text: COM (2023) 193 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM (2023) 193 final. 4 COM (2023) 193 final, p. 2. COM (2023) 193 final, p. 2. 4

text: 10 7. The EDPS considers that both the Explanatory Memorandum and the Preamble to the Proposal clearly set out its objectives, in support of the necessity of the foreseen processing of personal data, including special categories of personal data (in particular health data).

text: COM (2023) 193 final, p. 1. 7 Communication from the Commission, Pharmaceutical Strategy for Europe (COM/2020/761 final), https://health.ec.europa.eu/medicinal-products/pharmaceutical-strategy-europe_en. 8 Mission letter of the President of the European Commission to Stella Kyriakides, Commissioner for Health and Food Safety, https://commissioners.ec.europa.eu/system/files/2022-11/mission-letter-stella-kyriakides_en.pdf. 9 COM (2023) 193 final, p. 2. 10 See in particular recital 154 of the Proposal. 11

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: , OJ L 119, 4.5.2016, p. 1–88. 12 See recitals 62, 140 and 155, together with

text: Articles 166

text: to 169 of the Proposal. 5

text: Section 1 of Chapter XI of the Proposal. 14 Section 2 of Chapter XI of the Proposal. 15 Section 3 of Chapter XI of the Proposal. 16 Section 4 of Chapter XI of the Proposal. 17 See

text: Articles 9(2)

text: (i) and 9(2)(j) of

text: Regulation (EU) 2016/679

text: (GDPR), as well as 10(2)(i) and 10(2)(g) of

text: Regulation (EU) 2018/1725

text: (EUDPR). 6

text: While the Proposal should specify the categories of personal data at least in general terms, further details could also be provided by way of an Implementing Regulation, such as it was done in the Commission Implementing

text: Regulation (EU) No 520/2012 of 19 June 2019

text: on the performance of pharmacovigilance activities regarding

text: Regulation (EC) No 726/2004

text: . 19 See further EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: , 7 November 2019, p.8. 8

text: See Judgment of the European Court of Justice of 9 November 2010 in Joint Cases

text: and

text: Volker und Markus Schecke GbR (

text: ) and Hartmut Eifert (

text: ) v Land Hessen, ECLI:EU:C:2010:662, par. 53. 9

text: p.o. Leonardo CRVERA NAVAS Acting Head of EDPS Secretariat

identifier: EDPS yttrande 24/2023

title: EDPS Opinion 24/2023 on the Proposal for a Regulation laying down Union procedures for the authorisation and supervision of medicinal products for human use and establishing rules governing the EMA

text: 19 June 2023

text: Opinion 24/2023

text: on the Proposal for a Regulation laying down Union procedures for the authorisation and supervision of medicinal products for human use and establishing rules governing the European Medicines Agency

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council laying down Union procedures for the authorisation and supervision of medicinal products for human use and establishing rules governing the European Medicines Agency, amending

text: Regulation (EC) No 1394/2007

text: and

text: Regulation (EU) No 536/2014

text: and repealing

text: Regulation (EC) No 726/2004

text: Regulation (EC) No 141/2000

text: and

text: Regulation (EC) No 1901/2006

text: .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: Regulation (EC) No 1394/2007

text: and

text: Regulation (EU) No 536/2014

text: and repealing

text: Regulation (EC) No 726/2004

text: Regulation (EC) No 141/2000

text: and

text: Regulation (EC) No 1901/2006

text: The Proposal aims at achieving an internal market as regards medicinal products for human use and, at the same time, setting high standards of quality and safety for medicinal products in order to meet common safety concerns with regard to such products. In this regard, the EDPS welcomes that the Proposal aims to provide a clear legal basis for the processing of personal data, including health data, by the European Medicines Agency (EMA).

text: Exceptions to the prohibition on processing of personal data concerning health may be provided for by Union law where it is necessary for reasons of public interest in the area of public health and/or for scientific research purposes. When doing so, however, the legal basis provided by Union law must provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. The EDPS therefore considers that the Proposal should at least specify all relevant sources of personal health data, together with other relevant safeguards, such as pseudonymisation.

text: On the processing of personal data within the Eudravigilance database, the EDPS considers that the Proposal should define what categories of personal data would be processed when sharing information on suspected adverse reactions in human beings arising from use of the medicinal products. In addition, the EDPS also recommends to specify EMA’s role and responsibilities (and of Member States where applicable) within the meaning of data protection law.

text: The EDPS also understands that personal data would be processed in the context of the register of orphan medicinal products. Since the register will be set up and managed by EMA, the EDPS recommends explicitly designating EMA as the controller of the processing.

text: Lastly, the EDPS understands that personal data would be processed in the context of the webportal created for the purpose of disseminating information on authorised or to be authorised medicinal products. Again, the EDPS considers it necessary to clarify the EMA’s role and responsibilities within the meaning of data protection law, as also the role of Member States and the Commission.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 26 April 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council laying down Union procedures for the authorisation and supervision of medicinal products for human use and establishing rules governing the European Medicines Agency, amending

text: Regulation (EC) No 1394/2007

text: and

text: Regulation (EU) No 536/2014

text: and repealing

text: Regulation (EC) No 726/2004

text: Regulation (EC) No 141/2000

text: and

text: Regulation (EC) No 1901/2006

text: (‘the Proposal’).

text: 2. According to its Explanatory Memorandum , the main objectives of the Proposal are to: • guarantee a high level of public health by ensuring the quality, safety and efficacy of medicinal products for EU patients, including for paediatric patients and patients suffering from rare diseases throughout the Union and; • harmonise the internal market for the supervision and control of medicinal products and the rights and duties incumbent upon the competent authorities of the Member States.

text: 3. The specific objectives of the Proposal are to : • ensure that all patients across the EU have timely and equitable access to safe, effective, and affordable medicines; • enhance security of supply and ensure medicines are always available to patients, regardless of where they live in the EU; • offer an attractive innovation-and competitiveness friendly environment for research, development, and production of medicines in Europe; • make medicines more environmentally sustainable.

text: 4. As explained in the Explanatory Memorandum , the Proposal builds on the pharmaceutical strategy for Europe . This strategy aims to provide a holistic answer to the current challenges of the pharmaceutical policy to ensure EU’s supply of safe and affordable medicinal products and supporting the EU pharmaceutical industry’s innovation efforts through a combination of legislative and non-legislative measures .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 26 April 2023, pursuant to

text: Article 42(1)

text: EUDPR. The EDPS positively notes that he was already previously informally consulted pursuant to Recital 60 EUDPR.

text: 2. General remarks

text: 6. The EDPS welcomes the objectives of the Proposal, namely achieving an internal market as regards medicinal products for human use and, at the same time, setting high standards of quality and safety for medicinal products in order to meet common safety concerns with regard to such products.

text: 8. The EDPS welcomes the provisions of the Proposal, recalling that the EUDPR and the General Data Protection Regulation (‘GDPR’) will apply to the various processing of personal data taking place under the Proposal . In this regard, the EDPS highlights that the protection of the fundamental rights to the protection of personal data and privacy in the context of the Proposal are inextricably linked with the protection of human dignity and the integrity of the person, particularly where special categories of personal data within the meaning of

text: Article 9

text: GDPR and 10 EUDPR are involved.

text: 9. In the chapters below, the Opinion provides specific comments and recommendations on the processing of personal health data by the European Medicines Agency (‘EMA’) as set out in Articles 166 and 169 of the Proposal. It will also make specific recommendations on the processing of personal data and the roles and responsibilities within the meaning of data protection law in the context of the various databases and registers set out and provided for in the Proposal.

text: 10. Lastly, the EDPS notes that the Proposal does not contain any Recital referring to this consultation. Therefore, the EDPS calls for a Recital to be added to the Proposal containing specific reference to the consultation of the EDPS under

text: Article 42(1)

text: EUDPR.

text: 3. Processing of personal data by EMA

text: 11. Chapter XI of the Proposal lays down EMA’s tasks , structure and operations , financial 15 16 provisions and the general provisions applying to EMA . The EDPS welcomes that Articles 166 and 169 of the Proposal deal specifically with ‘Personal health data’ and ‘Processing of personal data’, respectively, and aim to provide a clear legal basis for the processing of such data.

text: 3.1. Personal health data

text: 12. Article 166(1) of the Proposal provides that EMA may process personal health data, from sources other than clinical trials, for the purpose of improving the robustness of its scientific assessment or verifying claims of the applicant or marketing authorisation holder in the context of the evaluation or supervision of medicinal product. Such processing should support EMA’s public health tasks and in particular the evaluation and monitoring of medicinal products or the preparation of regulatory decisions and scientific opinions.

text: 13. In line with

text: Article 9

text: GDPR and 10 EUDPR, processing of personal data concerning health shall be prohibited, unless one of the exceptions under

text: Article 9(2)

text: GDPR and 10(2) EUDPR applies. Reasons of substantial public interest in the area of public health and scientific research can justify the processing of personal data concerning health provided that appropriate safeguards for the fundamental rights and interests of the data subject are identified on the basis of Union or Member State law .

text: 14. The EDPS notes that, while Article 166 of the Proposal outlines the purposes for which personal health data would be processed (namely EMA’s public health tasks and in particular the evaluation and monitoring medicinal products or the preparation of regulatory decisions and scientific opinions), it does not specify the categories of personal health data to be processed and the sources from which such personal health data would be collected.

text: 15. As regards the categories of data to be processed, the EDPS understands that providing further details in the legislative act of each specific category of personal health data to be processed by EMA could be complex to achieve in practice. Article 166(1) of the Proposal makes clear, however, that only personal health data which is necessary to support EMA’s public health tasks and in particular the evaluation and monitoring medicinal products or the preparation of regulatory decisions and scientific opinions will be processed.

text: 16. As regards the sources from which such personal health data would be collected, the EDPS notes that Article 166(1) of the Proposal indicates that personal health data to be processed by EMA would be collected “(...) from sources other than clinical trials (...)”, without providing any limitation. Recital (60) of the Proposal clarifies that EMA should be able to use personal health data including via the Data Analysis and Real World Interrogation Network (DARWIN) and the European Health Data Space interoperable infrastructure.

text: 17. In accordance with

text: Article 10(2)

text: EUDPR, the prohibition on processing of personal data concerning health shall not apply in the cases of

text: Article 10(2)

text: (i) (public health) and

text: Article 10(2)

text: (g) (scientific research). Both these provisions require, however, that relevant legal basis provided by Union law ‘must provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject’.

text: 18. The EDPS understands that, in cases of use of health data by EMA via the forthcoming European Health Data Space (‘EHDS’), the safeguards required by

text: Articles 9

text: GDPR and 10 EUDPR are those included in the forthcoming EHDS Regulation. In all other cases, however, in line with

text: Articles 9

text: GDPR and 10 EUDPR, safeguards would need to be specified in another instrument of Union or Member State law. In the light of the considerations, the EDPS considers it necessary that at least the sources of personal health data be identified in the enacting terms of the Proposal, together with any other relevant safeguards, such as pseudonymisation.

text: 3.2. Processing of personal data

text: 19. Article 169(2) of the Proposal states that “[f]or the purpose of this Article, ‘regulatory science activities’ shall mean scientific projects to complement available scientific evidence with regard to diseases or horizontal questions related to medicinal products, to fill evidence gaps that cannot be fully addressed through data in the possession of the Agency, or to support horizon scanning activities. (...)”.

text: 20. The EDPS considers that Article 169(2) of the Proposal (and in particular the underlined part) does not specify the purposes of the processing in a manner that would provide sufficient clarity and foreseeability for the individuals affected. For example, the EDPS notes that the term ‘horizon scanning activities’ lacks clarity on its meaning as well as whether the aim of filling ‘evidence gaps’ that cannot be fully addressed through data in the possession of EMA is considered as a purpose of its own or rather as a qualification of the preceding purpose. Therefore, the EDPS recommends to clarify, insofar possible, such aspects.

text: 21. Article 169(3) of the Proposal states that “[t]he processing of personal data by the Agency in the context of this Article shall be guided by the principles of transparency, explainability, fairness, and accountability.” In this regard, the EDPS notes that, as the EUDPR as a whole would apply to any processing to personal health data performed by EMA (as explicitly confirmed by Article 169(1) of the Proposal), the EDPS suggests the deletion of Article 169(3) of the Proposal.

text: 22. Article 169(4) of the Proposal provides that “[t]he Management Board shall establish the general scope for the regulatory science activities in consultation with the Commission and the European Data Protection Supervisor.” In this regard, the EDPS considers that

text: Article 169(4)

text: lacks clarity as to the elements that should be addressed by the Management Board’s 7 decision when establishing the general scope of the regulatory science activities or which criteria shall be taken into account. The EDPS recommends to clarify such aspects as much as possible. Moreover, he also suggests to clarify whether the consultation of the EDPS would take place under

text: Article 41

text: EUDPR, or whether such consultation would take another form.

text: 4. The Eudravigilance database

text: 23. Article 101(1) of the Proposal requires EMA to set up, in collaboration with the Member States and the Commission, a ‘Eudravigilance database’ to collate pharmacovigilance information regarding medicinal products authorised in the Union and to allow competent authorities to access that information simultaneously and to share it. In addition, Article 101(3) of the Proposal requires EMA to ensure that healthcare professionals and the public have appropriate levels of access to the Eudravigilance database, and that personal data is protected. EMA is required to work together with all stakeholders, including research institutions, healthcare professionals, and patient and consumer organisations, in order to define the ‘appropriate level of access’ for healthcare professionals and the public to the Eudravigilance database.

text: 24. The EDPS understands that the setting up and maintaining of the Eudravigilance database would entail the processing of personal data (including health data), including their transfer to third countries and relevant international organisations. In this regard, the EDPS first notes that the Article of the Proposal does not clearly define what categories of personal data would be processed when sharing information on suspected adverse reactions in human beings arising from use of the medicinal products. In addition to specifying the categories of personal data involved , the EDPS also recommends to specify EMA’s role and responsibilities (and of Member States where applicable) within the meaning of data protection law in relation the processing operations carried out in the context of the Eudravigilance database.

text: 5. Orphan medicinal products

text: 25. Article 64(2) of the Proposal states that, among the particulars and documentation to be provided, the application of the orphan medicine sponsor shall also include the “name or corporate name and permanent address of the orphan medicine sponsor”. Moreover, the EDPS notes that, according to Article 67(1) of the Proposal, “[t]he register of designated orphan medicinal products shall list all designated orphan medicinal products. It shall be set up and managed by the Agency and be publicly available.” In this regard, Article 67(3) of the Proposal adds that “[t]he information on the designated orphan medicinal product entered in the register of designated orphan medicinal products (...)” shall include, among others, “(b) the name and address of the orphan medicine sponsor (...)”.

text: 26. The EDPS understands that personal data would be processed both in the context of the application and within the register of orphan medicinal products. While orphan medicine sponsors will be predominantly legal persons, it cannot be excluded that the information concerning orphan medicine sponsors relates to an identifiable natural person . As the register will be set up and managed by EMA, the EDPS recommends explicitly defining EMA’s role within the meaning of data protection law by designating EMA as the controller of the processing.

text: 6. European medicines web-portal and register of studies for environmental risk assessment

text: 27. Article 104(1) of the Proposal states that EMA “(...) shall, in collaboration with the Member States and the Commission, set up and maintain a European medicines web-portal for the dissemination of information on medicinal products authorised or to be authorised in the Union.” In addition, the same Article clarifies that, by means of such portal, “(...) the Agency shall make public the following: (a) the names of members of the Committees referred to in

text: Article 142

text: , (...) and the members of the coordination group, together with their professional qualifications and with the declarations (...)”.

text: 28. The EDPS understands that personal data would be processed in the web-portal for the purpose of dissemination of information on medicinal products already authorised or to be authorised in the EU. Since EMA, in collaboration with Member States and the Commission, would be responsible to set up and maintain the web-portal, the EDPS considers it necessary to clarify the EMA’s role within the meaning of data protection law, as also the role of Member States and the Commission.

text: 7. Conclusions

text: 29. In light of the above, the EDPS makes the following recommendations: (1) to clarify in Article 166 of the Proposal at least the sources from which personal health data would be collected by EMA, together with other relevant safeguards, such as pseudonymisation; (2) to modify Article 169(2) of the Proposal in a way that it specifies the purposes of the processing in a manner that would provide sufficient clarity and foreseeability for the individuals affected; (4) to clarify in Article 169(4) of the Proposal the elements that should be addressed by the Management Board’s decision when establishing the general scope of the regulatory science activities, the criteria shall be taken into account, as well as the manner in which the EDPS shall be consulted; (5) to clarify the categories of personal data to be processed within the Eudravigilance database when sharing information on suspected adverse reactions in human beings arising from use of the medicinal products; (6) to specify EMA’s role and responsibilities (and of Member States where applicable) within the meaning of data protection law in relation the processing operations carried out in the context of the Eudravigilance database; (7) to designate EMA as the controller of the processing in relation to the register of orphan medicinal products; (8) to clarify the EMA’s role within the meaning of data protection law, as also the role of Member States and the Commission, in relation to the web-portal created for the purpose of disseminating information on authorised or to be authorised medicinal products. Brussels, 19 June 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 10


text: COM(2024) 670 final. 1

text: COM(2024) 670 final. 2

text: OJ L 295, 21.11.2018, p. 39. 4 COM(2024) 670 final. COM(2024) 670 final, Explanatory Memorandum, p. 3. 6 Idem. 7 Idem. 8 Idem. 4

text: COM(2024) 670 final, Explanatory Memorandum, p. 5. 10 Communication from the Commission to the European Parliament and the Council "A strategy towards a fully functioning and resilient Schengen area" (COM/2021/277 final). 11

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1). 12 Ibid. 5

text: EDPS Opinion 6/2023 on the Proposals for Regulations on the collection and transfer of advance passenger information (API), issued on 8 February 2023. 6

text: COM(2024) 670 final, Explanatory Memorandum, p. 13. 15 Ibid. 16

text: Regulation (EU) No 910/2014

text: of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive

text: , OJ L 257, 28.8.2014, p. 73– 114. 7

identifier: EDPS yttrande 24/2024

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 24/2024 on the Proposal for a Regulation establishing an application for the electronic submission of travel data

serie: yttranden

text: 4 December 2024

type: rubrik

text: Opinion 24/2024

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council establishing an application for the electronic submission of travel data (“EU Digital Travel application”) and amending

text: Regulation (EU) 2016/399

text: and

text: (EU) 2018/1726

text: of the European Parliament and of the Council and

text: Council Regulation (EC) No 2252/2004

text: , as regards the use of digital travel credentials . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: (EU) 2016/399

text: and

text: (EU) 2018/1726

text: Council Regulation (EC) No 2252/2004

text: , as regards the use of digital travel credentials (‘the Proposal’).

text: The objective of the Proposal is to increase security in the Schengen area and the EU and allow for a smoother and faster border crossing for travellers. To this end, the Proposal for a regulation aims at (i) establishing a uniform standard for digital travel credentials and a common EU application (EU Digital Travel application) for using them, (ii) allowing people to use digital travel credentials to cross external air, land and sea borders based on a uniform EU technical solution, and (iii) enabling border authorities to carry out checks based on these credentials, to reduce bottlenecks and time spent at border-crossing points.

text: The EDPS considers that the Proposal does not raise any specific concerns from data protection perspective. Notwithstanding this general conclusion, the EDPS recommends to clarify that competent border authorities should delete the travel data they have received remotely from the traveller via digital advance submission, immediately after the traveller has been granted entry or after an adequate waiting period after a decision denying exit or entry has been taken, unless there is a legal justification for a continued processing for other purposes. He also highlights the need to clarify the relationship between the digital travel credentials and the European Digital Identity Wallet.

text: Contents 4. Relationship with the European Digital Identity Wallet..7

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 8 October 2024, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council establishing an application for the electronic submission of travel data (“EU Digital Travel application”) and amending Regulations

text: (EU) 2016/399

text: and

text: (EU) 2018/1726

text: Council Regulation (EC) No 2252/2004

text: 2. The objective of the Proposal is to increase security in the Schengen area and the EU and allow for a smoother and faster border crossing for travellers . To this end, the Proposal for a regulation aims at (i) establishing a uniform standard for digital travel credentials and a common EU application (EU Digital Travel application) for using them, (ii) allowing people to use digital travel credentials to cross external air, land and sea borders based on a uniform EU technical solution, and (iii) enabling border authorities to carry out checks based on these credentials, to reduce bottlenecks and time spent at border-crossing points .

text: 3. As a result, travellers will have the possibility to submit a digital version of their travel document through an application for an advance check ahead of travel, and consequently to pass through border control in a smoother fashion . In addition, the Proposal will allow border authorities to carry out the checks in advance and thereby focus their resources on detecting cross-border crime and irregular migration more efficiently .

text: 4. In addition, the Proposal will have an impact on several existing legal acts, relating to digital visas, the European Travel Authorisation and Information System (ETIAS), the Entry/Exit System (EES), and advance passenger information (API) .

text: 5. The 2021 Commission Communication on a Schengen Strategy put forward the European Commission’s plans towards further digitalising procedures at the external borders of the Schengen area, including an initiative on digitalising travel documents and facilitating travel.

text: 6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 9 October 2024, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 33 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 7. The EDPS welcomes the specific attention given in the Proposal, in particular in recital 11 and in

text: Article 7

text: , to the data protection aspects of the envisaged processes. As a result, the Proposal provides for the necessary legal clarity and certainty as regards the applicable data protection framework, namely

text: Regulation (EU) 2016/679

text: (GDPR) and the EUDPR, as well as on the attribution of the role and responsibilities of data controller and data processor with regard to the involved Union and national authorities.

text: 8. The EDPS also welcomes the voluntary nature of the digital travel credentials and the possibility for the individuals to freely choose whether to use them or a physical travel document for the purpose of undergoing border checks, without affecting their eligibility to cross external borders. In this regard, the EDPS calls on the competent Union and Member States bodies to ensure that the possible choice not to use the digital credentials would not entail in practice any other negative consequences for the individual.

text: 9. The EDPS positively notes that the amount and categories of personal data, as currently processed in the areas of border control and document issuance under Union and national law, are not affected by this proposal . The EDPS similarly welcomes the fact that, in line with ICAO standards and the principle of data minimisation, pursuant to Article 4(7) of the Proposal, the digital travel credentials created would not include the fingerprints of the holder.

text: 10. However, the EDPS considers that the establishment of the EU Digital Travel application and the creation and use of digital travel credentials would inevitably lead to additional risks for the data subject, as personal data that would otherwise be presented physically in a non-digital format to the border control authorities would be transmitted remotely, leaving the data subject with less control of the data and opening up possibilities for further processing. Therefore, adequate safeguards, such as strict purpose limitation and robust security, including protection against any unauthorised access, alteration, or loss of data, are essential.

text: 11. The EDPS also notes that advance border checks with the use of digital travel credentials (and other travel data, if applicable) are in practice very similar to the processing of advance passenger information by border authorities. The EDPS recalls that he has issued an Opinion on two Proposals for Regulations on the collection and transfer of advance passenger information (API), where he has discussed several elements that are relevant also in the context of the proposed EU Digital Travel application, such as the functioning of a dedicated EU ‘router’, the storage of data, and the designation of data controllers and processors .

text: 12. This being said, the EDPS considers that the Proposal does not raise any specific concerns from data protection perspective. Notwithstanding this general conclusion, the following specific comments aim to highlight selected aspects of the Proposal that may require additional attention and clarification.

text: 3. Storage Limitation

text: 13. The EDPS stresses that in principle the digitalisation and digital delivery of travel data by the traveller should not lead to additional data retention that would not generally occur in cases where the traveller chooses to use his or her physical travel document. In this regard, the EDPS welcomes the clarification in Article 7(4) of the Proposal that no personal data should be stored on the backend validation service or the Traveller Router beyond what is necessary for the creation of the digital travel credential and transmission of the travel data to the competent border authorities.

text: 14. However, in the view of the EDPS, the retention of digital travel credentials and other traveller data by border control authorities requires a more precise legal limitation. Therefore, the EDPS recommends to further clarify that the competent border authorities should delete the travel data they have received from the traveller via digital advance submission immediately after the traveller has been granted entry or after an adequate waiting period after a decision denying exit or entry has been taken, unless there is a legal justification for a continued processing for other purposes.

text: 15. In the same vein, the EDPS notes that in order to use the digital travel credentials, the digital travel credentials submitted by the user must be temporarily stored in a local database in the responsible Member State. This temporary database would be populated with the facial images that are contained in the submitted digital travel credentials. According to the Proposal, this is necessary to biometrically match the traveller to the submitted digital travel credential when they present themselves at the border-crossing point . The EDPS recommends that once the border check has been carried out, the data should be deleted from the temporary database – similar to what is currently done when reading chip data from physical travel documents during border checks .

text: 16. According to Article 4(2) of the Proposal, the EU Digital Travel application should provide for the possibility to store a digital travel credential for multiple use in the European Digital Identity Wallet, provisions for which are laid down in

text: Regulation (EU) No 910/2014

text: 17. The EDPS supports in principle the envisaged interoperability between the EU Digital Travel application and the European Digital Identity Wallet as provided for in Article 8(4) of the Proposal. At the same time, the EDPS notes that the Proposal lacks any specic details about the relationship between the two systems.

text: 18. The digital travel credentials would contain the same personal data, including facial image and excluding the fingerprints, as the identity cards, passports or other travel documents, on which they are based. Conversely, according to

text: Article 3

text: , point 3 of

text: Regulation (EU) No 910/2014

text: , ‘person identification data’ that can be stored in the European Digital Identity Wallet means a set of data that is issued in accordance with Union or national law and that enables the establishment of the identity of a natural or legal person, or of a natural person representing another natural person or a legal person. In this context, it is not clear whether digital travel credentials would be stored in the form of attestations of attributes, similarly to a driver’s licence, or as person identification data.

text: 19. Therefore, the EDPS recommends further clarifying the relationship between the digital travel credentials and the European Digital Identity Wallet, e.g. by explicitly referring to this element in Article 16 of the Proposal as regards the future implementing acts to be adopted by the Commission.

text: 5. Conclusions

text: 20. In light of the above, the EDPS makes the following recommendations: (1) to clarify that the competent border authorities should delete the travel data they have received remotely from the traveller via digital advance submission, immediately after the traveller has been granted entry or after an adequate waiting period after a decision denying exit or entry has been taken, unless there is a legal justification for a continued processing for other purposes. (2) to further clarifying the relationship between the digital travel credentials and the European Digital Identity Wallet. Brussels, 4 December 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8

type: vagledning

utgivare: edps


text: COM(2025) 447 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2025) 447 final. 4 See See Explanatory Memorandum, COM(2025) 447 final, p.1. 5 See Recital 1 of the Recommendation, COM(2025) 447 final, p.6. See Explanatory Memorandum, COM(2025) 447 final, p.1. 5

text: See Explanatory Memorandum, COM(2025) 447 final, p.1. 8 Ibid . 9 Agreement between the United States of America and the European Union on the Processing and Transfer of Financial Messaging Data from the European Union to the United States for the Purposes of the Terrorist Finance Tracking Program, OJ L 195, 27.7.2010, pp. 5–14. 6

text: See Opinions of the Court of Justice of 6 October 2021, A-1/19 par. 284-285 and of 26 July 2017, PNR Canada, ECLI:EU:C:2017:592, par. 96. See also EDPB- EDPS Joint Opinion 5/2021 on the proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), issued on 18 June 2021, par. 11. 11

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89. 12 Agreement between the United States of America and the European Union on the protection of personal information relating to the prevention, investigation, detection, and prosecution of criminal offences (‘Umbrella Agreement’), OJ L 336, 10.12.2016. 7

text: See

text: Article 1(3)

text: and Article 5(1) of the Umbrella Agreement. 14 See Explanatory Memorandum, COM(2025) 447 final, p. 4. 15 See point 11 of the Annex, COM(2025) 447 final. 16 See e.g. CJEU judgment of 6 October 2020, La Quadrature du Net and Others,

text: and

text: , EU:C:2020:791, paragraphs 120 and 121. 8

text: See CJEU judgment of 6 October 2020, Joined Cases La Quadrature du Net and Others,

text: and

text: , EU:C:2020:791, paragraphs 95-98, judgment of 2 October 2018, Ministerio Fiscal,

text: , EU:C:2018:788, paragraphs 54, 57and 60, (judgment of 2 March 2021, Prokuratuur (Conditions of access to data relating to electronic communications),

text: , EU:C:2021:152, paragraph 35. 18 See point 2 of the Annex, COM(2025) 447 final. 19 DHS Reference No. DHS/ALL/PIA-095(b), available at https://www.dhs.gov/sites/default/files/2024-04/24_0429_priv_pia-dhs-all- 095b.pdf 9

text: See the EDPS press release of 28 May 2025, available at https://www.edps.europa.eu/press-publications/press-news/pressreleases/2025/migration-management-data-protection-one-last-lines-defence-vulnerable-individuals_en 21 See points 7 and 8 of the Annex, COM(2025) 447 final. 10

text: See point 11(e) of the Annex, COM(2025) 447 final. 23 See

text: Article 49(4) of Regulation (EU) 2024/1358

text: of the European Parliament and of the Council of 14 May 2024 on the establishment of ‘Eurodac’ for the comparison of biometric data in order to effectively apply Regulations

text: (EU) 2024/1351

text: and

text: (EU) 2024/1350

text: of the European Parliament and of the Council and

text: Council Directive 2001/55/EC

text: and to identify illegally staying third-country nationals and stateless persons and on requests for the comparison with Eurodac data by Member States’ law enforcement authorities and Europol for law enforcement purposes, amending Regulations

text: (EU) 2018/1240

text: and

text: (EU) 2019/818

text: of the European Parliament and of the Council and repealing

text: Regulation (EU) No 603/2013

text: of the European Parliament and of the Council (‘Eurodac Regulation) (OJ L, 2024/1358, 22.5.2024). 24 See for instance Judgment of 24 September 2019, GC and Others,

text: , EU:C:2019:773, par. 44; judgment of 25 January 2018, Bevándorlási és Állampolgársági Hivatal,

text: ; EU:C:2018:36, par. 59-63; judgment of 22 June 2021, Latvijas Republikas Saeima,

text: , EU:C:2021:504, par. 74-75. 11

text: See points 6 and 11(e) of the Annex, COM(2025) 447 final. 26 Under U.S. law a felony is a crime for which the penalty is more than one year of imprisonment. 27 DHS Reference No. DHS/ALL/PIA-095(b), page 2. 28 Opinion 4/2022 on the Proposal for a Regulation on automated data exchange for police cooperation, paragraphs 42, 43, https://www.edps.europa.eu/system/files/2022-03/22-03-07_opinion-4-2022_prum_en.pdf 12

text: DHS Reference No. DHS/ALL/PIA-095(b), page 2. 30 For more information see

text: Regulation (EU) 2024/982

text: of the European Parliament and of the Council of 13 March 2024 on the automated search and exchange of data for police cooperation, and amending Council Decisions 2008/615/JHA and 2008/616/JHA and Regulations

text: (EU) 2018/1726

text: (EU) No 2019/817

text: and

text: (EU) 2019/818

text: of the European Parliament and of the Council (the Prüm II Regulation), OJ L, 2024/982, 5.4.2024. 13

text: See Explanatory Memorandum, COM(2025) 447 final, page 2. 32 For more information, see

text: Regulation (EU) 2019/817

text: and

text: Regulation (EU) 2019/818

text: (‘Interoperability Regulations’). 33

text: Regulation (EU) 2019/816

text: of the European Parliament and of the Council of 17 April 2019 establishing a centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (ECRIS-TCN) to supplement the European Criminal Records Information System and amending

text: Regulation (EU) 2018/1726

text: , OJ L 135, 22.5.2019, pp. 1–26. 34 See point 11 of the Annex, COM(2025) 447 final. 14

text: See point 3 of the Annex, COM(2025) 447 final. 36 See point 11(c) of the Annex, COM(2025) 447 final. 37 See point 11(h) of the Annex, COM(2025) 447 final. 38 See point 11(j) of the Annex, COM(2025) 447 final. 39 See point 11(b) of the Annex, COM(2025) 447 final. 40 See judgment of the Court of Justice of 1 October 2015, Case C 201/14, Smaranda a.o., ECLI:EU:C:2015:638, in particular para. 32 and 33 where the Court found that ‘the requirement to inform the data subjects about the processing of their personal data is all the more important since it affects the exercise by the data subjects of their right of access to, and right to rectify, the data being processed, and their right to object to the processing of those data’ and ‘[t]hat information concerns the identity of the data controller, the purposes of the processing and any further information necessary to guarantee fair processing of the data’. 15

text: See point 11(k) and (f) of the Annex, COM(2025) 447 final. 16

text: See point 21 of the Annex, COM(2025) 447 final. 17

identifier: EDPS yttrande 24/2025

title: EDPS Opinion 24/2025 on the Recommendation for a Council Decision authorising the opening of negotiations on a framework agreement between EU and USA on the exchange of information for security screenings and identity verifications

text: Opinion 24/2025

text: on the negotiating mandate for a framework agreement between the European Union and the United States of America on the exchange of information for security screenings and identity verifications

text: The European Data Protection Supervisor (EDPS) is an independent institution of the European Union (EU), responsible under

text: Article 52(2) of Regulation (EU) 2018/1725

text: ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3) of Regulation (EU) 2018/1725

text: ‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

text: Under

text: Article 42(1) of Regulation (EU) 2018/1725

text: , the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Recommendation for a Council Decision authorising the opening of negotiations on a framework agreement between the European Union and the United States of America on the exchange of information for security screenings and identity verifications relating to border procedures and applications for visa .

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: This Opinion is limited to the provisions of the Recommendation that are relevant from a data protection perspective.

text: Executive Summary

text: On 23 July 2025, the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations on a framework agreement between the European Union and the United States of America on the exchange of information for security screenings and identity verifications relating to border procedures and applications for visa.

text: The objective of the proposed Recommendation is to provide the negotiating directives to the European Commission to negotiate a framework agreement that will set out the legal structure and conditions for the exchange of information between the competent authorities of the EU Member States and of the United States, based on which the Member States would be empowered to establish bilateral agreements for an exchange of information from their national systems. The Recommendation is linked to the requirement by the United States for admission to and further participation in the U.S. Visa Waiver Program, pursuant to which the partner countries have to conclude of an ‘Enhanced Border Security Partnership’ (EBSP) with the U.S. Department of Homeland Security.

text: The EDPS notes that the proposed framework agreement, if concluded, would set an important precedent, as it would be the first agreement concluded by the EU implying large-scale sharing of personal data, including biometric data, for the purpose of border and immigration control by a third country. Therefore, the EDPS stresses the need to ensure that the envisaged processing of personal data does not exceed the limits of what is strictly necessary and proportionate. In the light of this, he largely supports the proposed approach to establish a common EU-U.S. framework for such information exchange that would set common Union-level conditions and safeguards and thus, in his view, contribute to more effective guarantees and subsequently stronger protection of the fundamental rights and freedoms of the affected individuals. To this end, the EDPS urges the Commission and the Council to take into account a number of specific recommendations.

text: The EDPS considers it necessary to conduct an in-depth fundamental rights impact assessment of the proposed framework agreement and the Enhanced Border Security Partnerships with the United States. In that context, he believes that the seriousness of the interference by the proposed sharing of personal data for the purposes of border and immigration control by the United States should be deemed comparable to the seriousness of the interference caused by the exchanges of data for law enforcement purposes.

text: Additionally, the EDPS recommends to define the personal scope of the framework agreement exhaustively and narrowly, taking also into account the specific prohibitions of data sharing laid down in EU law. In the same vein, he recommends that the categories of personal data that may be exchanged under the framework agreement, including the content and the scope of the supplementary information to be provided to the U.S. authorities, should also be circumscribed exhaustively and as narrowly as possible. Moreover, the EDPS explicitly underlines that any direct or indirect sharing and transfer of data from the EU large-scale IT systems in the area of justice and home affairs and in particular from those related to migration and asylum, should be precluded.

text: The EDPS makes also other important recommendations, including about the accountability mechanisms, in particular the need for clear and specific justification of each query; the transparency of the envisaged processing and the corresponding obligations of the competent U.S. and EU authorities; the legal possibility for EU Member States to refuse sharing or transferring data to U.S. authorities in individual cases; the availability of judicial redress in the United States regardless of the citizenship and the purposes of the processing; and others.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union (TFEU),

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 23 July 2025, the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations on a framework agreement between the European Union and the United States of America on the exchange of information for security screenings and identity verifications relating to border procedures and applications for visa (‘the Recommendation’).

text: 2. The objective of the proposed Recommendation is to provide the negotiating directives to the European Commission to negotiate a framework agreement that will set out the legal structure and conditions for the exchange of information between the competent authorities of the EU Member States and of the United States, based on which the Member States would be empowered to establish bilateral agreements for an exchange of information with the United States from their national information systems .

text: 3. The Recommendation is linked to the new requirement by the United States of America for admission to and further participation in the U.S. Visa Waiver Program (VWP), which enables citizens of participating countries to travel to the United States visa-free for maximum 90 days for the purpose of tourism or business. The new requirement entails the conclusion of an ‘Enhanced Border Security Partnership’ (EBSP) with the U.S. Department of Homeland Security (DHS) . Consequently, the envisaged framework agreement would apply to those Member States which enjoy a visa free status with the U.S. or who wish to join the U.S. VWP .

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 23 July 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 3 of the Recommendation. In addition, given the expected significant impact on the proposed agreement on the rights to privacy and protection of personal data, the EDPS stands ready to provide further advice to the Commission as Union negotiator in the course of the negotiations.

text: 2. General remarks

text: 5. The conclusion of an Enhanced Border Security Partnership with the U.S. Department of Homeland Security is a condition for admission to, and further participation in the U.S. VWP. The EBSP would complement the already existing traveller information exchange requirements such as the Agreements on Enhancing Cooperation in Preventing and Combating Serious Crime (PCSC Agreements), which establish information exchange, including biometric data, on individuals who are suspected or convicted of terrorist offences or serious crime .

text: 6. The United States has set a deadline 31 December 2026 for the conclusion of the EBSP agreements with the countries admitted to the VWP, including the EU Member States . It should be noted that the proposed framework agreement differs from the existing EU agreements with third countries, including with the United States, that entail large-scale transfers of data, such as the Passenger Name Record (PNR) agreements or the EU-U.S. TFTP Agreement . The material scope of these agreements is limited to law enforcement and criminal justice cooperation, and in some cases their scope is further restricted to combating only serious crime and terrorism.

text: 7. The proposed framework agreement, if concluded, would therefore set an important precedent, as it would be the first agreement concluded by the EU implying large-scale sharing of personal data, including biometric data, for the purpose of border and immigration control by a third country.

text: 8. Given the novelty of the subject matter and the expected significant impact on the fundamental rights of a large number of individuals, the EDPS notes with regret that the Recommendation is not accompanied by an Impact Assessment, which in this case would have been fully justified and would have facilitated the assessment of its necessity and proportionality.

text: 9. This notwithstanding, the EDPS largely supports the proposed approach to establish a common EU-U.S. framework for information exchange in the context of the EBSP that would set common Union-level conditions and safeguards. Such an approach might, in his view, contribute to more effective safeguards and subsequently stronger protection of the fundamental rights and freedoms of the affected individuals.

text: 10. This Opinion examines the necessity and proportionality of the proposed framework agreement as it would result if the negotiating directives were all fully implemented, focusing specifically on its purpose, material and personal scope and envisaged data protection safeguards, including oversight and redress mechanisms, and offers a number of concrete recommendations.

text: 3. Legal basis and applicable legal framework on data protection

text: 11. The EDPS notes that the legal basis of the Recommendation are the following provisions of the TFEU:

text: Article 16(2)

text: Article 77(2)

text: and

text: Article 218(3)

text: and (4).

text: Article 218

text: TFEU lays down the procedure for the negotiation and conclusion of agreements between the European Union and third countries or international organisations.

text: Article 77(2)

text: TFEU regulates matters related to, among others, the common visa policy and the checks of persons crossing external borders of the Union.

text: 12. Under

text: Article 16(2)

text: TFEU, the Union has the power to adopt measures relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies and by Member States when carrying out activities which fall within the scope of Union law.

text: 13. In line with the jurisprudence of the CJEU,

text: Article 16

text: TFEU provides an appropriate legal basis in cases where the protection of personal data is one of the essential aims or components of the rules adopted by the EU legislature .

text: 14. The EDPS considers that it can indeed already be considered that the protection of personal data is (and should be) one of the essential aims and components of the future framework agreement and therefore supports the inclusion of

text: Article 16

text: TFEU among substantive legal bases of the Recommendation.

text: 15. The other interlinked aims of the agreement are to further law enforcement cooperation and immigration control. In that context, one of the consequences of the interlinked law enforcement and immigration objectives of the EBSP is the potential applicability of different data protection regimes under the EU data protection legal framework. The processing of data by criminal law enforcement authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties is covered by

text: Directive (EU) 2016/680

text: (‘the LED’) , while processing of personal data by Member States for purposes like immigration control and visa policy is governed by

text: Regulation (EU) 2016/679

text: (the ‘GDPR’). Both the GDPR and the LED include strict conditions for the transfer of personal data to third countries.

text: 16. In addition, for data transfers between criminal law enforcement authorities for the prevention, investigation, detection or prosecution of criminal offenses, including terrorism, the EU and the United States have signed in 2016 the so-called ‘Umbrella Agreement’, which is intended to provide appropriate safeguards within the meaning of

text: Article 37(1)

text: (a) of the LED . The Umbrella Agreement supplements, as appropriate, but does not replace, provisions regarding the protection of personal data in the existing and future law enforcement agreements between the EU Member States and the United States. At the same time, the Umbrella Agreement on its own is not construed to provide the legal basis for any transfers of personal data .

text: 17. As acknowledged by the Commission in the Explanatory Memorandum , given the broader scope and purpose of the information exchange intended by the EBSP, and to the extent that authorities other than criminal law enforcement would be involved in the transfer, the EU-U.S. Umbrella Agreement is not entirely applicable to all the types of transfers envisaged by the United States under the EBSP.

text: 18. Consequently, one of the objectives of the framework agreement is to fill this gap and to lay down the safeguards and guarantees needed with regard to the protection of personal data as well as fundamental rights and freedoms of individuals affected by the exchange of personal data in the context of the EBSP .

text: 19. The EDPS is concerned that the distinction in practice between the applicable legal acts on data protection, i.e. the GDPR and the LED, might prove challenging, especially in view of possible divergent understanding in the EU and in the United States of the concepts of security and law enforcement. Therefore, the EDPS urges the Commission to circumscribe very clearly in the framework agreement the purposes and the objectives of the envisaged data processing operations under the EBSP, in order to ensure the necessary legal clarity and certainty regarding the applicable legal framework on data protection in the EU, especially if the transfer of personal data for non-law enforcement purposes in the U.S. is retained in the agreement.

text: 4. Necessity and proportionality

text: 20. Article 52(1) of the Charter of Fundamental Rights (‘the Charter’) allows limitations to be placed on the exercise of the rights to privacy and protection of personal data enshrined Articles 7 and 8 of the Charter, provided that those limitations are provided for by law, that they respect the essence of those rights and that, in compliance with the principle of proportionality, they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others . In this context, an integral part of the proportionality test is the assessment of the seriousness of the interference by the envisaged processing of personal data.

text: 21. The Court of Justice of the European Union (CJEU) has advanced several criteria to determine the seriousness of an interference with the right to the protection of personal data and the right for respect of private life, such as the objectives and purposes of the processing, the nature of the personal data, the categories and the number of affected data subjects, the nature and specific methods for the processing of the data at issue, etc. In that regard, the CJEU has repeatedly upheld the general principle that only significant and important objectives of public interest are capable of justifying a serious interference with the fundamental rights . Moreover, the greater the interference entailed by the proposed act is, the most robust and detailed the respective conditions and the safeguards should be.

text: 22. In line with the above-mentioned principles and case law, the EDPS considers that it is essential to ensure that the envisaged processing of personal data does not exceed the limits of what is strictly necessary and proportionate. To this end, the material and personal scope should be very clearly and narrowly defined. In particular, any potential exchange of personal data in the framework of the EBSPs should by limited only to people travelling to the United States. Moreover, as already envisaged in point 3 of the Annex to the Recommendation, the agreement should preclude a systematic, generalised and nontargeted processing of data for all travellers.

text: 4.1. Material scope

text: 23. According to the Recommendation, the purposes of the envisaged transfer and subsequent processing of personal data in the context of the EBSP are (1) ‘screening and verification of identity of travellers necessary to determine if their entry or stay would pose any risk to public security or public order’, and (2) ‘to support the competent authorities in the prevention, detection, investigation and prosecution of crimes and terrorist offences’ .

text: 24. The EDPS notes the U.S. Department of Homeland Security (DHS) has published in 2024 a “Privacy Impact Assessment Update - DHS International Biometric Information Sharing (IBIS) Program – Enhanced Border Security Partnership (EBSP)” , which explains in more details the purposes of the bilateral biometric and biographic information sharing between the United States and its foreign partners under the EBSP/IBIS Program, i.e. ‘border security, immigration decision-making, law enforcement activities with a nexus to the U.S. border, countering transnational crimes and organizations, detecting terrorism, and preventing and detecting crimes considered felonies under U.S. law or which render an individual inadmissible under the Immigration and Nationality Act’.

text: 25. Transfers of personal data for the purpose of prevention, detection, investigation and prosecution of crimes and terrorist offences, while liable to have a significant impact on the lives of the individuals concerned, are also capable in principle to justify a more serious interference with fundamental rights enshrined in Articles 7 and 8 of the Charter, as explained in the above-quoted case law of the CJEU. Moreover, such processing falls in the scope of the EU-U.S. Umbrella Agreement and the respective safeguards laid down in it.

text: 26. At the same time, the purpose of ‘screening and verification of identity of travellers’ and in particular ‘immigration decision-making’ by a third country authorities raises questions about its proportionality, especially if it would be carried out in a large scale, thus affecting a significant number of individuals.

text: 27. The EDPS acknowledges the significance of the measures related to border and migration management. The recently adopted Pact on Migration and Asylum as well as the newly developed large-scale EU IT systems like the European Travel Information and Authorisation System (ETIAS) and the Entry/Exit System (EES) show the political importance of these policies for the Union.

text: 28. At the same time, as the EDPS has repeatedly stressed, most recently on the occasion of the issuance of the EDPS Opinion on the Proposal for a Regulation establishing a common system for the return of third-country nationals staying illegally in the EU, data protection – as fundamental right listed in the Charter - is one of the last lines of defence for vulnerable individuals, such as migrants and asylum seekers . This is very relevant in the case of the proposed exchanges of personal data with the United States, given the well-known and widely recognised fact that the U.S. government applies a particularly strict immigration policy. Thus, it should be borne in mind that the transfer of personal data for the purposes of ‘screening and verification of identity of travellers’ may actually lead to serious legal and other consequences for the affected individuals, similar to those in the field of law enforcement and criminal justice, such as deprivation of liberty.

text: 29. The EDPS therefore urges the Commission to fully take into account in the negotiations the legal and policy implications of the material scope of the future agreement. Specifically, the seriousness of the interference provoked by the proposed sharing of personal data with a third country for the purposes of border and immigration control by that country should be considered for all effects as comparable to the interference caused by the exchanges of data for law enforcement purposes.

text: 4.2. Personal scope

text: 30. According to the Explanatory Memorandum to the Recommendation, under the EBSP, the United States intends to establish an information exchange on: - travellers to the United States who may have a connection to the VWP partner country; - applicants for immigration benefits or humanitarian protection in the United States; - individuals encountered by DHS law enforcement in a border and immigration context in the United States.

text: 31. The personal scope of the proposed exchange of personal data between the competent authorities of the Member States and of the United States is one of the key elements for the assessment of its proportionality. In that regard, the EDPS notes that the negotiating directives in the Recommendation make an important distinction between EU citizens, on the one hand, and third-country nationals, on the other hand .

text: 32. According to point 7 of the Annex of the Recommendation, personal data of third-country nationals would be transferred for both immigration purposes (‘in relation to the crossing of the external borders’) and for law enforcement purposes (‘in the context of the prevention, detection, investigation and prosecution of crimes and terrorist offences’).

text: 33. By contrast, in accordance with point 8 of the Annex of the Recommendation, personal data of [EU] citizens, their family members and of permanent residents may be exchanged only for law enforcement purposes, moreover if ‘strictly necessary and proportionate’.

text: 34. In addition, subject to specific safeguards, the framework agreement would also allow the transfer of personal data on minors and on victims of criminal offences, witnesses or other persons who can provide information concerning criminal offences .

text: 35. The EDPS understands that the exact modalities of the proposed data exchanges would be defined in the course of the negotiations. Notwithstanding this, he considers that still at the level of the negotiating mandate there should be sufficient clarity about the categories of data subjects potentially affected by the processing.

text: 36. In that regard, the EDPS considers that the negotiating directives should clarify the notion of ‘family members’ and should lay down the conditions and the context in which personal data of a family member may be queried and shared. The EDPS believes that such processing should in principle be possible only if the family member is actually crossing the borders of the United States, or is planning to do so (e.g. by filling for the Electronic System for Travel Authorization (ESTA) or requesting visa). In the same vein, there should be clarity about the notion of ‘permanent residents’. For instance, in the context of EU migration and asylum laws, the two categories that come closest to it are long-term residents and people with refugee status.

text: 37. Another aspect of the proposed framework agreement that could be deemed problematic from point of view of EU law is the envisaged exchange of personal data of ‘applicants for humanitarian protection in the US’, which seems to refer to asylum seekers. The EDPS recalls that the Union acts dealing with asylum and migration explicitly prohibit sharing such data from relevant EU IT system with third countries (with few limited exceptions, e.g. for readmission) .

text: 38. The EDPS therefore recommends that the personal scope of the framework agreement is defined exhaustively and as narrowly as possible, in accordance with the principles necessity and proportionality, taking fully into account the specific prohibitions of data sharing laid down in EU law.

text: 4.3. Categories of personal data

text: 39. The CJEU has identified the nature of the processed personal data, in special categories of data, as another important criterion for the assessment of the seriousness of an interference with the right to the protection of personal data .

text: 40. According to the Recommendation, the exchange of information under the framework agreement may include several categories of personal data: (1) ‘core’ data, i.e. the identity information included in the travel document, and the fingerprints of a traveller; (2) supplementary information about a given individual in case of a match against a queried database; as well as (3) special categories of personal data .

text: 41. In addition, the EDPS would like to point out that, in his understanding, a ‘hit/no hit’ reply in case of automatic queries against a database may also be considered as personal data and should be treated as such.

text: 42. The EDPS is concerned specifically by the lack of clarity in the negotiating directives, even in broad terms, about the content and scope of the supplementary information, which seem to be left to be circumscribed in the bilateral agreements or arrangements with the individual Member States.

text: 43. In this regard, the EDPS notes that in the already mentioned “Privacy Impact Assessment Update - DHS International Biometric Information Sharing (IBIS) Program – Enhanced Border Security Partnership (EBSP)” the U.S. DHS provides an indication about what additional information the U.S. authorities would be expecting from their counterparts in case of a match of the queried data (e.g fingerprints) against the respective database: ‘biographic information to DHS on the associated identity (e.g., name, date of birth, travel documents, nationality) as well as any known criminal convictions and arrests for serious 26 27 crimes , and an indication of the individual’s immigration status in that country’ .

text: 44. The EDPS recalls that he has already commented in his Opinion on the Proposal for a Regulation on automated data exchange for police cooperation (Prüm II) on the risk associated with the sharing of data from national police records, where the information about the possible arrests are typically stored. In particular, the EDPS had highlighted that national police records might contain data that had not been reviewed by a judicial authority, e.g. criminal intelligence about a potential ‘suspect’ in a crime, which had not been further pursued and investigated for various reasons. The concerns of the EDPS in his 2022 Opinion about the reliability of the information in the police records are even more relevant in the case at hand.

text: 45. The EDPS also notes that the proposed negotiating directives are not clear whether the supplementary information would be requested in all cases of a match, or only if the query is conducted in the context of the prevention, detection, investigation and prosecution of crimes and terrorist offences. However, the mentioned public document by the U.S. DHS implies that the additional information, including about prior arrests, would be generally required also in cases of queries for non-law enforcement (e.g. immigration) purposes.

text: 46. Regarding special categories of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, and data concerning a person's health and sex life or sexual orientation, according the proposed negotiating directives, their transfer should only be possible where ‘strictly necessary and proportionate in individual cases for preventing or combating criminal and terrorist offences as referred to in the framework agreement, and subject to appropriate safeguards’. The EDPS welcomes this specification and insists on its importance for ensuring the necessity and proportionality of the overall approach, given the sensitive nature of such data.

text: 47. The EDPS therefore recommends that, in line with the principles of necessity and proportionality and data minimisation, the categories of personal data to be exchanged under the framework agreement should be circumscribed in the framework agreement exhaustively and as narrowly as possible, especially regarding the possible supplementary information to be provided to the authorities of the other Party as a result of a query for non-law enforcement purposes.

text: 4.4. Modalities for exchange of personal data

text: 48. Another element of the proposed negotiating mandate that sets a precedent for the international agreements at Union level and thus deserves specific attention is the envisaged mechanism for exchange of personal data.

text: 49. The EDPS notes that point 15 of the Annex to the Recommendation seems to imply automatic access to certain Member States databases: ‘[t]he framework agreement should provide for a layered query response model, which distinguishes between information retrieved automatically upon performing a query and additional information which could be shared with the requesting Party only upon the explicit authorisation of that Party’.

text: 50. This understanding is further supported by the publicly available information from the U.S. DHS, which clarifies that pursuant to the bilateral Enhanced Border Security Partnerships with foreign partners, DHS may be authorized to conduct a search against the partner’s relevant national databases. In the event of a match, consistent with the terms of the applicable bilateral information sharing arrangement, the partner will provide additional information , as explained in the previous section of this Opinion.

text: 51. Thus it may be deemed that the proposed mechanism for queries under the framework agreement and the EBSPs would in practice approximate the United States with the situation of EU Member States and the Schengen Associated Countries as regards automatic access to data, for instance in the context of the Prüm system of automated data exchange for police cooperation .

text: 52. The EDPS notes that, according to points 10 and 12 of the Annex to the Recommendation, the framework agreement should outline the general conditions, criteria, types of databases and categories of data that would fall in scope of the exchange of information between the competent authorities of the Member States and of the United States as part of bilateral arrangements. On the other hand, the designation and the set-up of the queried national databases, as well as the other legal technical requirements or limitations, would be laid down in the bilateral arrangements operationalising the information exchange .

text: 53. In this context, the EDPS recalls that relevant national databases and the large-scale information systems used by EU Members States in the field of justice and home affairs, such as the Schengen Information System, the Visa Information System or Eurodac, are very much interlinked and interoperable. In addition, the architecture of many of these IT systems include central components, managed by a Union body - the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA). Moreover, the EU interoperability framework provides for storing and accessing data, including identity and biometric data, in common interoperability components, such the Common Identity Repository, the shared Biometric Matching Service and the European Search Portal .

text: 54. In the same vein, the EDPS recalls the explicit prohibitions under the EU law of sharing of personal data from Union databases and IT systems with third countries and international organisation. For instance, as already pointed out in this Opinion,

text: Article 49 of Regulation (EU) 2024/1358

text: (Eurodac Regulation) prohibits Member States and EU agencies from sharing data about refugee and migration status of third-country national that is stored in Eurodac. Similarly,

text: Article 18 of Regulation (EU) 2019/816

text: (ECRIS-TCN Regulation) prohibits sharing of information about criminal convictions of third-country nationals and stateless persons stored in the European Criminal Records Information System. The EDPS consider these safeguards as important ones and the framework agreement, which would take precedence over the mentioned provisions, should not overrule them.

text: 55. The EDPS therefore stresses that the proposed framework agreement and the bilateral EBSPs should preclude any possibility for direct or indirect sharing and transfer of data from the EU large-scale IT systems in the area of justice and home affairs, in particular for border and migration control purposes.

text: 4.5. Data protection safeguards

text: 56. The EDPS positively notes that the proposed negotiating directives include a number of safeguards, which the Commission as negotiator would aim to ensure in the future framework agreement. The EDPS specifically welcomes the objective for the agreement to provide safeguards and guarantees with regard to the protection of personal data and other fundamental rights and freedoms regardless of the nationality and place of residence of the individuals , which reflects the universal nature of the rights to privacy and data protection in the EU law.

text: 57. Similarly, it is the understanding of the EDPS that the safeguards and the guarantees with regard to the protection of personal data and other fundamental rights and freedoms should apply independently of the purpose of the query. The EDPS believes that this is the right approach, given the specific nature of the exchanges under the EBSP, which are without precedent, and the potentially serious consequences for the affected data subjects in both the law enforcement and the immigration context, as already explained above.

text: 58. Another important safeguard concerns the conditions triggering a query on a traveller. According to the proposed negotiating directives, the framework agreement should provide clear and precise rules and procedures that preclude a systematic, generalised and nontargeted processing of data for all travellers . While the EDPS welcomes and strongly supports this safeguard, he underlines the need to ensure that it is fully implemented in practice. To this end, the EDPS recommends including in the framework agreement effective accountability mechanisms, in particular an obligation for clear and specific justification of each query as well as logging of all processing operations related to the exchange.

text: 59. The EDPS also welcomes the proposed safeguards regarding storage that limit the retention of travellers’ personal data after their departure and its linking to objective evidence from which it may be inferred that there is a continuing risk to public security or public order ; the rules on automated processing of personal data, including profiling ; the prohibition of onward transfers of personal data to third countries or international organisations ; the exhaustive list of the competent authorities in the U.S. to which the Member States may transfer personal data as well as a short description of their competences .

text: 60. The EDPS also positively notes that according to point 15 of the Annex of the Recommendation, the transfer of additional/supplementary information to the U.S. side would only be possible with the explicit authorisation of the respective EU Member State.

text: 61. The EDPS however considers that this safeguard should be further developed and therefore recommends that the framework agreement provide for a general legal possibility for EU Member States to refuse sharing or transferring of data to U.S. authorities in individual cases.

text: 4.6. Transparency

text: 62. The EDPS positively notes that point 11(g) of the Annex of the Recommendation requires that the framework agreement should lay down rules, inter alia, ‘on information to be made available to individuals’.

text: 63. The EDPS recalls that the right to information is of utmost importance as it allows the exercise of the other data protection rights, including the right to remedies, and ensures fair processing of the data .

text: 64. The EDPS therefore stresses that the information to be made available to the data subjects about the envisaged sharing of data between the EU and the United States pursuant to the EBSP should be clear, easily accessible and sufficiently detailed to allow the individuals to be aware and to understand the purposes and the scope of the processing of their personal data, the identity of the data controller(s), the legal avenues for redress, and any other information necessary to ensure a fair and transparent processing of their data. Moreover, the EDPS reminds that the obligation about the transparency of the processing applies to both the U.S and the EU competent authorities.

text: 4.7. Oversight and redress

text: 65. The EDPS notes that, according to the proposed negotiating mandate, the framework agreement should ensure a system of oversight over the use of personal data by one or more independent bodies responsible for data protection in the U.S. with effective powers of investigation and intervention. In particular, the body or bodies should have powers to hear complaints from individuals about the use of their personal data. In addition, the framework agreement should also ensure enforceable rights of administrative and judicial redress for any person whose data are processed under the framework agreement and should guarantee effective remedies .

text: 66. In this regard, in line with Article 8(3) of the Charter and

text: Article 16(2)

text: TFEU, the EDPS stresses the importance of the existence of effective oversight and redress mechanisms, implemented by independent authorities. He is specifically concerned about the availability of judicial redress in the United States for all data subjects, irrespective of their citizenship and of the purpose of the data sharing. The EDPS recalls that the U.S. Judicial Redress Act of 2015 has extended certain rights of judicial redress established under the Privacy Act of 1974 to EU citizens. However, this extension is linked to the scope of application of EU-U.S. Umbrella Agreement, i.e. it is applicable only in case of transfers for law enforcement purposes. At the same time, as already explained in this Opinion, the envisaged personal scope of the framework agreement is much broader.

text: 67. The EDPS therefore recommends that the framework agreement offers guarantees that all data subjects would be able to avail themselves of the right to judicial redress in the United States (under the U.S. Judicial Redress Act or a similar U.S. legal act), regardless of their citizenship and the purposes of the processing under the EBSP.

text: 68. In addition, the EDPS notes that point 11(k) of the Annex of the Recommendation, which deals with oversight mechanisms, refers to ‘a duty of cooperation between such oversight bodies, on the one hand, and the relevant Union supervisory authorities, on the other hand’. The EDPS invites the Commission to clarify what is meant by ‘Union supervisory authorities’ and what exactly would be their role and obligations under the ‘duty of cooperation’.

text: 5. Suspension and termination

text: 69. The EDPS also positively notes that the proposed negotiating directives foresees an explicit provision in the framework agreement whereby a Party may terminate or suspend it, ‘in particular where the U.S. no longer effectively ensures the level of protection of fundamental rights and freedoms required under the framework agreement’ .

text: 70. Given the complex nature of the proposed cooperation between the EU and the Unites States, comprising both a framework agreement at Union level and EBSPs at national level, the EDPS recommends that the possible suspension and termination of the framework agreement, especially in situations where the U.S. no longer effectively ensures the required level of protection of fundamental rights and freedoms, should entail similar suspension or termination of the bilateral agreements and arrangements concluded by EU Member States.

text: 6. Conclusions

text: 71. In light of the above, the EDPS urges the Commission and the Council to take into account the following specific recommendations: (1) to conduct an in-depth fundamental rights impact assessment of the proposed framework agreement and the Enhanced Border Security Partnerships with the United States; (2) to consider the seriousness of the interference by the proposed sharing of personal data with a third country for the purposes of border and immigration control by the United States as being comparable to the seriousness of the interference caused by the exchanges of data for law enforcement purposes; (3) to define the personal scope of the framework agreement exhaustively and as narrowly as possible, taking also into account the specific prohibitions of data sharing laid down in EU law; (4) to clarify the notions of ‘family members’ and ‘permanent residents’; (5) to circumscribe exhaustively and as narrowly as possible the categories of personal data that may be exchanged under the framework agreement, including the content and the scope of the supplementary information to be provided to the U.S. authorities in case of a match, especially if the query is carried out for non-law enforcement purposes; (6) to preclude any possibility for direct or indirect sharing and transfer of data from the EU largescale IT systems in the area of justice and home affairs and in particular from those related to migration and asylum; (7) to include in the framework agreement effective accountability mechanisms, in particular an obligation for clear and specific justification of each query, as well as logging of all processing operations related to the exchange; (8) to guarantee that the individuals would be provided with clear, easily accessible and sufficiently detailed information about the envisaged processing pursuant to the EBSP, to allow them to be aware and to understand the purposes and the scope of the processing of their personal data, the identity of the data controller(s), the legal avenues for redress, and any other information necessary to ensure a fair and transparent processing; (9) to provide for a general legal possibility for EU Member States to refuse sharing or transferring data to U.S. authorities in individual cases; (10) to guarantee that all data subjects would be able to avail themselves of the right to judicial redress in the United States, regardless of their citizenship and the purposes of the processing under the EBSP; (11) to clarify the meaning and the scope of the ‘duty of cooperation’ between supervisory authorities; (12) to provide that the possible suspension and termination of the framework agreement, especially in situations where the U.S. no longer effectively ensures the required level of protection of fundamental rights and freedoms, would entail a similar suspension or termination of the bilateral agreements and arrangements concluded by EU Member States. Brussels, 17 September 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 18