text: COM(2023) 507 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 507 final. 4 See COM(2023) 507 final, Explanatory Memorandum, p. 4. Communication from the Commission to the European Parliament, the European Council, the Council, the European Economic and Social Committee and the Committee of the Regions on the EU Security Union Strategy, , COM(2020) 605 final. 6 Council Conclusions of 7 June 2021 on the transfer of Passenger Name Record (PNR) data to third countries, Council Document 9605/21 of 8 June 2021. 7 See COM(2023) 507 final, Explanatory Memorandum, p. 3. 4

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1. 9

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89–131. 10

text: Directive (EU) 2016/681

text: of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, OJ L 119, 4.5.2016, p. 132–149. 11 See COM(2023) 507 final, p. 2, 5. 12 Opinion 1/15 of the Court of Justice (Grand Chamber) of 26 July 2017, EU:C:2017:592. 13 Judgment of the Court of Justice (Grand Chamber) of 21 June 2022 “Ligue des droits humains”,

text: , EU:C:2022:491. 14 See https://www.icao.int/safety/airnavigation/nationalitymarks/annexes_booklet_en.pdf 5

text: OJ L 176, 10.7.1999, p. 36. 16 See Decision of the EEA Joint Committee No 154/2018 of 6 July 2018 amending Annex XI (Electronic communication, audiovisual services and information society) and Protocol 37 (containing the list provided for in

text: Article 101

text: ) to the EEA Agreement [2018/1022], OJ L 183, 19.7.2018, p. 23–26. 6

text: Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ L 281, 23.11.1995, p. 31. 18 Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, OJ L 350, 30.12.2008, p. 60. 19 See Section 3 of the Vienna Convention on the Law of Treaties Vienna, 23 May 1969. 20 See for instance , most recently, Article 19 of the Agreement between the European Union, of the one part, and New Zealand, of the other part, on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the authorities of New Zealand competent for fighting serious crime and terrorism, OJ L 51, 20.2.2023, p. 4. 7

identifier: EDPS yttrande 45/2023

amnesord:
PNR
Transfers of data

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 45/2023 on the negotiating mandate for an Agreement between the EU and Norway on the transfer of Passenger Name Record data

serie: yttranden

text: 30 October 2023

type: rubrik

text: Opinion 45/2023

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Kingdom of Norway on the transfer of Passenger Name Record data from the EU to the Kingdom of Norway for the prevention, detection, investigation and prosecution of terrorist offences and serious crime .

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 6 September 2023, the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Kingdom of Norway on the transfer of Passenger Name Record (PNR) data from the EU to the Kingdom of Norway for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. The aim of the future Agreement is to enable Norway to lawfully receive PNR data from the EU Member States and to allow its designated competent authority to make use of such data in a manner that ensures the security of the individuals moving within a common area without internal borders controls as well as the protection of the personal data concerning those individuals.

text: In the Opinion, the EDPS recalls the specific legal situation of Norway as a Schengen associated country. Pursuant to the Schengen Association Agreement between the EU and Norway of 1999, Norway is bound by the Union acts which constitute a development of the provisions of the Schengen acquis. As a result, Norway is supposed to apply the

text: Directive (EU) 2016/680

text: in a similar manner as EU Member States. In addition, as member of the European Economic Area, Norway is not considered as a third country within the meaning of Chapter V of the GDPR.

text: However, the EU PNR Directive does not constitute a development of the provisions of the Schengen acquis and therefore Norway is not bound by its provisions. Therefore, the EDPS stresses the need for the future PNR Agreement between the EU and Norway to adduce all the appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU.

text: In addition to this general comment, the EDPS makes two specific recommendations. Firstly, he recommends aligning the definition of sensitive data in the negotiating mandate with the definitions of special categories of data in the GDPR and

text: Directive (EU) 2016/680

text: . Secondly, the EDPS proposes introducing in the negotiating directives the legal possibilities to suspend the Agreement in case of breaches of its provisions, as well as to terminate it if the non-compliance is serious and persistent.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 6 September 2023 the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Kingdom of Norway on the transfer of Passenger Name Record (PNR) data from the EU to the Kingdom of Norway for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (‘the Recommendation’).

text: 2. The aim of the Recommendation is to enable Norway to lawfully receive PNR data from the Union and to allow its designated competent authority to make use of such data in a manner that ensures, at the same time, the security of the individuals moving within a common area without internal borders controls as well as the protection of the personal data concerning those individuals .

text: 3. The Recommendation is part of the broader initiative of the Commission to pursue a consistent and effective approach regarding the transfer of PNR data to third countries, as announced in the Security Union Strategy 2020-2025 and requested by the Council in its 6 7 Conclusions of June 2021 , in line with the Union law and case-law on PNR .

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 6 September 2023, pursuant to Article 42(1) of EUDPR.

text: 2. General remarks

text: 5. PNR data is information provided by passengers, and collected by and held in the air carriers’ reservation and departure control systems for their own commercial purposes. While useful for combating terrorism and serious crime, the transfer of PNR data to third countries and the subsequent processing by their authorities constitutes an interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter of Fundamental Rights (the Charter). For this reason, it requires a legal basis under EU law and must be necessary, proportionate and subject to strict limitations and effective safeguards.

text: 6. In addition to the Charter, the applicable legal rules in case of transfer and processing of PNR data, include also the horizontal EU legal framework on data protection, namely

text: Regulation (EU) 2016/679

text: (the GDPR) and

text: Directive (EU) 2016/680

text: (the Law Enforcement 9 10 Directive) , as well as the specific

text: Directive (EU) 2016/681

text: (the EU PNR Directive) .

text: 7. Furthermore, as highlighted in the Recommendation , the Court of Justice of the EU (CJEU) on two occasions interpreted the legal framework on PNR and provided guidance as regards proportionality and the necessity of PNR data processing, namely in Opinion 12 13 1/15 of 26 July 2017 and Judgment in

text: Case C-817/2019

text: of 21 June 2022 .The requirements laid down by the CJEU in the cited case law constitute an important point of reference for the assessment of this Recommendation and any future EU agreement on the transfer of PNR data.

text: 8. The EDPS also recalls that, in addition to the Union legislation, PNR data is subject to international rules and standards. The United Nations Security Council Resolution 2396 (2017) on threats to international peace and security caused by returning foreign terrorist fighters, adopted on 21 December 2017, and the subsequent UN Security Council Resolution 2482 (2019) of 19 July 2019, called on UN Member States to develop the capability to collect and use PNR data, based on Standards and Recommended Practices on PNR (SARPs) of the International Civil Aviation Organization (ICAO) from 2020, adopted by means of Amendment 28 to Annex 9 to the Convention on International Civil Aviation (Chicago Convention) . All EU Member States, as well as Norway, are Parties to the Chicago Convention.

text: 9. Another important aspect that deserves specific attention is the legal situation of Norway as a Schengen associated country. Pursuant to Article 8 of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the latters' association with the implementation, application and development of the Schengen acquis of 1999 , Norway is bound by the Union acts which constitute a development of the provisions of the Schengen acquis. While the process is not automatic and requires the acceptance by Norway of the content of the respective Union acts and measures and, if relevant, the fulfilment of the national constitutional requirements, it nevertheless creates clear legal obligations for Norway to implement and apply the respective Union legislation. Moreover, pursuant to Article 8(4) of the Schengen Association Agreement of 1999, if Norway would not accept the content of the respective Union act or failed to implement it into its internal legal order, this Agreement should be considered terminated. In addition, in accordance with Article 10 of the Schengen Association Agreement of 1999, Norway has to submit annual reports on the way in which its administrative authorities and its courts have applied and interpreted the provisions of the Schengen acquis, as interpreted by the CJEU, as the case may be.

text: 10. The EDPS also recalls the fact that Norway is legally bound by the EU data protection framework. Firstly, recital 101 of the Law Enforcement Directive explicitly states that this Directive “constitutes a development of provisions of the Schengen acquis, as provided for by the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the association of those two States with the implementation, application and development of the Schengen acquis”. As a result, as already explained above, Norway is under the obligation to implement it into its internal legal order and apply it in practice.

text: 11. Secondly, pursuant to Annex XI to the European Economic Area (EEA) Agreement , the GDPR is incorporated in the EEA Agreement. Consequently, as a member of EEA, Norway is not considered as a third country within the meaning of Chapter V of the GDPR.

text: 12. Conversely, the EDPS recalls that the PNR Directive does not constitute a development of the provisions of the Schengen acquis and therefore Norway is not bound by its provisions. Consequently, the future PNR Agreement between the EU and Norway should adduce all the appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU.

text: 13. In addition to these general comments, the EDPS has two specific recommendations concerning the negotiating mandate with regard to the transfer of sensitive data and the suspension and termination of the Agreement.

text: 3. Sensitive data

text: 14. The negotiating directive in paragraph 10 of the Annex to the Recommendation stipulates that the future Agreement has to ensure that "sensitive data within the meaning of Union law" is not processed. In this regard, ‘sensitive data’ is defined as "personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership or concerning a person’s health or sexual life or orientation". However, the definitions of special categories of data (sensitive data) in Article 9 (1) of GDPR and Article 10 of the Law Enforcement Directive include two additional categories: "genetic data and biometric data for the purpose of uniquely identifying a natural person".

text: 15. The EDPS notes that the definition of sensitive data in the negotiating mandate is identical to the one provided for in Article 13(4) of the PNR Directive. In this context, the EDPS recalls that while the PNR Directive was adopted at the same time as the GDPR and the Law Enforcement Directive, for reasons of legal technique it refers to the repealed predecessors 17 18 of these legal acts, namely Directive

text: and Framework Decision 2008/977/JHA . Pursuant to Article 94 of the GDPR and Article 59 of the Law Enforcement Directive, as of May 2018, the references to the repealed data protection acts in the PNR Directive must be construed as references to the respective current legal acts. In other words, the new higher EU standard of personal data protection applies also in the context of PNR data processing.

text: 16. In view of this, the EDPS recommends aligning the definition of sensitive data in paragraph 10 of the Annex to the Recommendation with the definitions of special categories of data in Article 9 (1) of GDPR and Article 10 of the Law Enforcement Directive by replacing the list of data categories considered sensitive data with a reference to respective provisions of the Union data protection law, or, alternatively, by adding "genetic data and biometric data for the purpose of uniquely identifying a natural person".

text: 4. Suspension and termination

text: 17. The negotiating directive in paragraph 18 of the Annex to the Recommendation stipulates that the Agreement should be concluded for a set period of time but include a provision whereby the Agreement is to be renewed for similar periods unless a Party notifies its decision to terminate it. However, the negotiation mandate does not refer to the legal possibility to suspend or terminate the Agreement before this set period of time elapses, in the event of a material breach or of non-fulfilment of obligations stemming from this Agreement by the Contracting Party. The EDPS reminds that such kind of suspension clause is not only a standard element of international agreements and commonly a part of EU international agreements , but is also an important safeguard for the rights of the individuals affected by the transfer of personal data pursuant to the Agreement.

text: 18. The EDPS therefore recommends introducing in the negotiating directives the legal possibilities to suspend the Agreement in case of breaches of its provisions, as well as to terminate it if the non-compliance is serious and persistent. The respective provision of the future Agreement should also stipulate the applicable procedure with regard to the personal data already transferred to Norway prior to its suspension or termination.

text: 5. Conclusions

text: 19. In light of the above, the EDPS makes the following recommendations: (1) to adduce in the future PNR Agreement between the EU and Norway all the appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU, taking into account the fact that the PNR Directive does not constitute a development of the provisions of the Schengen acquis and therefore Norway is not bound by its provisions; (2) to align the definition of sensitive data in paragraph 10 of the Annex to the Recommendation with the definitions of special categories of data in Article 9(1) of GDPR and Article 10 of the Law Enforcement Directive by replacing the list of data categories considered sensitive data with a reference to respective provisions of the Union data protection law, or, alternatively, by adding "genetic data and biometric data for the purpose of uniquely identifying a natural person"; (3) to introduce in the negotiating directives the legal possibilities to suspend the Agreement in case of breaches of its provisions, as well as to terminate it if the non-compliance is serious and persistent. Brussels, 30 October 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8

type: vagledning

utgivare: edps


text: COM(2023) 508 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 508 final. 4 See COM(2023) 508 final, Explanatory Memorandum, p. 4. Communication from the Commission to the European Parliament, the European Council, the Council, the European Economic and Social Committee and the Committee of the Regions on the EU Security Union Strategy, , COM(2020) 605 final. 6 Council Conclusions of 7 June 2021 on the transfer of Passenger Name Record (PNR) data to third countries, Council Document 9605/21 of 8 June 2021. 7 See COM(2023) 508 final, Explanatory Memorandum, p. 3. 4

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1. 9

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89–131. 10

text: Directive (EU) 2016/681

text: of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, OJ L 119, 4.5.2016, p. 132–149. 11 See COM(2023) 508 final, p. 2 and 5. 12 Opinion 1/15 of the Court of Justice (Grand Chamber) of 26 July 2017, EU:C:2017:592. 13 Judgment of the Court of Justice (Grand Chamber) of 21 June 2022 “Ligue des droits humains”,

text: , EU:C:2022:491. 14 See https://www.icao.int/safety/airnavigation/nationalitymarks/annexes_booklet_en.pdf 5

text: OJ L 176, 10.7.1999, p. 36. 16 See Decision of the EEA Joint Committee No 154/2018 of 6 July 2018 amending Annex XI (Electronic communication, audiovisual services and information society) and Protocol 37 (containing the list provided for in

text: Article 101

text: ) to the EEA Agreement [2018/1022], OJ L 183, 19.7.2018, p. 23–26. 6

text: Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ L 281, 23.11.1995, p. 31. 18 Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, OJ L 350, 30.12.2008, p. 60. 19 See Section 3 of the Vienna Convention on the Law of Treaties Vienna, 23 May 1969. 20 See for instance , most recently, Article 19 of the Agreement between the European Union, of the one part, and New Zealand, of the other part, on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the authorities of New Zealand competent for fighting serious crime and terrorism, OJ L 51, 20.2.2023, p. 4. 7

identifier: EDPS yttrande 46/2023

title: EDPS Opinion 46/2023 on the negotiating mandate for an Agreement between the EU and Iceland on the transfer of Passenger Name Record data

text: 30 October 2023

text: Opinion 46/2023

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Iceland on the transfer of Passenger Name Record data from the EU to Iceland for the prevention, detection, investigation and prosecution of terrorist offences and serious crime .

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 6 September 2023, the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Iceland on the transfer of Passenger Name Record data from the EU to Iceland for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. The aim of the future Agreement is to enable Iceland to lawfully receive PNR data from the EU Member States and to allow its designated competent authority to make use of such data in a manner that ensures the security of the individuals moving within a common area without internal borders controls as well as the protection of the personal data concerning those individuals.

text: In the Opinion, the EDPS recalls the specific legal situation of Iceland as a Schengen associated country. Pursuant to the Schengen Association Agreement between the EU and Iceland of 1999, Iceland is bound by the Union acts which constitute a development of the provisions of the Schengen acquis. As a result, Iceland is supposed to apply the

text: Directive (EU) 2016/680

text: in a similar manner as EU Member States. In addition, as member of the European Economic Area, Iceland is not considered as a third country within the meaning of Chapter V of the GDPR.

text: However, the EU PNR Directive does not constitute a development of the provisions of the Schengen acquis and therefore Iceland is not bound by its provisions. Therefore, the EDPS stresses the need for the future PNR Agreement between the EU and Iceland to adduce all the appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU.

text: In addition to this general comment, the EDPS makes two specific recommendations. Firstly, he recommends aligning the definition of sensitive data in the negotiating mandate with the definitions of special categories of data in the GDPR and

text: Directive (EU) 2016/680

text: . Secondly, the EDPS proposes introducing in the negotiating directives the legal possibilities to suspend the Agreement in case of breaches of its provisions, as well as to terminate it if the non-compliance is serious and persistent.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 6 September 2023 the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Iceland on the transfer of Passenger Name Record data from the EU to Iceland for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (‘the Recommendation’).

text: 2. The aim of the Recommendation is to enable Iceland to lawfully receive PNR data from the Union and to allow its designated competent authority to make use of such data in a manner that ensures, at the same time, the security of the individuals moving within a common area without internal borders controls as well as the protection of the personal data concerning those individuals .

text: 3. The Recommendation is part of the broader initiative of the Commission to pursue a consistent and effective approach regarding the transfer of PNR data to third countries, as announced in the Security Union Strategy 2020-2025 and requested by the Council in its 6 7 Conclusions of June 2021 , in line with the Union law and case-law on PNR .

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 6 September 2023, pursuant to Article 42(1) of EUDPR.

text: 2. General remarks

text: 5. PNR data is information provided by passengers, and collected by and held in the air carriers’ reservation and departure control systems for their own commercial purposes. While useful for combating terrorism and serious crime, the transfer of PNR data to third countries and the subsequent processing by their authorities constitutes an interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter of Fundamental Rights (the Charter). For this reason, it requires a legal basis under EU law and must be necessary, proportionate and subject to strict limitations and effective safeguards.

text: 6. In addition to the Charter, the applicable legal rules in case of transfer and processing of PNR data, include also the horizontal EU legal framework on data protection, namely

text: Regulation (EU) 2016/679

text: (the GDPR) and

text: Directive (EU) 2016/680

text: Directive (EU) 2016/681

text: (the EU PNR Directive) .

text: Case C-817/2019

text: 8. The EDPS also recalls that, in addition to the Union legislation, PNR data is subject to international rules and standards. The United Nations Security Council Resolution 2396 (2017) on threats to international peace and security caused by returning foreign terrorist fighters, adopted on 21 December 2017, and the subsequent UN Security Council Resolution 2482 (2019) of 19 July 2019, called on UN Member States to develop the capability to collect and use PNR data, based on Standards and Recommended Practices on PNR (SARPs) of the International Civil Aviation Organization (ICAO) from 2020, adopted by means of Amendment 28 to Annex 9 to the Convention on International Civil Aviation (Chicago Convention) . All EU Member States, as well as Iceland, are Parties to the Chicago Convention.

text: 9. Another important aspect that deserves specific attention is the legal situation of Iceland as a Schengen associated country. Pursuant to Article 8 of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the latters' association with the implementation, application and development of the Schengen acquis of 1999 , Iceland is bound by the Union acts which constitute a development of the provisions of the Schengen acquis. While the process is not automatic and requires the acceptance by Iceland of the content of the respective Union acts and measures and, if relevant, the fulfilment of the national constitutional requirements, it nevertheless creates clear legal obligations for Iceland to implement and apply the respective Union legislation. Moreover, pursuant to Article 8(4) of the Schengen Association Agreement of 1999, if Iceland would not accept the content of the respective Union act or failed to implement it into its internal legal order, this Agreement should be considered terminated. In addition, in accordance with Article 10 of the Schengen Association Agreement of 1999, Iceland has to submit annual reports on the way in which its administrative authorities and its courts have applied and interpreted the provisions of the Schengen acquis, as interpreted by the CJEU, as the case may be.

text: 10. The EDPS also recalls the fact that Iceland is legally bound by the EU data protection framework. Firstly, recital 101 of the Law Enforcement Directive explicitly states that this Directive “constitutes a development of provisions of the Schengen acquis, as provided for by the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the association of those two States with the implementation, application and development of the Schengen acquis”. As a result, as already explained above, Iceland is under the obligation to implement it into its internal legal order and apply it in practice.

text: 11. Secondly, pursuant to Annex XI to the European Economic Area (EEA) Agreement , the GDPR is incorporated in the EEA Agreement. Consequently, as a member of EEA, Iceland is not considered as a third country within the meaning of Chapter V of the GDPR.

text: 12. Conversely, the EDPS recalls that the PNR Directive does not constitute a development of the provisions of the Schengen acquis and therefore Iceland is not bound by its provisions. Consequently, the future PNR Agreement between the EU and Iceland should adduce all the appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU.

text: 3. Sensitive data

text: 4. Suspension and termination

text: 18. The EDPS therefore recommends introducing in the negotiating directives the legal possibilities to suspend the Agreement in case of breaches of its provisions, as well as to terminate it if the non-compliance is serious and persistent. The respective provision of the future Agreement should also stipulate the applicable procedure with regard to the personal data already transferred to Iceland prior to its suspension or termination.

text: 5. Conclusions

text: 19. In light of the above, the EDPS makes the following recommendations: (1) to adduce in the future PNR Agreement between the EU and Iceland all the appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU, taking into account the fact that the PNR Directive does not constitute a development of the provisions of the Schengen acquis and therefore Iceland is not bound by its provisions; (2) to align the definition of sensitive data in paragraph 10 of the Annex to the Recommendation with the definitions of special categories of data in Article 9(1) of GDPR and Article 10 of the Law Enforcement Directive by replacing the list of data categories considered sensitive data with a reference to respective provisions of the Union data protection law, or, alternatively, by adding "genetic data and biometric data for the purpose of uniquely identifying a natural person"; (3) to introduce in the negotiating directives the legal possibilities to suspend the Agreement in case of breaches of its provisions, as well as to terminate it if the non-compliance is serious and persistent. Brussels, 30 October 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8


text: COM(2023) 509 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 509 final. 4 See COM(2023) 509 final, Explanatory Memorandum, p. 4. Communication from the Commission to the European Parliament, the European Council, the Council, the European Economic and Social Committee and the Committee of the Regions on the EU Security Union Strategy, COM(2020) 605 final. 6 Council Conclusions of 7 June 2021 on the transfer of Passenger Name Record (PNR) data to third countries, Council Document 9605/21 of 8 June 2021. 7 See COM(2023) 509 final, Explanatory Memorandum, p. 3.

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1. 9

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89–131. 10

text: Directive (EU) 2016/681

text: of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, OJ L 119, 4.5.2016, p. 132–149. 11 See COM(2023) 509 final, p. 2 and 5. 12 Opinion 1/15 of the Court of Justice (Grand Chamber) of 26 July 2017, EU:C:2017:592. 13 Judgment of the Court of Justice (Grand Chamber) of 21 June 2022 “Ligue des droits humains”,

text: , EU:C:2022:491. 14 See https://www.icao.int/safety/airnavigation/nationalitymarks/annexes_booklet_en.pdf 5

text: OJ L 53, 27.2.2008, p. 52–79. 16

text: Commission Decision 2000/518/EC of 26 July 2000

text: pursuant to Directive

text: of the European Parliament and of the Council on the adequate protection of personal data provided in Switzerland, OJ L 215, 25.8.2000, p. 1. 17 Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ L 281, 23.11.1995, p. 31. 6

text: Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ L 281, 23.11.1995, p. 31. 19 Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, OJ L 350, 30.12.2008, p. 60. 20 See Section 3 of the Vienna Convention on the Law of Treaties Vienna, 23 May 1969. 21 See for instance , most recently, Article 19 of the Agreement between the European Union, of the one part, and New Zealand, of the other part, on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the authorities of New Zealand competent for fighting serious crime and terrorism, OJ L 51, 20.2.2023, p. 4. 7

identifier: EDPS yttrande 47/2023

title: EDPS Opinion 47/2023 on the negotiating mandate for an Agreement between the EU and Switzerland on the transfer of Passenger Name Record data

text: 30 October 2023

text: Opinion 47/2023

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Swiss Confederation on the transfer of Passenger Name Record data from the EU to the Swiss Confederation for the prevention, detection, investigation and prosecution of terrorist offences and serious crime .

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 6 September 2023, the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Swiss Confederation on the transfer of Passenger Name Record (PNR) data from the EU to the Swiss Confederation for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. The aim of the future Agreement is to enable Switzerland to lawfully receive PNR data from the EU Member States and to allow its designated competent authority to make use of such data in a manner that ensures the security of the individuals moving within a common area without internal border controls as well as the protection of the personal data concerning those individuals.

text: In the Opinion, the EDPS recalls the specific legal situation of Switzerland as a Schengen associated country. Pursuant to the Schengen Association Agreement between the EU and Switzerland of 2008, Switzerland is bound by the Union acts which constitute a development of the provisions of the Schengen acquis. As a result, Switzerland is supposed to apply the

text: Directive (EU) 2016/680

text: in a similar manner as EU Member States. In addition, Switzerland has been considered in 2000 as providing an adequate level of protection for personal data transferred from the EU under Directive

text: . This adequacy decision continues to be in force under the GDPR.

text: However, the EU PNR Directive does not constitute a development of the provisions of the Schengen acquis and therefore Switzerland is not bound by its provisions. Therefore, the EDPS stresses the need for the future PNR Agreement between the EU and Switzerland to adduce all the appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU.

text: In addition to this general comment, the EDPS makes two specific recommendations. Firstly, he recommends aligning the definition of sensitive data in the negotiating mandate with the definitions of special categories of data in the GDPR and

text: Directive (EU) 2016/680

text: . Secondly, the EDPS proposes introducing in the negotiating directives the legal possibilities to suspend the Agreement in case of breaches of its provisions, as well as to terminate it if the non-compliance is serious and persistent.

text: Having regard to

text: Regulation (EU) No 2018/1725

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 6 September 2023 the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Swiss Confederation on the transfer of Passenger Name Record (PNR) data from the EU to the Swiss Confederation for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (‘the Recommendation’).

text: 2. The aim of the Recommendation is to enable Switzerland to lawfully receive PNR data from the Union and to allow its designated competent authority to make use of such data in a manner that ensures, at the same time, the security of the individuals moving within a common area without internal borders controls as well as the protection of the personal data concerning those individuals .

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 6 September 2023, pursuant to Article 42(1) of EUDPR. 4

text: 2. General remarks

text: Regulation (EU) 2016/679

text: (the GDPR) and

text: Directive (EU) 2016/680

text: (the Law Enforcement 9 10 Directive) , as well as the specific

text: Directive (EU) 2016/681

text: (the EU PNR Directive) .

text: 7. Furthermore, as highlighted in the Recommendation , the Court of Justice of the EU (CJEU) on two occasions interpreted the legal framework on PNR and provided guidance as regards proportionality and the necessity of PNR data processing, namely in Opinion 12 13 1/15 of 26 July 2017 and Judgment in

text: Case C-817/2019

text: of 21 June 2022 .The requirements laid down by the CJEU in the cited case law constitute an important point of reference for the assessment of this Recommendation and any future EU agreement on the transfer of PNR data.

text: 8. The EDPS also recalls that, in addition to the Union legislation, PNR data is subject to international rules and standards. The United Nations Security Council Resolution 2396 (2017) on threats to international peace and security caused by returning foreign terrorist fighters, adopted on 21 December 2017, and the subsequent UN Security Council Resolution 2482 (2019) of 19 July 2019, called on UN Member States to develop the capability to collect and use PNR data, based on Standards and Recommended Practices on PNR (SARPs) of the International Civil Aviation Organization (ICAO) from 2020, adopted by means of Amendment 28 to Annex 9 to the Convention on International Civil Aviation (Chicago Convention) . All EU Member States, as well as Switzerland, are Parties to the Chicago Convention.

text: 9. Another important aspect that deserves specific attention is the legal situation of Switzerland as a Schengen associated country. Pursuant to Article 7 of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation's association with the implementation, application and development of the Schengen acquis of 2008 , Switzerland is bound by the Union acts which constitute a development of the provisions of the Schengen acquis. While the process is not automatic and requires the acceptance by Switzerland of the content of the respective Union acts and measures and, if relevant, the fulfilment of the national constitutional requirements, it nevertheless creates clear legal obligations for Switzerland to implement and apply the respective Union legislation. Moreover, pursuant to Article 7(4) of the Schengen Association Agreement of 2008, if Switzerland would not accept the content of the respective Union act or failed to implement it into its internal legal order, this Agreement should be considered terminated. In addition, in accordance with Article 9 of the Schengen Association Agreement of 2008, Switzerland has to submit annual reports on the way in which its administrative authorities and its courts have applied and interpreted the provisions of the Schengen acquis, as interpreted by the CJEU, as the case may be.

text: 10. The EDPS also recalls the fact that Switzerland is legally bound by the EU data protection framework applicable to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Recital 102 of the Law Enforcement Directive explicitly states that this Directive “constitutes a development of provisions of the Schengen acquis, as provided for by the Agreement between the European Union, the European Community and the Swiss Confederation concerning the association of the Swiss Confederation with the implementation, application and development of the Schengen acquis”. As a result, as already explained above, Switzerland is under the obligation to implement the Law Enforcement Directive into its internal legal order and apply it in practice.

text: 11. With regard to data protection in general, including transfers by aircraft carriers, the EDPS recalls that Switzerland has been considered as providing an adequate level of protection 16 17 for personal data transferred from the EU in the year 2000 , under Directive

text: . Pursuant to Article 45(9) of the GDPR, this decision remains in force until amended, replaced or repealed by a Commission Decision adopted in accordance with paragraph 3 or 5 of

text: Article 45

text: GDPR.

text: 12. Conversely, the EDPS recalls that the PNR Directive does not constitute a development of the provisions of the Schengen acquis and therefore Switzerland is not bound by its provisions. Consequently, the future PNR Agreement between the EU and Switzerland should adduce all the appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU.

text: 13. In addition to these general comments, the EDPS has two specific recommendations concerning the negotiating mandate with regard to the transfer of sensitive data and the suspension and termination of the Agreement.

text: 3. Sensitive data

text: 14. The negotiating directive in paragraph 10 of the Annex to the Recommendation stipulates that the future Agreement has to ensure that "sensitive data within the meaning of Union law" is not processed. In this regard, ‘sensitive data’ is defined as "personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership or concerning a person’s health or sexual life or orientation". However, the definitions of special categories of data (sensitive data) in the GDPR and the Law Enforcement Directive include two additional categories: "genetic data and biometric data for the purpose of uniquely identifying a natural person".

text: 15. The EDPS notes that the definition of sensitive data in the negotiating mandate is identical to the one provided for in Article 13(4) of the PNR Directive. In this context, the EDPS recalls that while the PNR Directive was adopted at the same time as the GDPR and the Law Enforcement Directive, for reasons of legal technique it refers to the repealed predecessors 18 19 of these legal acts, namely Directive

text: and Framework Decision 2008/977/JHA . Pursuant to Article 94 of the GDPR and Article 59 of the Law Enforcement Directive, as of May 2018, the references to the repealed data protection acts in the PNR Directive must be construed as references to the respective current legal acts. In other words, the new higher EU standard of personal data protection applies also in the context of PNR data processing.

text: 16. In view of this, the EDPS recommends aligning the definition of sensitive data in paragraph 10 of the Annex to the Recommendation with the definitions of special categories of data in

text: Article 9(1)

text: GDPR and Article 10 of the LED by replacing the list of data categories considered sensitive data with a reference to respective provisions of the Union data protection law, or, alternatively, by adding "genetic data and biometric data for the purpose of uniquely identifying a natural person".

text: 4. Suspension and termination

text: 17. The negotiating directive in paragraph 18 of the Annex to the Recommendation stipulates that the Agreement should be concluded for a set period of time but include a provision whereby the Agreement is to be renewed for similar periods unless a Party notifies its decision to terminate it. However, the negotiation mandate does not refer to the legal possibility to suspend or terminate the Agreement before this set period of time elapses, in the event of a material breach or of non-fulfilment of obligations stemming from this Agreement by the Contracting Party. The EDPS would like to remind that this kind of suspension clause is not only a standard element of international agreements and commonly a part of EU international agreements as well , but also an important safeguard for the rights of the individuals affected by the transfer of personal data pursuant to the Agreement.

text: 18. The EDPS therefore recommends introducing in the negotiating directives the legal possibilities to suspend the Agreement in case of breaches of its provisions, as well as to terminate it if the non-compliance is serious and persistent. The respective provision of the future Agreement should also stipulate the applicable procedure with regard to the personal data transferred to Switzerland prior to its suspension or termination.

text: 5. Conclusions

text: 19. In light of the above, the EDPS makes the following recommendations: (1) to adduce in the future PNR Agreement between the EU and Switzerland all the appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU, taking into account the fact that the PNR Directive does not constitute a development of the provisions of the Schengen acquis and therefore Switzerland is not bound by its provisions; (2) to align the definition of sensitive data in paragraph 10 of the Annex to the Recommendation with the definitions of special categories of data in Article 9 (1) of GDPR and Article 10 of the Law Enforcement Directive by replacing the list of data categories considered sensitive data with a reference to respective provisions of the Union data protection law, or, alternatively, by adding "genetic data and biometric data for the purpose of uniquely identifying a natural person"; (3) to introduce in the negotiating directives the legal possibilities to suspend the Agreement in case of breaches of its provisions, as well as to terminate it if the non-compliance is serious and persistent. Brussels, 30 October 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8


text: COM(2023) 516 final COM(2023) 515 final 1

text: OJ L 295, 21.11.2018, p. 39. 4 COM(2023) 516 final. 5 COM(2023) 515 final. See p. 5, par. 3 of the Explanatory Memorandum of the Proposal for a Directive. 7

text: Regulation (EU) No 1024/2012

text: of the European Parliament and of the Council of 25 October 2012 on administrative cooperation through the Internal Market Information System and repealing

text: Commission Decision 2008/49/EC

text: (OJ L 316, 14.11.2012, p. 1). 8

text: Regulation (EU) 2018/1724

text: of the European Parliament and of the Council of 2 October 2018 establishing a single digital gateway to provide access to information, to procedures and to assistance and problem-solving services and amending

text: Regulation (EU) No 1024/2012

text: (OJ L 295, 21.11.2018, p. 1). 5

text: See p. 6, last paragraph of the Explanatory Memorandum of the Proposal for a Directive. 10 See p. 1, par. 1 of the Explanatory Memorandum of the Proposal for a Directive. 11 An economy that works for people (europa.eu). 12 Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, ‘Building an economy that works for people: an action plan for the social economy’, COM(2021) 778 final. 13 Namely, the Commission proposal of 13.06.23 for a Council Recommendation on developing social economy framework conditions in the Member States (COM(2023) 316 final) and two Commission Staff Working Documents of 13.06.23: “Relevant taxation frameworks for social economy entities (SWD(2023) 211 final) and “Non-discriminatory taxation of charitable organisations and their donors: principle drawn from EU case-law (SWD(2023) 212 final). 14 15 See p. 2, last paragraph of the Explanatory Memorandum of the Proposal for a Directive. See p. 1-2. 15 See p. 1-2. 16 In Ireland, Denmark and Sweden, associations are regulated by principles developed through doctrine and case-law. 6

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive

text: (OJ L 119, 4.5.2016, p.1). 18 See recital 41 and Art. 20(6) of the Proposal for a Directive. 19 EDPS Opinion 1/2023 on the Proposal for an Interoperable Europe Act, issued on 13 January 2023. 7

identifier: EDPS yttrande 48/2023

amnesord:
Transfers of data
IMI

title: EDPS Opinion 48/2023 on the Proposal for a Directive on European cross-border associations and the Proposal for a Regulation amending Regulations 1024/2012 and 2018/1724

text: 31 October 2023

text: Opinion 48/2023

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Directive of the European Parliament and of the Council on European cross-border associations and the Proposal for a Regulation of the European Parliament and of the Council amending Regulations

text: (EU) No 1024/2012

text: and

text: (EU) 2018/1724

text: as regards the use of the Internal Market Information System and the Single Digital Gateway for the purposes of certain requirements laid down by Directive (EU) .../... of the European Parliament and of the Council on European cross-border associations (COM(2023)516) . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposals that are relevant from a data protection perspective.

text: Executive Summary

text: On 5 September 2023, the European Commission issued the Proposal for a Directive of the European Parliament and of the Council on European cross-border associations and the Proposal for a Regulation of the European Parliament and of the Council amending Regulations

text: (EU) No 1024/2012

text: and

text: (EU) 2018/1724

text: as regards the use of the Internal Market Information System and the Single Digital Gateway for the purposes of certain requirements laid down by Directive (EU) .../... of the European Parliament and of the Council on European cross-border associations (COM(2023)516).

text: The EDPS welcomes the aim of this legislative initiative to regulate conditions for non-profit associations to operate cross-border in the internal market. In addition, the EDPS welcomes recital 42 of the Proposal for a Directive on European cross-border associations emphasising that GDPR and EUDPR apply to the processing of personal data carried out in the context of that Directive.

text: However, the EDPS made several recommendations. In particular, he recommended to align the wording of

text: Article 20(6)

text: and recital 41 of the Proposal for a Directive on European cross-border associations and to explain why 2 years is found an appropriate retention period of personal data after the dissolution of an European cross-border association.

text: Finally, the EDPS referred to his Opinion 1/2023 on the Proposal for an Interoperable Europe Act.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 5 September 2023, the European Commission issued the Proposal for a Directive of the European Parliament and of the Council on European cross-border associations (‘the Proposal for a Directive’) and the Proposal for a Regulation of the European Parliament and of the Council amending Regulations

text: (EU) No 1024/2012

text: and

text: (EU) 2018/1724

text: as regards the use of the Internal Market Information System and the Single Digital Gateway for the purposes of certain requirements laid down by Directive (EU) .../... of the European Parliament and of the Council on European cross-border associations (COM(2023)516) (‘the Proposal for a Regulation’).

text: 2. The objective of the Proposal for a Directive is to facilitate the exercise of non-profit associations’ right of establishment and the effective exercise of free movement rights by laying down measures coordinating the conditions for establishing and operating European cross-border associations (ECBAs), thereby providing inter alia for automatic recognition of their legal personality by Member States, ensuring they are subject to a single registration obligation and providing for harmonised rules on mobility (i.e. transfer of registered office) . The Proposal for a Regulation aims at amending

text: Regulation (EU) No 1024/2012

text: which established the Internal Market Information System (IMI) in order to ensure that Member States’ competent authorities cooperate and exchange information through the IMI when they apply the national rules implemented in accordance with the provisions of the proposal. It also aims at amending

text: Regulation (EU) 2018/1724

text: which established the Single Digital Gateway to ensure that Member States give online access to information relevant to the ECBAs and non-profit associations and facilitate the exchange of evidence between competent authorities during the procedures concerning ECBAs, as laid down by the Proposal for a Directive. The Regulation is the appropriate instrument for such changes in view of the principle of parallelism of form .

text: 3. The Proposals stem from the European Parliament resolution of 17 February 2022, aiming to promote associations and other non-profit organisations in the EU in completing the internal market, protecting their fundamental rights and fostering an EU democratic space .

text: 4. The Proposal for a Directive is included in the 2023 Commission Work Programme as part of the Social Economy framework under the Commission’s headline ambition of “An economy that works for people”, contributing to the objective of ʽan economy that can fully respond to the needs of EU citizens thereby ensuring social fairness and prosperityʼ. In this sense, it interlinks with measures announced in the Social Economy Action Plan 1314 and forms together with them the “Social Economy framework” .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 5 September 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in recital 51 of the Proposal for a Directive.

text: 2. General remarks

text: 6. The Explanatory Memorandum of the Proposal for a Directive emphasises that non-profit associations represent the predominant legal form among non-profit organisations in the European Union. However, non-profit associations and their activities are regulated by specific legislation in 24 Member States in a different manner, creating legal uncertainty and giving rise to different administrative procedures and requirements. Moreover, a very large majority of Member States do not recognise associations from other Member States seeking to engage in cross-border activities.

text: 7. The EDPS fully supports the aim of the Proposals to fill in this legislative gap by regulating conditions for non-profit associations to operate cross-border in the internal market. However, the EDPS would like to remind that every proposal for a legislative act, which has an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data, must comply with the applicable data protection legislation. In that regard, the EDPS welcomes recital 42 of the Proposal for a Directive emphasising that Regulation 2016/679 (‘GDPR’) and EUDPR apply to the processing of personal data carried out in the context of that Directive.

text: 3. Retention of personal data

text: 8. An important principle of the GDPR is storage of personal data which prohibits personal data to be kept in a form permitting identification of data subjects for longer than is necessary for the purposes for which the personal data are processed. In that regard, the EDPS welcomes that the Proposal for a Directive provides for a limitation of retention of personal data . However, when reading together recital 41 (ʽ...all data retained and stored in the register should be kept for 2 years after dissolution.ʼ) and Article 20(6) of the Proposal for a Directive (ʽMember States shall ensure that personal data are not retained in the register after the dissolution of an ECBA for longer than 2 years.ʼ) it is unclear whether personal data must be retained for 2 years or whether 2 years is the maximum period the data can be retained. In addition, the Proposal for a Directive does not contain an explanation justifying the necessity to retain the personal data for 2 years. The EDPS therefore suggests clarifying these issues in order to be fully compliant with the storage limitation principle.

text: 4. Public sector interoperability

text: 9. The EDPS notes recital 41 of the Proposal for a Directive, stating: ʽThe interoperability solutions developed as part of the implementation of the Proposal for a Regulation of the European Parliament and of the Council laying down measures for a high level of public sector interoperability across the Union can further support Member States to move towards cross-border interoperability of their registersʼ.

text: 10. In that regard, the EDPS would like to recall that EDPS issued an Opinion on this Proposal as well. In particular, the EDPS emphasised that interoperability of network and information systems across sectors of public administration and across all levels of administration affects one of the most fundamental principles of data protection, the principle of purpose limitation. The EDPS encouraged the development of interoperability solutions which do not go over the head of the persons concerned, but actively involve them, thus giving them better control over what data to share for which purposes e.g. in a process of authorizing the exchange between administrations and electronically checking the data to be exchanged.

text: 5. Other specific comments

text: 11. As already stated in the introduction, the EDPS welcomes the reference to this consultation in recital 51 of the Proposal for a Directive. However, he notes that the date of the EDPS Opinion is not correct. In addition, the EDPS suggests adding a similar recital in the Proposal for a Regulation.

text: 12. Finally, when it comes to the Proposal for a Regulation, the EDPS notes that its recital 2 invokes

text: Article 30(2)

text: instead of Article 28(2) of the Proposal for a Directive related to administrative cooperation between the competent authorities of Member States. He suggests correcting this clerical error.

text: 6. Conclusions

text: 13. In light of the above, the EDPS makes the following recommendations: (1) to align the wording of

text: Article 20(6)

text: and recital 41 of the Proposal for a Directive and to explain why 2 years are found an appropriate retention period for personal data after the dissolution of a European cross-border association; (2) to correct the date of the EDPS Opinion in recital 51 of the Proposal for a Directive and to insert a reference to this consultation in the Proposal for a Regulation; Brussels, 31 October 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8


text: COM(2023) 532 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 532 final. 4 COM(2023) 532 final, p. 46. COM(2023) 532 final, p. 2. 6 OECD/G20 Base Erosion and Profit Shifting Project, Outcome Statement on the Two-Pillar Solution to Address the Tax Challenges Arising from the Digitalisation of the Economy, 11 July 2023. 7 COM(2023) 532 final, p. 4. 4

text: Volker und Markus Schecke Gbr v. Land Hessen Eifert The Court of Justice of European Union in Joint Cases C92/09, , and

text: , v. Land Hessen and Bundesanstalt für Landwirtschaft und Ernahrung, ruled that the name of a legal person is to be considered personal data if the official title of the legal person identifies one or more natural persons. 9 See also Recital 22 of the Proposal. 5

identifier: EDPS yttrande 49/2023

title: EDPS Opinion 49/2023 on the Directive on Business in Europe: Framework for Income Taxation (BEFIT)

text: 3 November 2023

text: Opinion 49/2023

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Council Directive on Business in Europe: Framework for Income Taxation (BEFIT) . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 12 September 2023, the European Commission issued the Proposal for a Council Directive on Business in Europe: Framework for Income Taxation (BEFIT) (‘the Proposal’). The objective of the Proposal is to reduce tax compliance costs for large businesses, primarily those who operate in more than one Member State, and to create a coherent approach to corporate taxation in the EU. A common set of rules for EU companies is introduced to calculate their taxable base while ensuring a more effective allocation of profits between EU countries.

text: The EDPS welcomes the fact that the Proposal includes specific provisions on data protection that specify the purposes of the personal data processing, identify the controllers involved in the processing, and determine how long personal data may be processed.

text: To enhance legal certainty and foreseeability, the EDPS recommends to further clarify the specific purposes of the processing of personal data in the context of Chapter IV of the Proposal. In addition, the EDPS recommends clarifying the starting date of the proposed data retention period and to ensure that the maximum retention period remains limited to what is strictly necessary.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 12 September 2023, the European Commission issued the Proposal for a Council Directive on Business in Europe: Framework for Income Taxation (BEFIT) (‘the Proposal’).

text: 2. The objective of the Proposal is to develop a common corporate tax framework in support of the Single Market, by providing a degree of tax certainty and easier tax compliance for larger businesses that have taxable presence in multiple Member States . More specifically, the Proposal aims to reduce compliance costs for EU businesses, encourage cross-border expansion, and reduce distortions as well as the risk of double and over-taxation and tax disputes .

text: 3. The Proposal builds on the internationally agreed achievements of the OECD/G20 Inclusive Framework on the Two Pillar Approach , in order to provide businesses in the Union ‘with simplicity and certainty in a comprehensive manner’ .

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 13 September 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 26 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 5. The EDPS understands that data that would be processed in the context of the Proposal would mainly be non-personal data, or personal data in the context of data processing related to legal persons. At the same time, the EDPS welcomes that recital 22 of the Proposal refers to the applicability of

text: Regulation (EU) 2016/679

text: (‘the GDPR’) when personal data are processed within the framework of the Proposal.

text: 6. The EDPS recalls that even information on economic operators that are legal persons might in some cases be considered as personal data. In these cases, the determining factor is whether the information ‘relates to’ an ‘identifiable’ natural person .

text: 7. The EDPS positively notes the introduction of specific provisions on data protection in the enacting terms of the Proposal.

text: Article 76

text: provides specifications on the purposes for which personal data may be processed in the context of the Proposal, on the determination of actors responsible for the processing of personal data and on data retention periods. At the same time, the EDPS considers that the content of some of these provisions should be developed further in order to ensure respect for the fundamental rights to privacy and to the protection of personal data enshrined in Article 7 and 8 of the Charter of Fundamental Rights of the European Union.

text: 3. Purposes of the processing

text: 8. In accordance with Article 76 of the Proposal, Member States may process personal data ‘solely for the purpose of applying Chapter IV as well as for the purpose of examining and reaching consensus on the content of the BEFIT information return and processing and assessing individual tax returns under Chapter V’ .

text: 9. The EDPS welcomes that the Proposal provides an indication of the purposes of the processing of personal data. In accordance with

text: Article 5(1)

text: b GDPR, the purposes for which personal data may be processed must be explicitly specified. In this regard, the EDPS considers that the general reference to Chapter IV of the Proposal is not sufficient to explicitly describe the purposes of the processing.

text: 10. According to the explanatory memorandum, Chapter IV would provide a ‘risk assessment tool (‘traffic lights system’) with benchmarks, in order to facilitate transfer pricing compliance with associated enterprises outside the BEFIT group. The EDPS understands that personal data would be processed in the framework of exchanges between the competent authorities of Member States and the taxpayers when conducting the risk assessment. It is not fully clear, however, whether any personal data would need to be processed for the purpose of elaborating the risk assessment tool itself (e.g. when developing the relevant benchmarks). The EDPS therefore recommends to further clarify the specific purposes for which personal data may be processed in the context of Chapter IV of the Proposal and to indicate the relevant categories of personal data.

text: 4. Retention period

text: 11. The EDPS welcomes the introduction, in Article 76(2) of the Proposal, of a maximum retention period of 10 years for the storage of personal data to achieve the purposes of the Proposal. He also notes positively that

text: Article 76(2)

text: makes clear that the retention period may be shorter, having regard to the national laws on the statute of limitations applicable in each Member State.

text: 12. As currently drafted, however, the starting point of the retention period may not be entirely clear. The EDPS recommends clarifying that the starting point for the maximum retention period of 10 years is the moment when personal data are processed for the purposes specified in the Proposal. In addition, the EDPS recommends the co-legislator to consider further whether a maximum retention period of 10 years is really needed and to limit the maximum period to what is strictly necessary.

text: 5. Conclusions

text: 13. In light of the above, the EDPS makes the following recommendations: (1) to further clarify the specific purposes of the processing of personal data to be carried out in application Chapter IV of the Proposal, (2) to clarify the starting date of the data retention period foreseen in the Proposal and to limit the maximum retention period to what is strictly necessary. Brussels, 3 November 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 6


text: COM(2023) 528 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 528 final. 4 COM(2023) 528 final, p. 4. COM (2005) 702 final. 6 COM(2020)103 final. 7 COM(2023) 535 final. 4

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1–88. 9 The Court of Justice of European Union in Joint Cases C92/09, Volker und Markus Schecke Gbr v. Land Hessen, and

text: , Eifert v. Land Hessen and Bundesanstalt für Landwirtschaft und Ernahrung, ruled that the name of a legal person is to be considered personal data if the official title of the legal person identifies one or more natural persons. 5

identifier: EDPS yttrande 50/2023

title: EDPS Opinion 50/2023 on the Proposal for a Council Directive establishing a Head Office Tax system for SMEs

text: 3 November 2023

text: Opinion 50/2023

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to Proposal for a Council Directive establishing a Head Office Tax system for micro, small and medium sized enterprises, and amending Directive

text: . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: (‘the Proposal’).

text: The EDPS welcomes the fact that the Proposal includes specific provisions on data protection that specify the purposes of the personal data processing, identify the controllers involved in the processing, and determine how long personal data may be processed. To enhance legal certainty and foreseeability, the EDPS recommends clarifying the starting date of the proposed retention period and to ensure that the maximum retention period remains limited to what is strictly necessary.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 12 September 2023, the European Commission issued a Proposal for a Council Directive establishing a Head Office Tax system for micro, small and medium sized enterprises, and amending Directive

text: (‘the Proposal’).

text: 2. The objective of the Proposal is to provide rules which open the possibility for standalone companies qualifying as micro, small and medium sized enterprises (SMEs) to use one single set of tax rules, namely the rules of the Member State of their Head Office, for computing the taxable result in respect of activities performed through a permanent establishment situated in another Member State. The system relies on a mutual recognition among Member States of each other’s taxation rules, and is optional for all eligible SMEs, which can continue applying different sets of tax rules to their business operations .

text: 3. The Proposal builds on a Communication from the European Commission that set out a possible solution to the compliance costs and other tax obstacles faced by SMEs and on the Commission’s SME Strategy for a sustainable and digital Europe . The Proposal is part of a broader SME Relief Package , which aims to provide short-term relief, boost long-term SME competitiveness and resilience, and foster a fair and SME-friendly business environment.

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 13 September 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 17 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 5. The EDPS understands that the data that would be processed in the context of the Proposal would mainly be non-personal data or personal data in the context of data processing related to legal persons. At the same time, the EDPS welcomes that recital 14 refers to the applicability of

text: Regulation (EU) 2016/679

text: (‘the GDPR’) when personal data are processed in the context of the Proposal by competent authorities for the purpose of verifying the eligibility requirements or determining the tax liability of permanent establishments.

text: 7. The EDPS positively notes the introduction of specific provisions on ‘data protection’ in the enacting terms of the Proposal.

text: Article 18

text: establishes the purposes for which competent authorities in EU Member States may process personal data, determines that such competent authorities shall act as controllers for the purposes of the GDPR, and defines personal data retention periods. At the same time, the EDPS considers that the content of these provisions should be developed further in order to ensure respect for the fundamental rights to privacy and to the protection of personal data enshrined in Article 7 and 8 of the Charter of Fundamental Rights of the European Union.

text: 3. Purposes of the processing

text: 8. Article 18(1) of the Proposal would allow competent authorities in EU member States to process personal data for the purpose of verifying the eligibility requirements or to determine the tax liability as referred to in Articles 4, 9 and 11 of the Proposal. The EDPS welcomes that the Proposal explicitly defines the purposes of the processing of personal data and also makes explicit reference to the specific provisions of the Proposal that would provide the legal basis for the processing.

text: 4. Retention period

text: 9. The EDPS welcomes the introduction, in Article 18(2) of the Proposal, of a maximum retention period of 10 years for the retention of personal data by competent authorities to achieve the purposes of the Directive, in particular, verification of eligibility requirements and determination of the tax liability of the taxpayers. He also positively notes that

text: Article 18(2)

text: 10. As currently drafted, however, the starting point of the retention period may not be entirely clear. The EDPS recommends clarifying that the starting point for the maximum retention period of 10 years is the moment when personal data are processed for the purposes specified in the Proposal. In addition, the EDPS recommends the co-legislator to consider further whether a maximum retention period of 10 years is really needed and to limit the maximum period to what is strictly necessary.

text: 5. Conclusions

text: 11. In light of the above, the EDPS makes the following recommendations: (1) to clarify the starting date of the data retention period foreseen in Article 18(2) of the Proposal and to limit the maximum retention period to what is strictly necessary. Brussels, 3 November 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 6


text: COM (2023) 529 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM (2023) 529 final. 4 COM (2023) 529 final, p. 1. OECD Transfer Pricing Guidelines for Multinational Enterprises and Tax Administrations (https://www.oecd.org/tax/transferpricing/oecd-transfer-pricing-guidelines-for-multinational-enterprises-and-tax-administrations-20769717.htm) 6 COM (2023) 529 final, p. 4. 4

text: The Court of Justice of European Union in Joint Cases C92/09, Volker und Markus Schecke Gbr v. Land Hessen, and

text: , Eifert v. Land Hessen and Bundesanstalt für Landwirtschaft und Ernahrung, ruled that the name of a legal person is to be considered personal data if the official title of the legal person identifies one or more natural persons. 5

identifier: EDPS yttrande 51/2023

title: EDPS Opinion 51/2023 on the Proposal for a Directive on transfer pricing

text: 3 November 2023

text: Opinion 51/2023

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal on a Council Directive on transfer pricing . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 12 September 2023, the European Commission issued the Proposal on a Council Directive on transfer pricing (‘the Proposal’). The Proposal aims at increasing tax certainty by introducing the ‘arm’s length principle’ into EU legislation and ensuring its coherent application across the Union, clarifying the role of the Organisation for Economic Co-operation and Development (OECD) Transfer Pricing Guidelines, and reducing double taxation as well as double non-taxation.

text: The EDPS welcomes the fact that the Proposal includes specific provisions on data protection that seek to specify the purposes of the personal data processing, identify the controllers involved in the processing, and determine how long personal data may be processed.

text: To enhance legal certainty and foreseeability, the EDPS recommends to further clarify the specific purposes of the processing of personal data in the context of the Proposal. In addition, the EDPS recommends clarifying the starting date of the proposed retention period and to ensure that the maximum retention period remains limited to what is strictly necessary.

text: Having regard to

text: Regulation (EU) No 2018/1725

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 12 September 2023, the European Commission issued the Proposal on a Council Directive on transfer pricing (‘the Proposal’).

text: 2. The objective of the Proposal is to harmonize transfer pricing rules within the Union and to ensure a common approach to transfer pricing problems. Transfer pricing is described as a mechanism for determining the pricing of transactions between related entities of a multinational group. The Commission indicates that, according to the current international standards, such transactions must be priced on the same basis as transactions between third parties under comparable circumstances. This is known as the ‘arm’s length principle’ .

text: 3. More specifically, the draft Proposal aims at incorporating the arm’s length principle into Union law, clarifying the role and status of the Organisation for Economic Co-operation and Development (OECD) Transfer Pricing Guidelines and creating the possibility to establish common binding rules on specific subjects within the Union, within the framework of the OECD Transfer Pricing Guidelines .

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 13 September 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 23 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 5. The EDPS understands that data that would be processed in the context of the Proposal would mainly be non-personal data, or personal data in the context of data processing related to legal persons. At the same time, the EDPS welcomes that recital 19 of the Proposal refers to the applicability of

text: Regulation (EU) 2016/679

text: (‘the GDPR’), when personal data are processed within the framework of the Proposal.

text: 6. The EDPS recalls that even information on economic operators that are legal persons might in some cases be considered as personal data. In these cases, the determining factor is whether the information ‘relates to’ an ‘identifiable’ natural person .

text: 7. The EDPS positively notes the introduction of specific provisions on data protection in the enacting terms of the Proposal.

text: Article 16

text: refers to the purposes of the personal data processing, and provides specifications on the determination of actors responsible for the processing of personal data and on data retention periods. At the same time, the EDPS considers that the content of some of these provisions should be developed further in order to ensure respect for the fundamental rights to privacy and to the protection of personal data enshrined in Article 7 and 8 of the Charter of Fundamental Rights of the European Union.

text: 3. Purposes of the processing

text: 8. According to Article 16(1) of the Proposal, ‘Member States may process personal data for the purposes of applying the Directive’. The EDPS considers that the mere reference to the purposes of ‘applying the Directive’ is not sufficient to clearly specify them, in accordance with Article 8 of the Charter of fundamental rights of the EU and

text: Article 5(1)

text: (b) of the GDPR.

text: 9. It should be recalled that purpose limitation is among the key principles of the EU data protection framework, laid down in Article 5 of the GDPR. It is an essential safeguard to provide individuals with the confidence that their data will not be used against them in an unexpected manner. Purpose limitation requires, on the one hand, that personal data are collected for specified, explicit and legitimate purposes and, on the other hand, that personal data are not further processed in a manner that is incompatible with those purposes. Therefore, the EDPS recommends that the co-legislators clearly identify the purposes of the processing of personal data in the context of the Proposal.

text: 10. Moreover, the EDPS also recalls that, in line with the data minimisation principle laid down in

text: Article 5(1)

text: (c) of the GDPR, the collection of personal data should be limited to what is necessary to fulfil the purposes for which they are processed.

text: 4. Retention period

text: 11. The EDPS welcomes the introduction, in Article 16(2) of the Proposal, of a maximum retention period of 10 years for the storage of personal data to achieve the purposes of the Directive. He also positively notes that

text: Article 16(2)

text: makes clear that the retention period may be shorter, having regard to the national laws on the statute of limitations applicable in each Member State.

text: 12. As currently drafted, however, the starting point of the retention period may not be entirely clear. The EDPS recommends clarifying that the starting point for the maximum retention period of 10 years is the moment when personal data are processed for the purposes specified in the Proposal. In addition, the EDPS recommends the co-legislator to consider further whether a maximum retention period of 10 years is really needed and to limit the maximum period to what is strictly necessary.

text: 5. Conclusions

text: 13. In light of the above, the EDPS makes the following recommendations: (1) to further clarify the specific purposes of the processing of personal data to be carried out in application Chapter IV of the Proposal; (2) to clarify the starting date of the data retention period foreseen in the Proposal and to limit the maximum retention period to what is strictly necessary. Brussels, 3 November 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 6