIS); performance and functionality improvements in the new face recognition solution (FACE); full integration of AFIS and new FACE in Europol data management workflows; development of the functionalities to search biometric data in the Europol Information System (EIS) and via Querying Europol’s systems (QUEST); update of the Data Analysis Portal (DAP) for biometric data; and others.

text: 16. The EDPS considers that all these initiatives will inevitably result in substantial expanding of the processing of biometric data, including the use of facial recognition by Europol. Subsequently, the expected significant increase in the processing of biometric data raises a number of serious questions, first of all how the requirement of strict necessity and proportionality laid down in Article 30 of Europol Regulation will be ensured in practice. This applies not only to the collection and further internal processing by Europol but also to the dissemination of biometric data to Member States (e.g. via EIS/QUEST).

text: 17. It is important to underline also the horizontal nature of the issue of biometric data processing by Europol and the possible knock-on effects in other areas, where Europol has access to such data, e.g. the automated data exchange for police cooperation (Prüm II); the interoperability of EU Large-Scale Information Systems like the Schengen Information System (SIS) and the Visa Information System (VIS); the transfer of biometric personal data from third countries, including pursuant to

text: Article 18

text: a(6) Europol Regulation, etc.

text: 18. The EDPS recalls that in its recent case law on the processing for law enforcement purposes of special categories of personal data, including biometric and genetic data, the Court of Justice of the EU stressed that the requirement that such processing should be allowed ‘only where strictly necessary’ must be interpreted as establishing strengthened conditions for lawful processing of sensitive data. Moreover, the fact that the necessity for processing of such data is an ‘absolute’ one signifies that that necessity is to be assessed with particular rigour. Furthermore, according to the Court, the requirement that processing of sensitive data be ‘strictly necessary’ entails particularly strict checking, as to whether the principle of data minimisation is observed .

text: 19. Another important question, to which the Proposal does not provide an answer, is what controls would be applied as regards the quality of the biometric data processed by Europol. For instance, while the EDPS understands that the data from crime scenes or similar settings cannot always be of high quality, in any event there needs to be a standard of minimum quality, especially if the data will be processed with the help of matching algorithms (Artificial Intelligence (AI)-based or not).

text: 20. In this context, the EDPS notes that, unlike the legal framework on the EU large-scale information systems, where many of the basic acts explicitly require the adoption of implementing or delegated acts dealing specifically with data quality thresholds and controls, no such delegation exists in Europol Regulation . This affects the clarity and precision of the new provisions, which allow interferences of accrued seriousness with the fundamental rights of the persons concerned due to the anticipated increase in the scale of processing of special categories of data.

text: 21. The EDPS considers that the increased risks stemming from envisaged extensive processing of biometric data should be properly addressed. Therefore, he recommends the establishment of mitigation mechanisms for the data protection risks caused by biometric data processing. Such mitigation mechanisms should include the adoption of clear binding rules providing for appropriate safeguards, especially with regard to the strict necessity and proportionality of the processing of biometric data by Europol, and the quality of the data.

text: 22. Moreover, given the essential role of such modalities and their potential impact on fundamental rights, the EDPS recommends that they are laid down either in the basic act, i.e. in Europol Regulation, or in implementing or delegated acts adopted pursuant to Articles

text: and

text: TFEU. The choice of legal instrument providing for additional safeguards for the processing of biometric data is not a mere formality but a means to ensure more democratic control with appropriate checks and balances. In this regard, the EDPS considers that only very technical (practical) details should be left to be decided under the administrative autonomy of the EU body involved in the processing of personal data (e.g. by the Management Board of a decentralised Agency).

text: 4. Role of Frontex

text: 23. One of the objectives of the Proposal is to strengthen cooperation between Europol and Frontex, more specifically as a result of the creation of the European Centre Against Migrant Smuggling. However, the role, limits and procedures to be followed by Frontex when performing its tasks to support Europol, Eurojust and Member States law enforcement authorities, are not sufficiently specified in the Proposal, nor in the European Borders and Coast Guard (EBCG) Regulation . In particular, there is not enough clarity how this task would interact with Frontex' core tasks in border and migration management.

text: 24. The EDPS recalls his findings during his recent audit of Frontex, which led to issuing of a number of recommendations and opening an investigation . In particular, the EDPS considers that Article 90 of the EBCG Regulation, read in the light of the provisions defining the Frontex’s role and tasks, allows Frontex to process operational personal data collected only in the context of a specific and lawful purpose, within its mandate, namely - in respect of debriefing interviews - for migration management purposes. In addition, the EDPS considers that Frontex may not systematically, proactively and on its own collect any kind of information about suspects of any cross-border crimes. This collection must be strictly limited to identified needs of Europol, Eurojust and Member States competent authorities and concern only suspects of cross-border crimes about whom Europol, Eurojust and Member State competent authorities are allowed to process personal data to perform their tasks.

text: 25. The EDPS therefore recommends further clarifying and circumscribing the role of Frontex in the fight against migrant smuggling and traffic in human being, in order to avoid Frontex being turned de facto into a law enforcement agency.

text: 5. Transfers of data by Europol to third countries based on derogations

text: 26. The EDPS notes that according to Recital 8 of the Proposal "[t]he transfer of personal data by Europol to third countries may, in the absence of an adequacy decision or of adequate or appropriate data protection safeguards, be carried out in accordance with Article 25(5) of [Europol] Regulation”. The EDPS recalls that the latter provision lays down the possibility for derogation from the general legal rules for transfer of personal data to third countries and international organisations in specific cases, e.g. when necessary in order to protect the vital interests of the data subject or of another person; or it is essential for the prevention of an immediate and serious threat to the public security; or is necessary in individual cases for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal sanctions; and others.

text: 27. The EDPS furthermore reminds that according to

text: Article 25(5)

text: , last subparagraph of Europol Regulation, "derogations may not be applicable to systematic, massive or structural transfers." In this regard, the EDPS also recalls his Supervisory Opinion on International Data Transfers by Frontex in the Context of Return Operations of 20.12.2021, where he strongly advocated for the use of structural tools for transfers instead of derogations .

text: 28. The EDPS stresses that Recital 8 of the Proposal could not and should not be interpreted as promoting or recommending regular and systemic use of derogations for transfer of data to third countries and therefore he recommends the recital to be modified accordingly.

text: 6. Execution of investigative non-coercive measures related to data processing by Europol

text: 29. The EDPS notes that Article 9 of the Proposal proposes amendments to Article 4(5) of Europol Regulation and the creation of new

text: Article 5

text: a and 5b therein, related to operational support by Europol to Member States, in particular setting up of operational task forces and Europol deployment for operational support. Recital 18 of the Proposal clarifies that the deployed Europol staff and seconded national experts should be able to carry out investigative non-coercive measures that relate to data processing in liaison and in agreement with the competent authorities of the Member State concerned, and in accordance with Europol Regulation and Member State’s national law.

text: 30. The EDPS considers this element as part of a more general trend identified in the recent years where more actors participate in a specific processing operation. Examples of this approach are the Europol’s access to national IT environments in the context of a specific investigation or the Joint Operational Analysis Concept provided for in

text: Article 20

text: (2a) of Europol Regulation . The EDPS recalls that the Joint Operational Analysis is a new working method of Europol which enables Member States to allow other Member States to directly access the information they provide to Europol for the purpose of conducting joint operational analysis in specific criminal investigations. The EDPS has already analysed this element as part of his supervisory activities and has warned Europol about the possible implications in terms of joint controllership, pursuant to

text: Article 86

text: EUDPR.

text: 31. The EDPS therefore recommends that Europol defines clearly, together with the concerned Member State(s), the allocation of responsibility as regards the processing of personal data, in accordance with the relevant provisions of Europol Regulation, the EUDPR and the Law Enforcement Directive , in cases when Europol provides operational support to Member States pursuant to the new

text: Article 5

text: a and 5b of Europol Regulation. This allocation should also be clarified in the implementing rules for the setting up and implementation of operational task forces and for the preparation and implementation of Europol deployments for operational support, which the Management Board of Europol would have to adopt pursuant to the proposed new

text: Article 5

text: a(8) and

text: Article 5

text: b(9), respectively.

text: 7. Conclusions

text: 32. In light of the above, the EDPS makes the following recommendations: (1) to establish mechanisms for mitigation of data protection risks stemming from the increased processing of biometric data, including the adoption of clear binding rules providing for appropriate safeguards, especially with regard to the strict necessity and proportionality of the processing of biometric data by Europol and the quality of the data; (2) to further clarify and circumscribe the role of Frontex in the fight against migrant smuggling and traffic in human being; (3) to modify Recital 8 of the Proposal in order to avoid interpreting it as promoting or recommending regular and systemic use of derogations for transfer of data to third countries; (4) Europol to define clearly, together with the concerned Member State(s), the allocation of responsibility as regards the processing of personal data, in accordance with the relevant provisions of Europol Regulation, the EUDPR and the Law Enforcement Directive, in cases when Europol provides operational support to Member States pursuant to the proposed new

text: Articles 5

text: a and 5b of Europol Regulation. Brussels, 23 January 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 12


text: OJ L 295, 21.11.2018, p. 39. 2 COM(2025) 22 final. 3 COM(2025) 23 final. 4 Article 1 of the Signing Proposal. Article 1 of the Conclusion Proposal. 4

text: COM(2023) 230 final. 7 EDPS Opinion 18/2023 on the Recommendation for a Council Decision authorising the opening of negotiations for digital trade disciplines with the Republic of Korea and with Singapore, 15 May 2023. 8 Council Decision 8886/23. 9 COM(2025) 23 final, p. 1. 10 OJ L 294, 14.11.2019. 11 OJ L 189, 26.7.2018. 12

text: Article 2(2)

text: (c) of the Digital Trade Agreement. 13

text: Article 16(3)

text: (e) of the Digital Trade Agreement. 14 https://ec.europa.eu/newsroom/just/items/627665/en 15

text: Article 41(2)

text: (a) and (c) of the Digital Trade Agreement. 16 EDPS Opinion 03/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, issued on 22 February 2021, paragraph 14. 5

text: EDPS Opinion 03/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, issued on 22 February 2021, paragraph 15. 18 EDPS Opinion 18/2023 on the Recommendation for a Council Decision authorising the opening of negotiations for digital trade disciplines with the Republic of Korea and with Singapore, 15 May 2023, paragraph 11. 19 EDPS Opinion 03/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, issued on 22 February 2021, paragraphs 16- 22 and 38. 20 https://ec.europa.eu/commission/presscorner/detail/en/MEX_18_546. 6

text: As an example, the EDPS and the European Data Protection Board (EDPB) have recommended the co-legislators to require that controllers and processors, established in the EU/EEA and processing personal electronic health data within the scope of the Commission’s Proposal for a Regulation on the European Health Data Space, should be required to store this data in the EU/EEA, without prejudice to the possibility to transfer personal electronic health data in compliance with Chapter V GDPR. See EDPB- EDPS Joint Opinion 03/2022 on the Recommendation for a Regulation on the European Health Data Space, issued on 12 July 2022, paragraph 111. The EDPS and EDPB recommendation was taken up by the EU co-legislators in Article 86 of the final version of the text, which allows EU Member States to require that the storage of personal electronic health data for the purpose of primary use be located within the Union, subject to specific conditions. 22 Article B(2) of the Horizontal Provisions. 23 This is particularly concerning given the wording of Article 41(3) of the Digital Trade Agreement, which provides that “the Parties agree that nothing in this Agreement requires them to act in a manner inconsistent with their obligations under the WTO Agreement”. 7

text: For example, by relying on the mechanisms provided under

text: Article 46(2)

text: (d) GDPR and

text: Article 48(2)

text: (c) EUDPR. 25 Judgment of the Court of Justice (Grand Chamber) of 16 July 2020, Data Protection Commissioner v Facebook Ireland Ltd, Maximillian Schrems,

text: , ECLI:EU:C:2020:559, paragraph 96. 8

text: Article 11(1) of the Digital Trade Agreement. 27 Article 11(3) of the Digital Trade Agreement. 28 For example, entities in Singapore may be covered by the GDPR by virtue of its

text: Article 3(2)

text: . 9

identifier: EDPS yttrande 04/2025

amnesord:
Finance
International Agreements
Transfers of data

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 4/2025 on the Proposals for Council Decisions on the signing and conclusion, on behalf of the Union, of the Digital Trade Agreement between the European Union and the Republic of Singapore.

serie: yttranden

text: Opinion 4/2025

type: rubrik

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the (i) Proposal for a Council Decision on the signing, on behalf of the European Union, of the Digital Trade Agreement between the European Union and the Republic of Singapore, and (ii) the Proposal for a Council Decision on the conclusion, on behalf of the European Union, of the Digital Trade Agreement between the European Union and the Republic of Singapore. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 14 April 2023, the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for digital trade disciplines with the Republic of Korea and with Singapore (the ‘Recommendation’), on which the EDPS issued his Opinion 18/2023 of 15 May 2023. On 27 June 2023, the Council authorised the Commission to negotiate digital trade disciplines with the Republic of Singapore (‘Singapore’). The Commission, on behalf of the Union, and Singapore launched the negotiations on 20 July 2023. The negotiations were concluded in principle on 25 July 2024. The draft Digital Trade Agreement will complement the existing EU-Singapore Free Trade Agreement (‘FTA’) and give effect to the EU-Singapore Partnership and Cooperation Agreement (‘PCA’).

text: On 31 January 2025, the European Commission issued two proposals for Council Decisions on the signing and conclusion, on behalf of the European Union, of the Digital Trade Agreement between the European Union and the Republic of Singapore.

text: The Digital Trade Agreement concerns, among other matters, cross-border data flows with trust, data localisation requirements and personal data protection. Like in his Opinion 18/2023 on the Recommendation, the EDPS recalls that the protection of personal data is a fundamental right in the Union and cannot be subject to negotiations in the context of EU trade agreements. Dialogues on data protection and trade negotiations with third countries can complement each other but must follow separate tracks. Personal data flows between the EU and third countries should be enabled by using the mechanisms provided under the EU data protection legislation.

text: The EDPS welcomes the fact that the Digital Trade Agreement makes a reference to the horizontal provisions for cross-border data flows and personal data protection in trade negotiations, and recommends making such reference in a recital of the Digital Trade Agreement. At the same time, the EDPS considers that certain amendments to the wording of the horizontal provisions might create legal uncertainty as to the Union’s position on the protection of personal data in connection with EU trade agreements.

text: To better reflect the EU commitment to the protection of personal data, the EDPS recommends amending the Digital Trade Agreement in order to clarify that each party may adopt and maintain the safeguards it deems appropriate to ensure the protection of personal data and privacy, including through rules for the cross-border transfer of personal data. The EDPS also recommends clarifying that nothing in the Digital Trade Agreement shall affect the protection of personal data and privacy afforded by the parties’ respective safeguards. To give effect to this, the EDPS further recommends specifying that the "legitimate public policy objectives" allowing regulatory authorities to require access to source code include not only the ones currently listed in the Digital Trade Agreement, but also the protection of natural persons with regard to the processing of personal data.

text: Lastly, the EDPS invites the European Commission to consider ways in which it could complement the Digital Trade Agreement by increasing convergence between the EU and Singapore a data protection regimes.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 31 January 2025, the European Commission issued:  a Proposal for a Council Decision on the signing, on behalf of the European Union, of the Digital Trade Agreement between the European Union and the Republic of Singapore (‘the Signing Proposal’);  a Proposal for a Council Decision on the conclusion, on behalf of the European Union, of the Digital Trade Agreement between the European Union and the Republic of Singapore (‘the Conclusion Proposal’).

text: 2. The objective of the Signing Proposal is to authorise the signing, on behalf of the Union, of the Digital Trade Agreement . The objective of the Conclusion Proposal is to approve the Digital Trade Agreement, which is attached to the Conclusion Proposal as an Annex .

text: 3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 31 January 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in the third citation of both the Signing Proposal and Conclusion Proposal.

text: 2. General remarks

text: 4. On 14 April 2023, the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for digital trade disciplines with the Republic of Korea and with Singapore (the ‘Recommendation’). The EDPS was consulted on this matter and issued on 15 May 2023 his Opinion 18/2023 on the Recommendation .

text: 5. On 27 June 2023, the Council authorised the Commission to negotiate digital trade disciplines with the Republic of Singapore (‘Singapore’). The Commission, on behalf of the Union, and Singapore launched the negotiations on 20 July 2023. The negotiations were concluded in principle on 25 July 2024. The Digital Trade Agreement aims to enhance consumer protection online, provide legal certainty for businesses that want to engage in cross-border digital trade, and address unjustified barriers to digital trade . It will complement the existing EU-Singapore Free Trade Agreement (‘FTA’) and give effect to the EU-Singapore Partnership and Cooperation Agreement (‘PCA’).

text: 6. The commitments in the Digital Trade Agreement are of a binding nature and range from commitments on cross-border data flows and online consumer protection, to commitments on the protection of source code of software. The EDPS notes that the Digital Trade Agreement would also apply to open government data , as long as (among other conditions) each Party ensures such data is made available for reuse in full compliance with its personal data protection rules .

text: 7. According to the Explanatory Memorandum of the Conclusion Proposal, section A of chapter two of the Digital Trade Agreement, on data flows with trust, includes provisions that are in line with EU practice based on the 2018 horizontal provisions on cross-border data flows and the protection of personal data and privacy in trade agreements (‘the Horizontal Provisions’), which recognise each Party's right to determine the appropriate level of privacy and personal data protection in their jurisdictions. The EDPS takes note that Articles 5 and 6 of the Digital Trade Agreement on cross-border data flows and personal data protection would supersede Articles

text: and

text: (4) of the FTA .

text: 8. The EDPS has long taken the view that, as the protection of personal data is a fundamental right in the Union, it cannot be subject to negotiations in the context of EU trade agreements. It is for the EU alone to decide how to implement fundamental rights protections in Union law. The Union cannot and should not embark on any international trade commitments that are incompatible with its domestic data protection legislation. Dialogues on data protection and trade negotiations with third countries can complement each other but must follow separate tracks. Personal data flows between the EU and third countries should be enabled by using the mechanisms provided under the EU data protection legislation .

text: 3. Horizontal provisions on cross-border data flows

text: 9. The EDPS recalls that he supports the legal wording of the Horizontal Provisions as the best outcome achievable to preserve individual’s fundamental rights to data protection and privacy. The Horizontal Provisions reach a balanced compromise between public and private interests as they allow the EU to tackle protectionist practices in third countries in relation to digital trade, while ensuring that trade agreements cannot be used to challenge the high level of protection guaranteed by the Charter of fundamental rights of the EU and the EU legislation on the protection of personal data .

text: 10. In his Opinion 18/2023, the EDPS welcomed that Section (2)(6) of the Annex to the Recommendation established that negotiations on data flows and data protection ‘should result in rules covering cross-border data flows addressing unjustified data localisation requirements, while neither negotiating nor affecting the EU’s personal data protection rules and should, notably be in line with the EU legal framework on the protection of personal and non-personal data’ . He also recommended to ensure consistency with and make an express reference to the Horizontal Provisions, which the Conclusion Proposal only does in its Explanatory Memorandum. Therefore, the EDPS recommends including this reference in a recital of the Conclusion Proposal.

text: 11. In his Opinion 3/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, the EDPS recommended that the wording agreed with the UK on data protection and privacy (which modified the Horizontal Provisions) remained an exception and would not be the basis for future trade agreements with other third countries . On this note, the EDPS recalls that the Commission has repeatedly stated that as ‘the protection of personal data is a fundamental right in the EU, it cannot be subject to negotiations in the context of EU trade agreements’. Consequently, the Horizontal Provisions should not be up for negotiation .

text: 12. Nonetheless, the EDPS notes that the Digital Trade Agreement does not integrally take over the Horizontal Provisions. In amending the legal wording of the Horizontal Provisions, the EDPS considers that the Digital Trade Agreement creates legal uncertainty as to the Union’s position on the protection of personal data in connection with EU trade agreements and risks creating friction with the EU data protection legal framework. The EDPS reinstates that, as a matter of principle, the wording of the Horizontal Provisions should be kept in EU trade agreements containing provisions for cross-border data flows and personal data protection. He also stresses that any different wording resulting from negotiations in a specific case should not serve as a precedent for negotiations of EU trade agreements with other third countries on matters of cross-border data flows and personal data protection.

text: 4. Differences between the Horizontal Provisions and the Digital Trade Agreement

text: 13. The EDPS notes that the legal wording of the Horizontal Provisions was modified in the Digital Trade Agreement. As a result, the EDPS is concerned that the Digital Trade Agreement, in its current wording, could - contrary to the negotiating directives contained in the Recommendation - affect the EU’s personal data protection rules and the possibility for the EU to, in duly justified cases, enact measures that would require controllers or processors to store personal data in the EU/EEA .

text: 14. In this regard, the EDPS welcomes that Article 3 of the Digital Trade Agreement recognises the Parties’ right to regulate within their territories to achieve legitimate policy objectives, such as the protection of public health, social services, public education, safety, environment or public morals, social or consumer protection, privacy and data protection, and the promotion and protection of cultural diversity. However, he understands that the right of the EU to regulate to protect privacy and data protection as fundamental rights might be constrained by Article 6(11) of the Digital Trade Agreement, since the provision would only allow the Parties to adopt and apply rules for the cross-border transfer of personal data if they also provide for instruments enabling transfers under conditions of general application for the protection of the data transferred. It is not clear whether all duly justified cases in which the EU would decide to require specific controllers or processors to store specific personal data in the EU/EEA based on grounds related to the fundamental rights to data protection and privacy would qualify as conditions of general application under Article 6(11) of the Digital Trade Agreement.

text: 15. Furthermore, the EDPS notes that Article 6 of the Digital Trade Agreement does not state that ‘[n]othing in this agreement shall affect the protection of personal data and privacy afforded by the Parties’ respective safeguards’. This wording is meant to ensure that if EU laws protecting privacy and related to data protection were challenged in a trade dispute, the EU would not need to justify its data protection and privacy laws under strict tests based on Article XIV of the World Trade Organization’s (WTO) General Agreement on Trade in Services. Its absence in the Digital Trade Agreement might not prevent the EU from having to pass strict trade tests to justify its measures safeguarding the fundamental rights to privacy and personal data protection .

text: 16. In any event, the EDPS considers that it is possible to interpret Article 6(11) of the Digital Trade Agreement as allowing the EU to require, in duly justified cases, specific controllers or processors to store specific personal data in the EU/EEA based on grounds related to the fundamental rights to data protection and privacy, as long as there is a general framework (such as Chapter V of the GDPR) enabling transfers under conditions of general application.

text: 17. The EDPS welcomes that Article 5(4) of the Digital Trade Agreement would allow the EU to adopt or maintain measures that would require (inter alia) the localisation of data (including personal data) in the territory of the EU for storage or processing or require the use of computing facilities or network elements in the territory of the EU for processing of data to achieve a “legitimate public policy objective ” (other than the protection of personal data and privacy), under certain conditions.

text: 18. The EDPS welcomes that

text: Articles 6(2)

text: and (4) of the Digital Trade Agreement establish that “Each Party Party shall adopt or maintain a legal framework that provides for the protection of the personal data of individuals” and that “provides non-discriminatory protection of personal data for natural persons”.

text: 19. The EDPS welcomes that Article 14 of the Digital Trade Agreement contains provisions on regulatory dialogue and cooperation on regulatory issues with regard to digital trade, akin to Article X of the Horizontal Provisions, without prejudice to the application of Article 6 of the Digital Trade Agreement on data protection.

text: 5. Increasing convergence between EU and Singaporean data protection regimes

text: 20. The EDPS also welcomes that Article 6(7) of the Digital Trade Agreement provides that the Parties should explore ways to increase convergence between their data protection regimes, including to facilitate cross-border data flows. In this respect, the EDPS recalls that there are mechanisms under EU data protection law to enable the EU to recognise Singaporean regulatory outcomes in relation to personal data protection in a way that would facilitate personal data transfers from the EU to Singapore.

text: 21. A possible avenue that the European Commission could consider in order to enhance convergence in relation to personal data protection would be to intensify cooperation and dialogue on existing transfer mechanisms, by also involving the relevant data protection authorities. If necessary, efforts could be made to develop the convergence of these tools to ensure that appropriate safeguards are in place in the meaning of

text: Article 46

text: GDPR and

text: Article 48

text: EUDPR . This would help ensure that the level of protection of personal data is not undermined when personal data is transferred outside of the European Economic Area .

text: 6. Access to source code

text: 22. The EDPS also notes that the Digital Trade Agreement would prohibit the Parties from requiring the transfer of, or access to, the source code of software owned by a natural or legal person of the other Party as a condition for the import, export, distribution, sale or use of such software, or of products containing such software, in or from its territory . The provision contains a number of exceptions, including where regulatory authorities require the transfer of, or access to, source code of software for investigation, inspection or examination, enforcement action or judicial proceeding purposes, to secure compliance with its laws or regulations pursuing legitimate public policy objectives .

text: 23. The EDPS notes that personal data protection is not listed among the “legitimate public policy objectives” in footnote 12, which accompanies Article 11(3) of the Digital Trade Agreement. Data protection supervisory authorities under the GDPR or the EUDPR should not be prevented from requiring access to source code from entities in third countries (such as Singapore), notably when access to such source code is necessary to monitor compliance with such Regulations by such entities . Therefore, the EDPS considers it necessary to specify in footnote 12 that "legitimate public policy objectives" allowing authorities to require access to source code include not only the ones listed in footnote 6 to

text: Article 5(4)

text: 7. Conclusions

text: 24. In light of the above, the EDPS makes the following recommendations: (1) to supplement Article 6(11) of the Digital Trade Agreement with the text “Nothing in this agreement shall affect the protection of personal data and privacy afforded by the Parties’ respective safeguards”, to ensure that if EU laws protecting privacy and related to data protection were challenged in a trade dispute, the EU would not need to justify its data protection and privacy laws under strict tests based on Article XIV of the WTO’s General Agreement on Trade in Services; (2) for the European Commission to consider ways in which it could complement the Digital Trade Agreement by increasing convergence between the EU and Singaporean data protection regimes; (3) to specify in footnote 12 of the Digital Trade Agreement that "legitimate public policy objectives" allowing authorities to require access to source code include not only the ones listed in footnote 6 to Article 5(4) of the Digital Trade Agreement, but also the protection of natural persons with regard to the processing of personal data. Brussels, 21 March 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 10

type: vagledning

utgivare: edps


text: COM(2025) 847 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2025) 847 final. 4 COM(2025) 847 final, p. 1. See also Article 1 of the Proposal. Chapter II of the Proposal. 6 Section 1 of Chapter II of the Proposal. 7 Section 2 of Chapter II of the Proposal. As specified in Article 19(2) of the Proposal, EMERS would be activated following a proposal by the Commission to the Council for an implementing act. 8 Chapter III of the Proposal. 9 Chapter IV of the Proposal. 10 Annex I to the Proposal. 11 Form A, Annex II to the Proposal. 12 Form B, Annex II to the Proposal. 4

text: JOINT (2025) 120 final - White Paper for European Defence – Readiness 2030. 14 JOINT (2025) 27 final - Joint Communication to the European Parliament, the European Council and the Council - Preserving Peace - Defence Readiness Roadmap 2030. 15 Explanatory memorandum to the Proposal, page 1. 16 Explanatory memorandum to the Proposal, page 8. See also for instance reference to Commanding Officer (rank, name, seniority), and to Senior Officer embarked (rank, name) in Form B, Annex II to the Proposal. 17 Directive

text: of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), OJ L 201, 31.7.2002, pp. 37–47. 5

text: Article 50(1) of the Proposal. 19 In accordance with

text: Article 5(1)

text: (b) of the GDPR and

text: Article 4(1)

text: (b) EUDPR. 20 See Article 14 of the Proposal. 21 See Article 19(2) of the Proposal. 22 See EDPS Guidance for co-legislators on key elements of legislative proposals, issued on 7 May 2025. 6

identifier: EDPS yttrande 04/2026

amnesord:
Transfers of data
Transport

title: Opinion 4/2026 on the Proposal for a Regulation establishing a framework of measures to facilitate the transport of military equipment, goods and personnel across the Union

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council establishing a framework of measures to facilitate the transport of military equipment, goods and personnel across the Union. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 19 November 2025, the European Commission adopted the Proposal for a Regulation of the European Parliament and of the Council establishing a framework of measures to facilitate the transport of military equipment, goods and personnel across the Union.

text: The Proposal aims to facilitate military transport across Member States to support European security and defence, as well as to improve the capacity to respond to natural and man-made disasters while minimising and mitigating the impact of such transport on civilian transport.

text: The Proposal would establish a uniform framework for military mobility, consisting among others in uniform procedures for permissions of military transport, on resilience of transport infrastructures, on availability of transport and logistic capabilities for military transport operations. As the information exchanges foreseen by the Proposal would entail the processing of personal data, the EDPS welcomes the references to the applicable data protection legislation, as well as the rules concerning the confidentiality and security of information received.

text: The Proposal would also empower the Commission to adopt implementing acts establishing the following information exchange systems: i) European Military Mobility Enhanced Response System; (ii) Military Mobility Digital Information System. The EDPS recommends empowering the Commission to further specify the categories of personal data to be processed and their storage period, as well as the roles and responsibilities of the controller(s).

text: Contents

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 19 November 2025, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council establishing a framework of measures to facilitate the transport of military equipment, goods and personnel across the Union (‘the Proposal’).

text: 2. The Proposal aims to facilitate military transport across Member States to support European security and defence, as well as the capacity to respond to natural and man-made disasters while minimizing and mitigating the impact of such transport on civilian transport . To fulfil this aim, the Proposal lays down a uniform framework for military mobility . The framework consists, among others, of: (1) uniform military transport permission procedures and rules ; (2) the establishment of a European Military Mobility 7 8 Enhanced Response System (EMERS) ; (3) rules on resilience of transport infrastructure ; and (4) rules on availability of transport and logistic capabilities for military transport operations .

text: 3. The Proposal is accompanied by two annexes, specifying the list of types of military transport operations covered by standing military transport permissions ; the form to request/grant a standing military transport permission ; the form to notify a military transport permission under a standing military transport permission or to request/grant/modify an ad hoc military transport permission .

text: 4. The objective of the Proposal is to establish an EU framework that enables, facilitates and accelerates the transport of military personnel, material and equipment across the territory of the European Union. The Proposal has been issued in the light of the Joint White Paper for European Defence - Readiness 2030 of March 2025 and the Defence Readiness Roadmap 2020 of 16 October 2025 .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 19 November 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to the present consultation in recital 67 of the Proposal.

text: 2. General remarks

text: 6. The EDPS welcomes the objectives of the Proposal, particularly the objective of fostering military mobility in the Union and across member States as enabler for European security and deterrence, also increasing the capacity to react to natural and man-made disorders, while minimising and mitigating the impact of such transport on civilian transport .

text: 7. The information exchanges foreseen by the Proposal would entail the processing of personal data (for instance, relating to the names of owners or operators of military transport services as natural persons) . The EDPS therefore welcomes the reference to the applicability of the GDPR and of the EUDPR, as well as to Directive 2002/58/CE (‘ePrivacy Directive’) in the Proposal.

text: 3. Specific remarks

text: 8. Article 51 of the Proposal contains provisions on personal data protection. The first paragraph of this article reiterates that the Proposal shall be without prejudice to the obligations of Member States relating to their processing of personal data under the GDPR, as well as the ePrivacy Directive, and to the obligations of the Commission and, where appropriate other Union institutions, bodies, offices and agencies under the EUDPR.

text: 9. The second paragraph confirms that the Member States, the Commission and, where appropriate, other Union institutions, bodies, offices and agencies may process personal data where necessary to comply with obligations in this Regulation or where necessary for the exercise of official authority or for tasks in the public interest entrusted to them in this Regulation. In this regard, the EDPS observes that once the obligations and tasks in the public interest are specified in the Proposal,

text: Article 6(1)

text: (c) or

text: Article 6(1)

text: (e) GDPR (or Article

text: 10. The EDPS welcomes the provision according to which information received as a result of the application of the Proposal must be used only for the purpose for which it was requested . This specification is line with the principle of purpose limitation insofar as the processing of personal data is concerned .

text: 11. Finally, the EDPS recalls that it expects to be consulted under

text: Article 42(1)

text: EUDPR on the implementing acts that may be adopted by the Commission to establish the Military Mobility Digital Information System, to be operated and maintained by the Commission , as well as on the implementing act establishing EMERS . The EDPS recommends to clearly define in those acts in particular the categories of personal data to be processed via these systems and their storage period, as well as the roles and responsibilities of the controller(s) .

text: 4. Conclusions

text: 12. In light of the above, the EDPS recommends empowering the Commission to further specify the categories of personal data to be processed and their storage period, as well as the roles and responsibilities of the controller(s) in the context of Military Mobility Digital Information System and EMERS. Brussels, 12 January 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI