text: OJ L 295, 21.11.2018, p. 39. 2 COM(2024) 183 final. 3

text: Regulation (EU) 2023/2124

text: of the European Parliament and of the Council of 4 October 2023 on certain provisions for fishing in the General Fisheries Commission for the Mediterranean (GFCM) Agreement area (recast) PE/24/2023/REV/1, OJ L, 2023/2124, 12.10.2023 4 COM(2024) 183 final, explanatory memorandum, p. 2. 4

text: Article 138

text: a(1) of the Proposal.

text: Article 138

text: a(2) of the Proposal. 7

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1–88. 8 See footnote 1. 9

text: Article 138

text: a(5) of the Proposal. 10

text: Article 5(1)

text: (f) GDPR and

text: Article 4(1)

text: (f) EUDPR. 5

text: Articles 15, 24, 34, 47(4), 70, 78(3) of Regulation 2023/2124 and

text: Articles 75

text: c, 96c, 106d of the Proposal. 12 Articles Article 65 of Regulation 2023/2124 and 30d, 37d, 06d, 120i of the Proposal. 6

identifier: EDPS yttrande 16/2024

title: EDPS Opinion 16/2024 on the Proposal for a Regulation amending Regulation (EU) No2023/2124 on certain provisions for fishing in the GFCM (General Fisheries Commission for the Mediterranean) Agreement area

text: 25 June 2024

text: Opinion 16/2024

text: Regulation (EU) No 2023/2124

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation amending

text: Regulation (EU) No 2023/2124 of 4 October 2023

text: on certain provisions for fishing in the GFCM (General Fisheries Commission for the Mediterranean) Agreement area. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: on certain provisions for fishing in the General Fisheries Commission for the Mediterranean (GFCM) Agreement area.

text: The objective of the Proposal is to implement into EU law fisheries conservation and management measures adopted by the GFCM. The GFCM is the regional organisation responsible for managing the fishery resources in the Mediterranean and Black Sea, with the view to promote the best utilisation of living marine resources and the sustainable development of aquaculture in that Sea.

text: The EDPS welcomes the inclusion in the Proposal of a specific provision dedicated to data management, protection of personal data and confidentiality. In particular, the EDPS welcomes the clear definition of the purposes of the processing of personal data, the data retention periods, and which entities would act as controllers.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 30 April 2024, the European Commission issued the Proposal for a Regulation of the European Parliament and the Council amending

text: on certain provisions for fishing in the GFCM (General Fisheries Commission for the Mediterranean) Agreement area (‘the Proposal’ ).

text: 2. The objective of the Proposal is to implement into EU law the fisheries conservation and management measures adopted in 2021 and 2022 by the General Fisheries Commission for the Mediterranean (GFCM), to which the European Union (EU) has been a contracting party since 1998 . The Proposal would make further amendments into

text: Regulation (EU) 2023/2124

text: in order to transpose additional GFCM measures.

text: 3. The GFCM is the regional organisation responsible for managing the fishery resources in the Mediterranean and Black Sea, with the view to promote the best utilisation of living marine resources and the sustainable development of aquaculture in that Sea.

text: 4. This Proposal corresponds to the fifth implementation of GFCM recommendations into EU law.

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 30 April 2024, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 24 of the Proposal.

text: 2. General remarks

text: 6. The EDPS welcomes the inclusion in the Proposal of a specific article on data management, protection of personal data and confidentiality. In particular, the EDPS welcomes: − the clear articulation of the purposes of the processing of personal data by the competent authorities, i.e. complying with the obligations of identifying relevant fishing vessels information and monitoring, controlling inspecting and surveilling fishing activities, in accordance with relevant articles of the Proposal, which are listed in an exhaustive manner . − the specification of a maximum retention period, together with the obligation to anonymize the data if the information is retained for a longer period . − the clarification of the roles of the authorities responsible for the processing of personal data, i.e. either the authorities of the Member States or the Commission shall be regarded as controllers, in accordance with 4(7) of Regulation (EU) 7 8 2016/679 (GDPR) or

text: Article 3(8) of Regulation (EU) 2018/1725

text: 3. Obligation of confidentiality

text: 7. The Proposal lays down a number of obligations that apply ‘in addition’ to those ‘established in Regulations

text: (EU) 2016/679

text: and

text: (EU) 2018/1725

text: ’. In particular, the relevant authorities should ‘ensure confidential treatment when transmitting and receiving electronic data’ . This obligation seems to apply, regardless of whether data can be considered as personal data or not.

text: 8. The EDPS recalls that both the GDPR and EUDPR require personal data to be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’) . As a result, several of the measures listed may also help to promote compliance with EU data protection law.

text: 9. The EDPS notes that the Proposal also foresees that the GFCM Secretariat may request authorities of the Member States and the Commission to rectify or erase electronic reports or messages processed in a manner which do not comply with this Proposal. If these electronic reports or messages include personal data, the EDPS recalls that the rights of the data subjects concerned should be respected, in accordance with Chapter III of the GDPR and the EUDPR.

text: 4. Obligation of security

text: 10. Paragraph 6 of

text: Article 138

text: a provides for the obligation of security of the processing of personal data in the context of the Proposal. The EDPS welcomes the objectives to prevent unauthorised processing of data, as well as to secure access to data and their transmission. However, the EDPS notes that this paragraph refers to ‘fisheries databases’, without specifying how these databases are established and which authorities can have access to them. The EDPS recommends to identify precisely these databases, and the users of these databases.

text: 5. International transfers of personal data

text: 11. The provisions of

text: Regulation (EU) 2023/2124

text: and of the Proposal regarding the lists of authorised and active vessels foresee that such lists should be communicated by the Member States to the Commission which, in turn, should transmit them to the GFCM Secretariat.

text: 12. The EDPS considers that such transmissions to the GFCM qualify as international transfers of personal data, since the GFCM is a regional fisheries management organisation established in 1949 under the provisions of Article XIV of the Constitution of the Food and Agriculture Organisation of the United Nations.

text: 13. The EDPS recalls the need for the Commission to comply with the conditions laid down in Chapter V of the EUDPR, when transferring personal data to the GFCM Secretariat. Similarly, the reporting obligation of presumed illegal, unreported, and unregulated (IUU) fishing laid down in

text: Article 128 of Regulation (EU) 2023/2124

text: should occur in compliance with the rules of Chapter V of the EUDPR. The EDPS recommends to add a recital recalling the need to ensure appropriate safeguards for international transfers of personal data.

text: 6. Personal data relating to criminal convictions and offences

text: 14. The EDPS notes that several articles of

text: Regulation (EU) 2023/2124

text: and of the Proposal refer to activities which would be considered as ‘infringements’. The EDPS recalls that data processed to prevent and fight against illegal fishing may constitute personal data relating to criminal convictions and offences, in which case safeguards for the rights and freedoms of data subjects should be provided, in accordance with

text: Article 10

text: GDPR and/or

text: Article 11

text: EUDPR.

text: 7. Conclusions

text: 15. In light of the above, the EDPS makes the following recommendations: 1) to identify the fisheries databases and the users of these databases referred to in

text: Article 138

text: a(6) of the Proposal; 2) to recall, by way of a recital, the need to ensure appropriate safeguards for international transfers of personal data. Brussels, 25 June 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7


text: OJ L 295, 21.11.2018, p. 39. 2 COM(2025) 282 final and COM(2025) 279 final. 3 See COM(2025) 282 final and COM(2025) 279 final, Annex,

text: Article 1(1)

text: and (2). 4 OJ L, 2024/948, 25.3.2024. See COM(2025) 282 final and COM(2025) 279 final, Explanatory Memorandum, p. 3. 4

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1. 7

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89–131. 8

text: Directive (EU) 2016/681

text: of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, OJ L 119, 4.5.2016, p. 132– 149. 9 Opinion 1/15 of the Court of Justice (Grand Chamber) of 26 July 2017, EU:C:2017:592. 10 Judgment of the Court of Justice (Grand Chamber) of 21 June 2022 “Ligue des droits humains”,

text: , EU:C:2022:491. 11 See https://www.icao.int/safety/airnavigation/nationalitymarks/annexes_booklet_en.pdf 12 OJ L 176, 10.7.1999, p. 36. 5

text: See COM(2025) 282 final and COM(2025) 279 final, Explanatory Memorandum, p. 2 and 3. 14 Opinion 45/2023 on the negotiating mandate for an Agreement between the EU and Norway on the transfer of Passenger Name Record data, issued on 30 October 2023. 15

text: Regulation (EU) 2025/13

text: of the European Parliament and of the Council of 19 December 2024 on the collection and transfer of advance passenger information for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, and amending

text: Regulation (EU) 2019/818

text: , OJ L, 2025/13, 8.1.2025. 16 EDPS Opinion 6/2023 on the Proposals for Regulations on the collection and transfer of advance passenger information (API), issued on 8 February 2023. 6

identifier: EDPS yttrande 16/2025

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 16/2025 on the signing and conclusion of an Agreement between the EU and Norway on the transfer of Passenger Name Record data

serie: yttranden

text: Opinion 16/2025

type: rubrik

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposals for Council Decisions on the signing and on the conclusion, on behalf of the European Union, of the Agreement between the European Union and the Kingdom of Norway on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime.

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 12 June 2025, the European Commission issued two Proposals for Council Decisions on the signing and on the conclusion, on behalf of the European Union, of the Agreement between the European Union and the Kingdom of Norway on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. The aim of the draft Agreement is to enable the transfer of Passenger Name Record (PNR) data by air carriers from the Union to Norway and to lay down rules and conditions subject to which those PNR data may be processed by Norway as well as to enhance police and judicial cooperation between the Union and Norway in respect of PNR data.

text: In the Opinion, the EDPS recalls the specific legal situation of Norway as a Schengen associated country. Pursuant to the Schengen Association Agreement between the EU and Norway of 1999, Norway is bound by the Union acts which constitute a development of the provisions of the Schengen acquis. As a result, Norway is supposed to apply the

text: Directive (EU) 2016/680

text: in a similar manner as EU Member States. In addition, as member of the European Economic Area, Norway is not considered as a third country within the meaning of Chapter V of the GDPR. However, the EU PNR Directive does not constitute a development of the provisions of the Schengen acquis and therefore Norway is not bound by its provisions. Consequently, the Agreement between the EU and Norway must adduce all the appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU.

text: Following his assessment of the draft Agreement, including the implementation of his previous specific recommendations on the negotiating mandate, the EDPS concludes that the draft Agreement between the European Union and the Kingdom of Norway on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime contains the necessary safeguards required in order for it to be compatible with the EU legal framework on data protection.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 12 June 2025 the European Commission issued two Proposals for Council Decisions on the signing and on the conclusion, on behalf of the European Union, of the Agreement between the European Union and the Kingdom of Norway on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (‘the Proposals’).

text: 2. The aim of the draft Agreement is to enable the transfer of Passenger Name Record (PNR) data by air carriers from the Union to Norway and to lay down rules and conditions subject to which those PNR data may be processed by Norway, as well as to enhance police and judicial cooperation between the Union and Norway in respect of PNR data .

text: 3. The negotiations on a PNR Agreement with Norway, as well as with two other Schengen associated countries - Iceland and the Swiss Confederation, began on 21 March 2024, in accordance with the negotiating mandate adopted by the Council on 4 March 2024 . On 9 April 2025, the EU and Norway negotiators initialled the text of the draft Agreement and thus formally concluded negotiations .

text: 4. The present Opinion of the EDPS is issued in response to two consultations by the European Commission of 12 June 2025, pursuant to Article 42(1) of EUDPR. Bearing in mind that both Proposals concern the same draft Agreement, the present Opinion covers both of them. The EDPS welcomes the reference to this consultation in Recitals 6 of the Proposals.

text: 2. General remarks

text: 5. PNR data is information provided by passengers, and collected by and held in the air carriers’ reservation and departure control systems for their own commercial purposes. While useful for combating terrorism and serious crime, the transfer of PNR data to third countries and the subsequent processing by their authorities constitutes an interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter of Fundamental Rights (the Charter). For this reason, it requires a legal basis under EU law and must be necessary, proportionate and subject to strict limitations and effective safeguards.

text: 6. In addition to the Charter, the applicable legal rules in case of transfer and processing of PNR data, include also the horizontal EU legal framework on data protection, namely

text: Regulation (EU) 2016/679

text: (the GDPR) and

text: Directive (EU) 2016/680

text: (the Law Enforcement 7 8 Directive) , as well as the specific

text: Directive (EU) 2016/681

text: (the EU PNR Directive) .

text: 7. Furthermore, the Court of Justice of the EU (CJEU) on two occasions interpreted the legal framework on PNR and provided guidance as regards proportionality and the necessity of PNR data processing, namely in Opinion 1/15 of 26 July 2017 and Judgment in Case C- 817/2019 of 21 June 2022 . The requirements laid down by the CJEU in the cited case law constitute an important point of reference for the assessment of any EU agreement on the transfer of PNR data, including the one at hand.

text: 8. The EDPS also recalls that, in addition to the Union legislation, PNR data is subject to international rules and standards. The United Nations Security Council Resolution 2396 (2017) on threats to international peace and security caused by returning foreign terrorist fighters, adopted on 21 December 2017, and the subsequent UN Security Council Resolution 2482 (2019) of 19 July 2019 called on UN Member States to develop the capability to collect and use PNR data, based on Standards and Recommended Practices on PNR (SARPs) of the International Civil Aviation Organization (ICAO) from 2020, adopted by means of Amendment 28 to Annex 9 to the Convention on International Civil Aviation (Chicago Convention) . All EU Member States, as well as Norway, are Parties to the Chicago Convention.

text: 9. An important legal aspect to be noted, which is also expressly highlighted in the Proposals, is the legal situation of Norway as a Schengen associated country as regards the application of the Union legal framework on data protection. Firstly, Norway is not considered a third country within the meaning of Chapter V of Regulation 2016/679 since the GDPR has been incorporated with adaptations in Annex XI to the European Economic Area (EEA) Agreement. Secondly, pursuant to Article 8 of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the latters' association with the implementation, application and development of the Schengen acquis of 1999 , Norway is bound by the Union acts which constitute a development of the provisions of the Schengen acquis, including

text: Directive (EU) 2016/680

text: , in a similar manner as EU Member States.

text: 10. However, the EU PNR Directive does not constitute a development of the Schengen acquis, hence Norway does not participate in the implementation of this legal instrument . Therefore, the Agreement between the EU and Norway must adduce all the appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU.

text: 11. The EDPS has already issued in 2023 an Opinion on the negotiating mandate for an Agreement between the EU and Norway on the transfer of PNR data . In his Opinion, the EDPS made two specific recommendations: - to align the definition of sensitive data in the future Agreement with the definitions of special categories of data in Article 9(1) of GDPR and

text: Article 10 of Directive (EU) 2016/680

text: ; and - to provide for in the Agreement the legal possibilities to suspend it in case of breaches of its provisions, as well as to terminate it if the non-compliance is serious and persistent.

text: 12. The EDPS notes with satisfaction that these recommendations have been taken into account during the negotiations and are subsequently reflected in the final text of the Agreement, as follows: - Article 8 of the draft Agreement provides for a prohibition to process special categories of PNR data in line with how this concept has been defined in the EU data protection acquis; - Article 20 of the draft Agreement provides for a suspension mechanisms and

text: Article 21

text: provides for the possibility for either Party to terminate the Agreement at any time.

text: 3. Use of the API-PNR router

text: 13. The EDPS notes that Article 4 of the draft Agreement provides for the possibility for Norway to make use of the API-PNR router established with

text: Regulation (EU) 2025/13

text: , as envisaged by

text: Article 10

text: (c) of that Regulation, which has not been included in the negotiating directives.

text: 14. The EDPS recalls that he has issued an Opinion on the proposals for the so-called API Regulations , which were subsequently adopted as

text: Regulation (EU) 2025/12

text: and

text: Regulation (EU) 2025/13

text: , where he commented, among others, on the router.

text: 15. In view of the fact that Norway is a Schengen associated country with direct access to the EU large-scale IT systems in the area of justice and home affairs, the EDPS considers the possible use of a common technical solution for the exchange of PNR data as appropriate. In this context, the EDPS welcomes the provision of

text: Article 4(1)

text: (b) of the draft Agreement, which explicitly clarifies that Norway would be bound by the rules on the functioning and the conditions for the use of the API-PNR router, as established by API Regulations, if it decides to use this common technical solution.

text: 4. Access to PNR data by Europol and Eurojust

text: 16. The EDPS notes that according to Article 15 of the draft Agreement, Norway will share with Europol or Eurojust, within the scope of their respective mandates, the results of processing of PNR data, or analytical information based on PNR data, in specific cases where necessary to prevent, detect, investigate, or prosecute terrorist offences or serious crime. Such exchange may be carried out on its own initiative or at the request of the Union Agencies.

text: 17. In this context, the EDPS reminds that, in as far as the data concerns extra-EU flights between the EU and Norway, this information is already processed under the EU PNR Directive by the Member States' Passenger Information Units (PIU). The EU PNR Directive does not foresee direct access to this data for Eurojust, and strictly defines the conditions under which Europol is able to access it.

text: 18. In view of the above, it is the understanding of the EDPS that regarding Europol or Eurojust, the condition “within the scope of their respective mandates” refers not only to the tasks and powers of the two Agencies provided for in the EU regulations establishing them but also the specific rules laid down in the EU PNR Directive. Consequently, the EU-Norway PNR Agreement should not lead to situations where Union Agencies request PNR data from Norway which they would not be able to request from an EU Member State.

text: 5. Conclusions

text: 19. In light of the above, the EDPS concludes that the draft Agreement between the European Union and the Kingdom of Norway on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime contains the necessary safeguards required in order for it to be compatible with the EU legal framework on data protection. Brussels, 24 July 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7

type: vagledning

utgivare: edps


text: COM(2026) 313 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2026) 313 final, p. 1. 4 Opinion of the European Data Protection Supervisor on the initiative of the Kingdom of Belgium, the Republic of Bulgaria, the Republic of Estonia, the Kingdom of Spain, the French Republic, the Italian Republic, the Republic of Hungary, the Republic of Poland, the Portuguese Republic, Romania, the Republic of Finland and the Kingdom of Sweden for a Directive of the European Parliament and of the Council on the European Protection Order, and on the initiative of the Kingdom of Belgium, the Republic of Bulgaria, the Republic of Estonia, the Kingdom of Spain, the Republic of Austria, the Republic of Slovenia and the Kingdom of Sweden for a Directive of the European Parliament and of the Council regarding the European Investigation Order in criminal matters, issued on 29 December 2010. 4

text: Directive

text: of the European Parliament and of the Council of 3 April 2014 regarding the European Investigation Order in criminal matters (OJ L 130, 1.5.2014, p. 1). See Recital 5 of the Proposal. 7 See also Recital 74 of the Proposal. 5

text: Recital 75 of the Proposal. 9

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89). 10 See

text: Article 5

text: , points (b), (c) and, in connection to such proceedings, point (d) of the Proposal. 11

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1). 12

text: Regulation (EU) 2018/1727

text: of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council Decision 2002/187/JHA (OJ L 295, 21.11.2018, pp. 138). 13

text: Council Regulation (EU) 2017/1939 of 12 October 2017

text: implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’) (OJ L 283, 31.10.2017, pp. 1). 14 See also COM(2026) 314 final, p. 3 and Article 2(2) of the Proposal to amend

text: Regulation (EU) 2018/1725

text: . 6

text: See also EDPS Guidance for co-legislators on key elements of legislative proposals, issued on 7 May 2025, para 27. 16

text: Regulation (EU) 2023/2844

text: of the European Parliament and of the Council of 13 December 2023 on the digitalisation of judicial cooperation and access to justice in cross-border civil, commercial and criminal matters, and amending certain acts in the field of judicial cooperation, OJ L, 2023/2844, 27.12.2023, ELI: http://data.europa.eu/eli/reg/2023/2844/oj. 17 The scope of the draft Directive is broader, however, as it also concerns the collection, use and even transfers to third countries and international organisations which does not fall under

text: Regulation (EU) 2023/2844

text: . 18 See

text: Article 2(1) of Regulation (EU) 2023/2844

text: . 19 See also EDPS Guidance for co-legislators on key elements of legislative proposals, issued on 7 May 2025, para 28-35. 20 See Art. 5(1)(c) GDPR as well as 4(1)(c) of LED and EUDPR. 21 Similarly as done in

text: Article 33(4)

text: (b) of the Proposal. 7

identifier: EDPS yttrande 16/2026

title: EDPS Opinion 16/2026 on the Proposal for a Directive regarding the European Investigation Order in criminal matters and the European Remote Participation Order (recast)

text: Opinion 16/2026

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Directive of the European Parliament and of the Council regarding the European Investigation Order in criminal matters and the European Remote Participation Order (recast) . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 23 June 2026, the European Commission adopted a Proposal for a Directive of the European Parliament and of the Council regarding the European Investigation Order in criminal matters and the European Remote Participation Order (recast).

text: The objective of the Proposal is to improve legal clarity and operational effectiveness in the crossborder gathering of evidence in the EU by addressing targeted deficiencies identified in the application of the current Directive. It also aims to draw up common rules for requesting assistance to make it easier for suspects, accused persons and victims to participate remotely in criminal court hearings from another Member State.

text: The EDPS supports the efforts to devise and refine the models of co-operation between the competent authorities and to address the shortcomings identified in the application of the EIO Directive thus far. To ensure an appropriate level of data protection, the EDPS makes several recommendations to clarify the applicable legal framework, the roles of the actors who may be involved in processing of personal data under the Proposal, and when personal data should be deleted in case of refusal of the European Investigation Order (‘EIO’).

text: In particular, the EDPS recommends clarifying the roles of the actors who may be involved in processing of personal data under the Proposal in the enacting terms of the Proposal, taking into account

text: Regulation (EU) 2023/2844

text: . In addition, the Proposal should specify that personal data obtained prior to the decision refusing the recognition or execution of an EIO should be deleted immediately, unless it is strictly necessary to prevent an immediate and serious threat to public security. Finally, the Proposal should expressly clarify that any means of transmission should also ensure an adequate level of security of the communicated personal data.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 23 June 2026, the European Commission adopted a Proposal for a Directive of the European Parliament and of the Council regarding the European Investigation Order in criminal matters and the European Remote Participation Order (recast) (‘the Proposal’).

text: 2. The objective of the Proposal is to improve legal clarity and operational effectiveness in the cross-border gathering of evidence in the EU by addressing targeted deficiencies identified in the application of the current Directive. It also aims to draw up common rules for requesting assistance to make it easier for suspects, accused persons and victims to participate remotely in criminal court hearings from another Member State.

text: 3. The EDPS has previously issued an Opinion on the initiative for a Directive of the European Parliament and of the Council regarding the European Investigation Order in criminal matters .

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 23 June 2026, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 78 of the Proposal. The EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 5. Directive

text: (‘the EIO Directive’) established the European Investigation Order (‘EIO’) as an instrument for cross-border gathering of evidence in criminal matters. The Directive was a response to a well-identified practical need for a comprehensive framework, based on mutual recognition, for obtaining evidence in cases with a crossborder dimension .

text: 6. The EDPS is aware that criminal activities are becoming increasingly a global and, in the great majority of the cases, cross-border phenomenon, thus requiring close cooperation between authorities in different countries. Effective cross-border judicial cooperation in criminal matters plays a vital role in enabling the collection and transfer of evidence across national boundaries, strengthening criminal investigations and prosecutions, and enhancing the capacity of the European Union and its Member States to counter these threats effectively. The EDPS therefore supports the efforts to further improve and refine the models of co-operation between the competent authorities in the EU and welcomes the aim of the Proposal to address the shortcomings identified in the application of the EIO Directive thus far, in order to contribute to a more efficient judicial cooperation and enhance mutual trust between Member States.

text: 7. The EDPS notes that the EIO is to be issued for the purpose of having one or more specific investigative measure(s) carried out in the executing Member State with a view of gathering evidence (potentially not in existence when the order is issued) and transferring it to the requesting Member State. Evidence collected by way of an EIO will typically contain personal data such as information on bank and other financial accounts (

text: Article 26

text: ), information on banking and other financial operations (

text: Article 27

text: ), real time geolocation, audio or visual data (

text: Article 28

text: ), telecommunications data (

text: Article 31

text: ) etc. For these reasons the Proposal has a significant impact on the lives of the individuals concerned and their rights to privacy and to the protection of personal data.

text: 8. The EDPS recalls that any interference with the fundamental rights to privacy and data protection guaranteed by Articles 7 and 8 of the Charter of Fundamental Rights of the EU (the ‘Charter’), must fulfil the requirements of Article 52(1) of the Charter. In that regard the EDPS positively notes that Article 1(2) of the Proposal states that “this Directive shall not have the effect of modifying the obligation to respect the fundamental rights and legal principles as enshrined in Article 6 of the TEU” .

text: 9. This Opinion focuses on the provisions of the Proposal that are specifically relevant from a data protection perspective, with the aim to provide constructive and objective advice with a view of ensuring the appropriate level of data protection, as guaranteed by the Charter.

text: 3. Data protection legislative framework

text: 10. As one of EU fundamental rights is the right to data protection, the EDPS welcomes the insertion of a dedicated recital reminding that the processing of personal data under the EIO Directive must comply with

text: Directive (EU) 2016/680

text: (‘LED’), or in certain, limited 10 11 cases , with

text: Regulation (EU) 2016/679

text: (‘GDPR’), as well as EUDPR and Regulation (EU) 12 13 2018/1727 for Eurojust and EUDPR and

text: Regulation (EU) 2017/1939

text: for the European Public Prosecutor’s Office (‘EPPO’).

text: 11. The EDPS notes that for the EPPO the recital mentions that “As regards the processing of personal data by the European Public Prosecutor’s Office,

text: Regulation (EU) 2018/1725

text: should apply as of the date of the entry into force of the amendments to

text: Regulation (EU) 2017/1939

text: ”. The EDPS understands that this wording anticipates the forthcoming revision of the EPPO founding act

text: Regulation (EU) 2017/1939

text: . However, in the interest of legal clarity, as there could possibly be additional amendments of the Regulation at some point in the future, the EDPS suggests clarifying explicitly in the recital which amendments it refers to.

text: 12. The EDPS also welcomes the clear ground for refusal, in

text: Article 21(5)

text: (c) of the Proposal, for consent to an onward transfer of personal data to a third country or an international organisation, in case the transfer would not comply with the conditions laid down in Chapter V of the GDPR or the LED.

text: 4. Roles and responsibilities

text: 13. The EDPS welcomes that recital 75 of the Proposal aims to clarify the roles of the different actors who may be involved in processing of personal data under the Proposal. Ensuring clarity of the role of each actor involved in the processing of personal data is important to promote transparency of processing and the effective exercise of data subject rights. Moreover, it is key to enable a determination of who will be responsible for what. Determining the role of controller from the outset also helps to avoid any possible problems of interpretation in assessing that role.

text: 14. Therefore, the EDPS considers that the designation of an entity as controller, joint controller or processor should take place in the enacting terms (operative text) of the Proposal rather than in the recitals accompanying them .

text: 15. The EDPS also recalls that, where transmission takes place using the decentralised IT system, as defined in

text: Article 2

text: , point (3) of

text: Regulation (EU) 2023/2844

text: , the roles of the competent authorities and of the Commission have already been specified in

text: Article 14 of Regulation (EU) 2023/2844

text: . Under that Regulation, “central authorities” are considered as “competent authorities” and are designated as controllers (and not as processors). Recital 75 of the Proposal, on the other hand, indicates that central authorities may also act as processors when processing personal data on behalf of competent authorities.

text: 16. While it is not excluded that a central authority may also act as a processor in the context of the Proposal, the relationship between the roles as defined by the Proposal and the roles already specified under

text: Regulation (EU) 2023/2844

text: should be clear and coherent.

text: 17. Finally, the EDPS recalls that any relationship between (joint) controllers and processors must be governed by appropriate legal arrangements .

text: 5. Deletion of data in case of refusal of EIO

text: 18. Under the principle of data minimisation, personal data which is processed must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed .

text: 19. Pursuant to Article 13(5) of the Proposal, provisional execution of a measure referred to in paragraph 4, point (c), shall cease where the recognition or execution of the EIO is refused. Any material (including personal data) obtained may be used only where strictly necessary to prevent an immediate and serious threat to public security.

text: Article 30(6)

text: (f) provides for the same solution in case of the refusal of recognition or execution of the EIO regarding cross-border surveillance.

text: 20. While fully supporting the strict limitation of the use of any material (including personal data) obtained before the decision on the refusal is made, the EDPS recommends clarifying in Articles

text: and

text: (f) of the Proposal that the material obtained prior to the decision refusing the recognition or execution of the EIO should be deleted, unless it is strictly necessary to prevent an immediate and serious threat to public security .

text: 6. Means of communication

text: 21. The EDPS notes that Article 51(2) of the Proposal provides for the possibility of certain communication to take place “by the swiftest and most appropriate means of transmission”. However, the provision does not expressly require that such means of transmission meet any specific security requirements. As this communication may also contain personal data, the EDPS considers that these “appropriate means of transmission” should ensure an adequate level of security of the communicated personal data and recommends clarifying that the means of transmission must also be secure.

text: 7. Statistics

text: 22. The EDPS notes that Article 55 of the Proposal obliges Member States to collect comprehensive statistics to allow the Commission to monitor the application of the EIO Directive.

text: 23. In that regard, the EDPS welcomes that, in line with the data minimisation, the provision expressly indicates that the statistics transmitted to the Commission must be limited to aggregated data and must not contain personal data.

text: 8. Conclusions

text: 24. In light of the above, the EDPS makes the following recommendations: (1) to clarify in Recital 75 to which amendments to

text: Regulation (EU) 2017/1939

text: it refers; (2) to specify in the enacting terms (operative text) of the Proposal the roles of the actors who may be involved in processing of personal data under the Proposal (as controller, joint controller or processor), taking into account

text: Regulation (EU) 2023/2844

text: ; (3) to clarify in Articles

text: and

text: (f) that in cases where the personal data obtained prior to the decision refusing the recognition or execution of the EIO may not be used, such data should immediately be deleted; (4) to clarify in

text: Article 51(2)

text: that “appropriate means of transmission” should ensure an adequate level of security of the communicated personal data. Brussels, 10 August 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8


text: OJ L 295, 21.11.2018, p. 39. 2 COM(2022) 336 final, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52022PC0336&from=FR. 3 Agreement between the European Union and Japan for an Economic Partnership, OJ L 330, 27.12.2018, p. 3. 4 Recital 2 to the Recommendation. 4

text: EDPS Opinion 03/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, issued on 22 February 2021, paragraph 14. Commission Implementing Decision

text: (EU) 2019/419

text: of 23 January 2019 pursuant to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information (Text with EEA relevance), OJ L 76, 19.3.2019, p. 1. 7

text: Article 45(1)

text: GDPR and Recital 5 of the Adequacy Decision. 8 Recitals 3 and 4 to the Recommendation offer limited clarification in this regard. 9 https://trade.ec.europa.eu/doclib/docs/2018/july/tradoc_157130.pdf. 5

text: EDPS Opinion 03/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, issued on 22 February 2021, paragraphs 15. 11 EDPS Opinion 03/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, issued on 22 February 2021, paragraphs 16- 22 and 38. 12 EDPB-EDPS Joint Opinion 03/2022 on the Recommendation for a Regulation on the European Health Data Space, issued on 12 July 2022, paragraph 111. 6

identifier: EDPS yttrande 17/2022

title: Cross-border data flows in the Agreement between the EU and Japan for an Economic Partnership

text: 9 August 2022

text: Opinion 17/2022

text: on the Recommendation for a Council Decision authorising the opening of negotiations for the inclusion of provisions on cross-border data flows in the Agreement between the European Union and Japan for an Economic Partnership

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Commission Recommendation for a Council Decision authorising the opening of negotiations for the inclusion of provisions on cross-border data flows in the Agreement between the European Union and Japan for an Economic Partnership. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Recommendation that are relevant from a data protection perspective.

text: Executive Summary

text: On 12 July 2022, the Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for the inclusion of provisions on cross-border data flows in the Agreement between the European Union and Japan for an Economic Partnership.

text: The Agreement for an Economic Partnership between the European Union and Japan was signed on 17 July 2018. The objective of this Agreement is, in particular, to remove the vast majority of duties paid by EU and Japanese companies and other technical and regulatory trade barriers.

text: On 23 January 2019, Japan was granted an adequacy finding by the Commission. Consequently, transfers of personal data from a controller or a processor in the European Economic Area (EEA) to organisations in Japan covered by the adequacy decision may take place without the need to obtain any further authorisation.

text: The EDPS takes note that the negotiations would exclusively concern cross-border data flows. Having regard to the fact that Japan has already been granted an adequacy finding by the Commission in 2019, the EDPS recommends detailing the reasons why, despite this adequacy decision, further negotiations on cross-border data flows are considered necessary.

text: The EPDS welcomes the specification that the provisions on cross-border data flows should be coherent with the horizontal provisions for cross-border data flows and personal data protection in trade negotiations. The horizontal provisions, published by the Commission in July 2018, represent a balanced compromise between public and private interests as they allow the EU to tackle protectionist practices in third countries in relation to digital trade, while ensuring that trade agreements cannot be used to challenge the high level of protection guaranteed by the Charter of fundamental rights of the EU and the EU legislation on the protection of personal data.

text: The EDPS understands the negotiating directives and the horizontal provisions as allowing, in duly justified cases, measures that would require controllers or processors to store personal data in the EU/EEA. The EDPS recalls that, together with the EDPB, he recently recommended that controllers and processors, established in the EU/EEA and processing personal electronic health data within the scope of the Commission’s proposal for a Regulation on the European Health Data Space, should be required to store this data in the EU/EEA, without prejudice to the possibility to transfer personal electronic health data in compliance with Chapter V GDPR. For the avoidance of doubt, the EDPS recommends to expressly clarify in the negotiating directives that the negotiated rules should not prevent the EU or the Member States from adopting, in duly justified cases, measures that would require controllers or processors to store personal data in the EU/EEA.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 12 July 2022, the European Commission (‘the Commission’) issued a Recommendation for a Council Decision authorising the opening of negotiations for the inclusion of provisions on cross-border data flows in the Agreement between the European Union and Japan for an Economic Partnership (‘the Recommendation’).

text: 2. By decision of 29 November 2012, the Council approved negotiating directives for the Commission to negotiate a free trade agreement with Japan, on the basis of which the Commission negotiated the Agreement between the European Union and Japan for an Economic Partnership, signed on 17 July 2018 (‘the Agreement’). The Agreement entered into force on 1 February 2019. The objective of the Agreement is, in particular, to remove the vast majority of duties paid by EU and Japanese companies and other technical and regulatory trade barriers.

text: 3. Chapter 8 of the Agreement contains provisions on trade in services, investment liberalisation and electronic commerce. Article 8.81 of the Agreement, which relates to the free flow of data, provides that '[t]he Parties shall reassess within three years of the date of entry into force of this Agreement the need for inclusion of provisions on the free flow of data into this Agreement’. In its meeting of 25 March 2022, the Joint Committee established by Article 22.1 of the Agreement examined whether the economic partnership between the European Union and Japan would benefit from the inclusion of provisions on cross-border data flows in the Agreement. Building on that examination, the representatives of the European Union and Japan, at the 28th EU-Japan summit (in May 2022), committed to consider the launch of the negotiations needed for such inclusion .

text: 4. As made clear by its title, the objective of the Recommendation is to authorise the Commission to open negotiations with Japan with the view to include provisions on data flows into the Agreement.

text: 2. General remarks

text: 6. The EDPS has long taken the view that, as the protection of personal data is a fundamental right in the Union, it cannot be subject to negotiations in the context of EU trade agreements. It is for the EU alone to decide how to implement fundamental rights protections in Union law. The Union cannot and should not embark on any international trade commitments that are incompatible with its domestic data protection legislation. Dialogues on data protection and trade negotiations with third countries can complement each other but must follow separate tracks. Personal data flows between the EU and third countries should be enabled by using the mechanisms provided under the EU data protection legislation .

text: 7. In this regard, the EDPS positively notes that Japan has already been granted an adequacy finding by the Commission on 23 January 2019 (‘the Adequacy Decision) . Consequently, transfers of personal data from a controller or a processor in the European Economic Area (EEA) to organisations in Japan covered by the Adequacy Decision may take place without the need to obtain any further authorisation .

text: 8. In this context, the EDPS takes note that the negotiating directives, included in the annex to the Recommendation, clarify that the provisions, to be negotiated and included in the Agreement, will ‘exclusively concern cross-border data flows between the European Union and Japan’ (emphasis added). In view of the Adequacy Decision, the need for having additional rules covering cross-border data flows should be expressed in more detail so that the justification for an amendment of the Agreement is made clearer . In other words, the EDPS recommends to further explain why, despite the Adequacy Decision, further negotiations on cross-border data flows are considered to be necessary.

text: 3. Horizontal provisions on cross-border data flows

text: 9. On 31 January 2018, the European Commission endorsed horizontal provisions for crossborder data flows and personal data protection in trade negotiations (‘the Horizontal Provisions’), which were published in July 2018 .

text: 10. The EDPS recalls that he supports the legal wording of the Horizontal Provisions as the best outcome achievable to preserve individual’s fundamental rights to data protection and privacy. The Horizontal Provisions reach a balanced compromise between public and private interests as they allow the EU to tackle protectionist practices in third countries in relation to digital trade, while ensuring that trade agreements cannot be used to challenge the high level of protection guaranteed by the Charter of fundamental rights of the EU and the EU legislation on the protection of personal data .

text: 11. In his Opinion 3/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, the EDPS recommended that the wording agreed with the UK on data protection and privacy (which modified the Horizontal Provisions) remained an exception and would not be the basis for future trade agreements with other third countries .

text: 12. Therefore, the EDPS welcomes Recital 4 to the Recommendation, which confirms that the negotiations would be opened ‘with a view to include the provisions on data flows into the

text: Agreement, coherent with the horizontal provisions for cross-border data flows and personal data protection in trade negotiations’ (emphasis added).

text: 13. The negotiating directives, included in the annex to the Recommendation, recall that the negotiated rules should not prevent the European Union and its Member States from regulating economic activity in the public interest and to achieve legitimate public policy objectives, including the protection of privacy and data protection. The directives also reiterate that the negotiations should not affect the EU’s personal data protection rules and should be in line with the EU legal framework.

text: 14. The EDPS welcomes the directives, which are in line with Article 2(2) of the Horizontal Provisions, according to which ‘[e]ach Party may adopt and maintain the safeguards it deems appropriate to ensure the protection of personal data and privacy, including through the adoption and application of rules for the cross-border transfer of personal data. Nothing in this agreement shall affect the protection of personal data and privacy afforded by the Parties’ respective safeguards.’

text: 15. The EDPS understands the negotiating directives and the Horizontal Provisions as allowing, in duly justified cases, measures that would require controllers or processors to store personal data in the EU/EEA. The EDPS recalls that, together with the EDPB, he recently recommended the co-legislators to require that controllers and processors, established in the EU/EEA and processing personal electronic health data within the scope of the Commission’s proposal for a Regulation on the European Health Data Space, should be required to store this data in the EU/EEA, without prejudice to the possibility to transfer personal electronic health data in compliance with Chapter V GDPR . For the avoidance of doubt, the EDPS recommends to expressly clarify in the negotiating directives that the negotiated rules should not prevent the EU or the Member States from adopting, in duly justified cases, measures that would require controllers or processors to store personal data in the EU/EEA.

text: 4. Reference to this Opinion

text: 16. The EDPS notes that the Recommendation does not refer to the EDPS consultation. Therefore, the EDPS recommends inserting a reference to the EDPS consultation in a recital.

text: 5. Conclusions

text: 17. In light of the above, the EDPS makes the following recommendations: (1) to detail in a recital the reasons why, despite the Adequacy Decision, further negotiations on cross-border data flows are considered to be necessary; (2) to clarify, in the negotiating directives included in the annex to the Recommendation, that the negotiated rules should not prevent the EU or the Member States from imposing on controllers and processors, in duly justified cases, to store personal data in the EU/EEA; and (3) to refer to the EDPS consultation in a recital. Brussels, 9 August 2022 P.O. Leonardo CERVERA NAVAS [e-signed] Wojciech Rafał WIEWIÓROWSKI 7


text: COM(2023) 133 final 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 133 final. 4 See page 2 of the Explanatory Memorandum to the Proposal. 5 European Union Serious and Organised Crime Threat Assessment: A corrupt Influence: The infiltration and undermining of Europe’s economy and society by organised crime. Europol and the global cocaine trade, available at https://www.emcdda.europa.eu/publications/eu-drug-markets/cocaine/europeand-global-cocaine-trade_en. 7 Europol and the global cocaine trade, available at https://www.emcdda.europa.eu/publications/eu-drug-markets/cocaine/europeand-global-cocaine-trade_en.

text: EU Drug Market: Cocaine, p.10, available at EU Drug Market: Cocaine | www.emcdda.europa.eu. 9 EU Drug Market: Cocaine, p. 19, available at EU Drug Market: Cocaine | www.emcdda.europa.eu. 10 Explanatory memorandum, p. 2. 11 idem. 12

text: Regulation (EU) 2016/794

text: of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA, OJ L 135, 24.5.2016, p. 53. 13 See EDPS Opinion 2/2018 on eight negotiating mandates to conclude international agreements allowing the exchange of data between Europol and third countries, adopted on 14 March 2018, https://edps.europa.eu/sites/edp/files/publication/18-03- 19_opinion_international_agreements_europol_en.pdf and EDPS Opinion 1/2020 on the negotiating mandate to conclude an international agreement on the exchange of personal data between Europol and New Zealand law enforcement authorities, issued on 31 January 2020 https://edps.europa.eu/sites/default/files/publication/20-01-31_opinion_recommendation_europol_en.docx.pdf

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89. 15 See Judgment of the Court of Justice of 30 April 1974,

text: Case C-181/73

text: , R. & V. Haegeman a.o., ECLI:EU:C:1974:41, par. 5. 16 See Judgment of the Court of Justice of 3 June 2008,

text: Case C-308/06

text: , Intertanko a.o., ECLI:EU:C:2008:312, par. 42. 17 See Judgment of the Court of Justice of 3 September 2008, joined cases

text: P and

text: P, Kadi a.o., ECLI:EU:C:2008:461, par. 285. 18 For further details see the EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data.

text: See Judgment of the Court of Justice of 8 April 2014, joined cases

text: and

text: , Digital Rights Ireland Ltd, ECLI:EU:C:2014:238, paragraph 52.. 20

text: Regulation (EU) 2022/991

text: of the European Parliament and of the Council of 8 June 2022 amending

text: Regulation (EU) 2016/794

text: , as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role in research and innovation, OJ L 169, 27.6.2022, p. 1. 21 See

text: Articles 18

text: a(6) and 23(9) of the Europol Regulation. 8

text: See Opinion 1/15 of the Court of Justice of 26 July 2017, EU-Canada PNR Agreement, ECLI:EU:C:2017:592, paragraph 141. 23 Idem. 24

text: Article 5(1)

text: (f) GDPR and

text: Article 4(1)

text: (f) LED and EUDPR. 25 See Judgment of the Court of Justice of 8 April 2014, in joined cases

text: and

text: , Digital Rights Ireland Ltd, ECLI:EU:C:2014:238, paragraph 40. 10

text: See Judgment of the Court of Justice of 1 October 2015,

text: Case C-201/14

text: , Smaranda a.o., ECLI:EU:C:2015:638, in particular para. 32 and 33 where the Court found that “the requirement to inform the data subjects about the processing of their personal data is all the more important since it affects the exercise by the data subjects of their right of access to, and right to rectify, the data being processed, and their right to object to the processing of those data” and that “That information concerns the identity of the data controller, the purposes of the processing and any further information necessary to guarantee fair processing of the data”. 11

identifier: EDPS yttrande 17/2023

title: EDPS Opinion 17/2023 on the negotiating mandate to conclude an international agreement on the exchange of personal data between Europol and Peruvian law enforcement authorities

text: 3 May 2023

text: Opinion 17/2023

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Recommendation for a Council decision authorising the opening of negotiations for an agreement between the European Union and the Republic of Peru on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Peruvian authorities competent for fighting serious crime and terrorism .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Recommendation that are relevant from a data protection perspective.

text: Executive Summary

text: On 9 March 2023 the European Commission issued a Recommendation for a Council decision authorising the opening of negotiations for an agreement between the European Union and the Republic of Peru on the exchange of personal data between Europol and the Peruvian authorities competent for fighting serious crime and terrorism.

text: The objective of the Recommendation is to open negotiations with the Republic of Peru with the purpose of signing and concluding an international agreement enabling the exchange of personal data between Europol and the Peruvian authorities competent for fighting serious crime and terrorism. The Annex to the Recommendation lays down the Council’s negotiating directives to the Commission, i.e. the objectives the latter should aim to achieve on behalf of the EU in the course of these negotiations.

text: Transfers of personal data gathered in the context of criminal investigations and further processed by Europol to produce criminal intelligence are liable to have a significant impact on the lives of the individuals concerned. For that reason, the international agreement must ensure that the limitations to the rights to privacy and data protection in relation to the fight against serious crime and terrorism apply only in so far as is strictly necessary.

text: The EDPS positively notes that the Commission has established by now, based also on a number of the recommendations from the previous EDPS Opinions on this matter, a well-structured set of objectives (negotiating directives), incorporating fundamental data protection principles, which the Commission aims to achieve on behalf of the EU in the course of international negotiations to conclude agreements on the exchange of personal data between Europol and third country law enforcement authorities.

text: In this regard, the recommendations in this Opinion are aimed at clarifying and, where necessary, further developing the safeguards and controls in the future Agreement between the EU and the Republic of Peru with respect to the protection of personal data. In this context, the EDPS recommends that the future Agreement explicitly lays down the list of the criminal offences regarding which personal data could be exchanged; provides for a periodic review of the need for storage of the transferred personal data as well as other appropriate measures ensuring that the time limits are observed; adduces additional safeguards as regards the transfer of special categories of data; ensures that no automated decision based on the received data under the Agreement would take place without the possibility for a human being to intervene in an effective and meaningful way; lays down clear and detailed rules regarding the information that should be made available to the data subjects.

text: The EDPS recalls that, pursuant to Article 8(3) of the Charter, the control by an independent authority is an essential element of the right to the protection of personal data. The EDPS therefore recommends to the Commission to pay special attention, during the negotiations to the oversight by independent public bodies responsible for data protection with effective powers vis-a-vis the law enforcement and other competent authorities of the Republic of Peru that will use the transferred personal data. In addition, in order to ensure proper implementation of the Agreement,

text: the EDPS also suggests that the Parties exchange on a regular basis information on the exercise of rights by data subjects as well as relevant information about the use of the oversight and redress mechanisms related to the application of the Agreement.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 9 March 2023 the European Commission issued a Recommendation for a Council decision authorising the opening of negotiations for an agreement between the European Union and the Republic of Peru on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Peruvian authorities competent for fighting serious crime and terrorism (‘the Recommendation’). The Recommendation is accompanied by its respective Annex.

text: 2. The objective of the Recommendation is to open negotiations with the Republic of Peru (hereinafter ‘Peru’) with the purpose of signing and concluding an international agreement enabling the exchange of personal data between Europol and the Peruvian authorities competent for fighting serious crime and terrorism. The Annex to the Recommendation lays down the Council’s negotiating directives to the Commission, i.e. the objectives the latter should aim to achieve on behalf of the EU in the course of these negotiations.

text: 3. In the Explanatory Memorandum of the Recommendation the Commission assesses that Latin America’s organised crime groups pose a serious threat to the EU internal security as their actions are increasingly linked to a series of crimes within the Union, particularly in the realm of drug trafficking . The 2021 EU Serious and Organised Crime Threat Assessment (‘SOCTA’) by Europol highlights that unprecedented quantities of illicit drugs are trafficked to the EU from Latin America, generating multi-billion-euro profits, which are used to finance a diverse range of criminal organisations (international and EU-based) and to weaken the rule of law in the EU .

text: 4. Most of the drugs seized in the EU are transported by sea, primarily in maritime shipping containers , and shipped to the EU directly from the countries of production, including Peru, as well as from neighbouring countries of departure in Latin America . Peru is the 5 second largest coca-cultivating country globally, accounting for 26% of global cultivation . This fact has concrete consequences for the EU, as a third (32 %) of the total number of EU cocaine samples tested originated from Peru; an increase from the previous years .

text: 5. In its Programming Document 2022-2024, Europol has flagged that, among others, the growing demand for drugs and increased drug trafficking routes into the EU justify the need for enhanced cooperation with Latin American countries. In this sense, in December 2020, Peru was included in Europol’s list of priority partners with which the agency may conclude Working Arrangements .

text: 6. Peru has been identified as a key international partner to reduce the global supply of cocaine by the European Monitoring Centre for Drugs and Drug Addiction (EMCDDA) .

text: 7. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 9 March 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes that he has been consulted on the Recommendation and expects a reference to this Opinion to be included in the preamble of the Council Decision. In addition, the EDPS welcomes the reference, in Recital 4 of the Recommendation, to Recital 35 of the

text: Regulation (EU) 2016/794

text: (‘Europol Regulation’), which provides that the Commission should be able to consult the EDPS also during the negotiations of the Agreement and, in any event, before the Agreement is concluded.

text: 8. The EDPS recalls that he has already had the opportunity to comment in 2018 and in 2020 on the exchange of personal data between Europol and the law enforcement authorities of third countries on the basis of Europol Regulation .

text: 9. The EDPS positively notes that the Commission has established by now, based also on a number of the recommendations from the previous EDPS Opinions on this matter, a wellstructured set of objectives (negotiating directives), incorporating fundamental data protection principles, which the Commission aims to achieve on behalf of the EU in the course of international negotiations to conclude agreements on the exchange of personal data between Europol and third country law enforcement authorities.

text: 10. In this context, the recommendations in this Opinion are aimed at clarifying and, where necessary, further developing the safeguards and controls in the future Agreement between the EU and Peru with respect to the protection of personal data. They are without prejudice to any additional recommendations that the EDPS could make on the basis of further available information and the provisions of the draft agreement during the negotiations. 6

text: 2. General remarks

text: 11. The Europol Regulation lays down specific rules regarding transfers of data by Europol outside of the EU.

text: Article 25(1)

text: thereof lists a number of legal grounds based on which Europol could lawfully transfer data to authorities of third countries. One possibility would be an adequacy decision of the Commission in accordance with

text: Article 36 of Directive (EU) 2016/680

text: (‘LED’) finding that the third country to which Europol transfers data ensures an adequate level of protection. Since there is no such adequacy decision for Peru at the moment, the other alternative for Europol to regularly transfer data would be the conclusion of a binding international agreement between the EU and the Republic of Peru, adducing adequate safeguards with respect to the protection of privacy and other fundamental rights and freedoms of individuals.

text: 12. Pursuant to

text: Article 216(2)

text: TFEU, international agreements concluded by the European Union ‛are binding upon the institutions of the Union and on the Member States’. Moreover, according to the settled case law of the Court of Justice of the European Union (‛CJEU’), international agreements become from their coming into force ‛an integral part of 15 16 Community law’ , and they have primacy over acts of secondary Union legislation .

text: 13. Since the proposed Agreement would be a binding international instrument, the EDPS notes that, in line with the case law of the CJEU, the ‛obligations imposed by an international agreement cannot have the effect of prejudicing the constitutional principles of the EC Treaty, which include the principle that all Community acts must respect fundamental rights, that respect constituting a condition of their lawfulness’ . It is therefore essential to ensure that the obligations stemming from the Agreement would not prejudice these principles as far as data protection is concerned.

text: 14. Transfers of personal data gathered in the context of criminal investigations and further processing by Europol to produce criminal intelligence envisaged under the future Agreement are liable to have a significant impact on the lives of the individuals concerned, as they may potentially be used as incriminating evidence in prosecution cases in the receiving country under its national law.

text: 15. As transfers of personal data to third countries constitute an interference with individuals’ right to data protection guaranteed by Article 8 of the Charter, requirements of necessity and proportionality of the envisaged processing need to be assessed in accordance with Article 52(1) of the Charter . As a result, the international agreement must ensure that the 7 limitations to the right to data protection in relation to the fight against serious crime and terrorism apply only in so far as is strictly necessary .

text: 16. Following the amendments of Europol Regulation in 2022 , Chapter IX of EUDPR applies to the processing of operational personal data by Europol. According to Recital 10 of EUDPR, the rules for the protection of operational personal data processed by Union bodies, offices or agencies, when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part Three TFEU, such as Europol, should be consistent with the LED. In this regard, Article 35(3) of the LED lays down the general principle that the level of protection of natural persons applicable in the EU must not be undermined by the transfer of their personal data to third countries or international organisations.

text: 17. The EDPS furthermore considers that the proposed Agreement should also take into account the potential risks in case of transfer of personal data from a third country to Europol. The Europol Regulation explicitly prohibits processing by Europol of “any information which has clearly been obtained in obvious violation of human rights” . This safeguard is even more valid in the context of the extended powers of Europol pursuant to

text: Article 18

text: a(6) of the amended Europol Regulation. Europol may process personal data that do not relate to the categories of data subjects listed in Annex II of the same Regulation, provided by a third country on the basis of an international agreement like the envisaged one, or pursuant to

text: Article 4(1)

text: (t) thereof, which mandates Europol to propose to Member States to enter information alerts in the Schengen Information System, based on data provided by third countries on persons involved in terrorism or serious crime. Therefore, the EDPS recommends the future Agreement to exclude explicitly transfers of personal data obtained in a manifest violation of human rights.

text: 3. Purpose limitation and data minimisation

text: 18. Purpose limitation is among the key principles of the EU data protection framework. It requires, on the one hand, that personal data are collected for specified, explicit and legitimate purposes and, on the other hand, that personal data are not further processed in a manner that is incompatible with those purposes. Article 18 of the Europol Regulation lays down an exhaustive list of purposes for data processing activities by Europol that are considered legitimate.

text: 19. In that regard, the EDPS notes that directive 2 of the Annex limits the exchange of data under the future Agreement only to crimes and related criminal offences falling within Europol's competence in accordance with Article 3 of Europol Regulation, in particular, preventing and combating terrorism, disrupting organised crime and fighting drug trafficking and cybercrime. It also envisages that the Agreement should specify its scope and the purposes for which Europol may transfer personal data to the competent authorities of Peru. Furthermore, directive 3(b) of the Annex underlines the principle of specificity, according to which the data should not be processed for other purposes than for the purposes of the transfer. In addition, directive 3(c) aims to ensure that personal data would be adequate, relevant and limited to what is necessary in relation to that purpose. The EDPS considers that all these requirements also apply to any sharing or onward transfer, in accordance with directives 3(i) and (j).

text: 20. In addition, the EDPS welcomes that the Agreement will oblige competent Peruvian authorities to respect any restrictions Europol may impose on access or use of transferred personal data and specify how compliance with these restrictions will be enforced in practice.

text: 21. Given the strong emphasis placed on purpose limitation in the Europol Regulation and for additional legal certainty, the EDPS recommends that the future Agreement explicitly lays down the list of the criminal offences regarding which personal data could be exchanged. Moreover, the transferred personal data must be related to individual cases.

text: 4. Storage limitation

text: 22. The EDPS notes that directive 3(c) of the Annex provides that personal data “will not be retained for longer than is necessary for the purposes for which they have been transferred”. Directive 3(f) further requires that the agreements should lay down rules on storage, review, correction and deletion of personal data. In that regard, the EDPS would like to point out that the Europol Regulation contains an elaborate regime for data storage with technical and procedural safeguards, which ensures that storage and erasure obligations are complied with in practice.

text: 23. In particular,

text: Article 31

text: thereof requires Europol to conduct reviews of the necessity and proportionality of storing the data every three years. This is without prejudice to different retention periods communicated by data providers when sending the data to Europol, which are binding for Europol. Any decision to store the data after the first three years must be duly justified and the motivation must be recorded. Europol is also bound to erase the data that have been erased in the systems of the data provider as soon as it is informed thereof. The EDPS considers these rules as fully applicable also for data received by Europol in the context of international cooperation.

text: 24. The EDPS recommends that the future Agreement provides for a periodic review of the need for storage of the transferred personal data as well as other appropriate measures ensuring that the time limits are observed. 9

text: 5. Special categories of personal data and different categories of data subjects

text: 25. According to the CJEU case law, the need for safeguards applies particularly where the protection of the particular category of personal data that is sensitive data is at stake .

text: 26. In this regard, the EDPS welcomes directive 3(d) aiming to align the special categories of data and their processing with Article 30 of the Europol Regulation, as well as to ensure specific safeguards relating to the transfer of personal data on minors, victims of criminal offence, witnesses or other persons who can provide information concerning criminal offences. However, given the sensitivity of special categories of personal data, the EDPS suggests that the future Agreement adduces the safeguards provided in Article 30 of the Europol Regulation, such as the prohibition of the selection of a particular group of persons solely on the basis of such personal data.

text: 6. Automated decisions

text: 27. The EDPS welcomes directive 3(f) aiming to provide for safeguards in respect to automated processing of personal data. According to the case law of the CJEU, ‛the need for [...] safeguards is all the greater where personal data is subject to automated processing. Those considerations apply particularly where the protection of the particular category of personal data that is sensitive data is at stake’ .

text: 28. In that regard, the EDPS recalls that in line with Article 77 (1) of the EUDPR and Article 11(1) of the LED, such safeguards should include at least the right to obtain human intervention. This would ensure that no automated decision based on the received data under the Agreement would take place without the possibility for a human being to intervene in an effective and meaningful way. This is especially important in the area of law enforcement, where the consequences of profiling on individuals are potentially even more severe. Therefore, the EDPS recommends including specifically this safeguard in the future Agreement.

text: 7. Data security

text: 29. The EDPS wishes to stress that ensuring the security of personal data is not only a clear requirement under EU law , but it is also considered by the CJEU as essential requirement in relation to the fundamental right to data protection . Data security is also essential for ensuring the confidentiality of criminal investigations.

text: 30. The EDPS therefore welcomes directive 3(h) of the Annex, the obligation to ensure security of personal data through appropriate technical and organisational measures, including by allowing only authorised persons to have access to personal data as well as an obligation of notification in the event of a personal data breach affecting data transferred under the Agreement. The EDPS considers it essential that security measures should cover data processed in the place of destination, as well as in transit.

text: 8. Right to information

text: 31. The EDPS welcomes the fact that directive 3(e) of the Annex requires that the future international agreement ensures “enforceable rights of individuals whose personal data are processed by laying down rules on the right of access, rectification and erasure, including the specific grounds which may allow any necessary and proportionate restrictions”. Furthermore, directive 3(f) provides for that the Agreement should lay down rules, inter alia, “on information to be made available to individuals”.

text: 32. The EDPS recalls that data subjects usually have no knowledge of the fact that their data are processed and transferred for law enforcement purposes. At the same time, the right to information is of utmost importance as it allows the exercise of the other data protection rights, including the right to remedies, and ensures fair processing of the data .

text: 33. The EDPS recommends that the future Agreement lays down clear and detailed rules regarding the information that should be made available to the data subjects, in line with

text: Article 79

text: EUDPR. Such rules should also include information about the applicable regime for EU data subjects to exercise their rights of access, rectification and erasure in Peru. In the same vein, the future Agreement should also lay down mechanisms to facilitate the exercise of such rights in practice, e.g. consultations between the competent law enforcement authorities and Europol.

text: 9. Supervision

text: 34. Pursuant to Article 8(3) of the Charter, the control by an independent authority is an essential element of the right to the protection of personal data. Therefore, the EDPS welcomes directive 3(k) of the Annex, according to which the Agreement should ensure “a system of oversight by one or more independent public authorities responsible for data protection with effective powers of investigation and intervention to exercise oversight over those public authorities of Peru that use personal data/exchanged information”.

text: 35. The EDPS recommends to the Commission to pay special attention during the negotiations to directive 3(k) concerning the oversight by independent public bodies responsible for data protection with effective powers vis-a-vis the law enforcement and other competent authorities of Peru that will use the transferred personal data.

text: 10. Review of the Agreement

text: 36. The EDPS welcomes Article 5 of the Annex providing that the Agreement will include provisions on the monitoring and periodic evaluation of the Agreement.

text: 37. For the purposes of this review, the EDPS suggests that the Parties exchange on a regular basis information on the exercise of rights by data subjects, including statistics on the number of requests and their outcome, notably the number of cases where the right was restricted. In addition, the Parties could agree to exchange relevant information about the use of the oversight and redress mechanisms related to the application of the Agreement, including the decisions taken on that account.

text: 11. Conclusions

text: 38. In light of the above, the EDPS recommends: (1) that the future Agreement excludes explicitly transfers of personal data obtained in a manifest violation of human rights, (2) that the future Agreement explicitly lay down the list of the criminal offences regarding which personal data could be exchanged and that the transferred personal data must be related to individual cases, (3) that the future Agreement provide for a periodic review of the need for storage of the transferred personal data as well as other appropriate measures ensuring that the time limits are observed, (4) to ensure the future Agreement adduce the safeguards provided for in Article 30 of the Europol Regulation, (5) to ensure that security measures cover data processed in the place of destination, as well as in transit, (6) to ensure that no automated decision based on the received data under the Agreement would take place without the possibility for a human being to intervene in an effective and meaningful way, (7) that the future Agreement lays down clear and detailed rules regarding the information that should be made available to the data subjects, (8) the Commission to pay special attention during the negotiations to draft directive 3(k) concerning the oversight by independent public bodies responsible for data protection with effective powers vis-a-vis the law enforcement and other competent authorities of Peru that will use the transferred personal data, 12 (9) for the purposes of this review of the Agreement, that the Parties exchange on a regular basis information on the exercise of rights by data subjects and relevant information about the use of the oversight and redress mechanisms related to the application of the Agreement. Brussels, 3 May 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 13