text: COM(2022) 707 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2022) 707 final. 4 COM(2022) 707 final, p. 1-3.

text: Council Directive 2011/16/EU of 15 February 2011

text: on administrative cooperation in the field of taxation and repealing Directive

text: , OJ L 64, 11.3.2011, p. 1–12.

text: EDPS Opinion Opinion 6/2020 on a proposal for an amendment of

text: Council Directive 2011/16/EU

text: relating to administrative cooperation in the field of taxation, issued on 28 October 2020. According to this Opinion, paragraph 18, the EDPS “considers that it cannot be excluded that the Commission, contrary to the wording of the Proposal, might have the role of controller or joint controller with the Member State’s competent authorities.” However, in the EDPS formal comments on the Proposal for a Council Directive laying down rules to prevent the misuse of shell entities for tax purposes and amending Directive

text: , the EDPS considers that the role of the Commission as processor appears compatible with limited responsibilities of the Commission. 7

text: Article 1(7)

text: (a) of the Proposal. 8

text: Article 1(7)

text: (b) of the Proposal. 5

text: Article 5 (1)

text: (b) GDPR. 10

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1–88. 11 Judgment of the Court of Justice of 2 March 2023, Norra Stockholm Bygg AB,

text: , ECLI:EU:C:2023:145, paragraph 31. 12 Ibid, paragraph 32. 13 Ibid, paragraph 33. See also paragraphs 36 and 37 (“36. Accordingly, it must be held that the processing of those data in the context of judicial proceedings such as the main proceedings constitutes processing carried out for a purpose other than that for which the data have been collected, namely for the purposes of tax inspection, and which is not based on the consent of the data subjects, within the meaning of

text: Article 6(1)

text: (a) of the GDPR. 37. In those circumstances, the processing of personal data for a purpose other than that for which those data have been collected must not only be based on national law, such as the provisions of Chapter 38 of the RB, but also constitute a necessary and proportionate measure in a democratic society, within the meaning of Article 6(4) of the GDPR, and safeguard one of the objectives referred to in Article 23(1) of the GDPR.”). 6

text: See recital (50) GDPR. 15 Article 1(6) of the Proposal, inserting

text: Article 8

text: ad(10). 16 Article 1(6) of the Proposal, inserting

text: Article 8

text: ad(4). 17 Article 1(6) of the Proposal, inserting

text: Article 8

text: ad(10). 18 Article 1(9) of the Proposal, amending

text: Article 21

text: . 7

text: Article 1(9) of the Proposal, inserting paragraph 5a. 20 Article 1(9) of the Proposal, inserting

text: Article 21

text: (5a). 21 See

text: Article 89 (1)

text: GDPR and

text: Article 13

text: EUDPR.

text: Article 13

text: EUDPR states that: “Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.” 8

identifier: EDPS yttrande 09/2023

amnesord:
Access to documents
Transfers of data
Tax cooperation

title: EDPS Opinion on the Proposal for a Council Directive amending Directive 2011/16/EU on administrative cooperation in the field of taxation

text: 3 April 2023

text: Opinion 9/2023

text: on the Proposal for a Council Directive amending Directive

text: on administrative cooperation in the field of taxation

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Council Directive (EU) amending Directive

text: on administrative cooperation in the field of taxation . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: With this Opinion, issued pursuant to

text: Article 42(1) of Regulation (EU) 2018/1725

text: , the EDPS puts forward recommendations on the Proposal for a Council Directive amending Directive

text: on administrative cooperation in the field of taxation having regard to the fundamental rights to privacy and to the protection of personal data (‘the Proposal’).

text: The EDPS welcomes the objectives pursued by the Proposal, notably to ensure tax administrations have access to information that is necessary to perform their duties effectively and to strengthen the general compliance with the provisions of Directive

text: . Against this background, the EDPS makes a number of recommendations aiming at ensuring full compliance of the Proposal with the applicable data protection legal framework.

text: Reuse of personal data for a different purpose by the competent authority of a Member State may only be allowed if it is grounded in Union or Member State law on the basis of which the further processing is lawfully authorised, constituting a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in

text: Article 23(1)

text: GDPR. To provide a higher level of harmonisation and legal certainty, the EDPS considers that the Proposal should provide an (exhaustive) list of the purposes for which personal data might be further processed.

text: As regards access by the Commission to the information recorded in the central directory on administrative cooperation in the field of taxation, the EDPS recommends clarifying which specific obligations of the Commission under the Directive warrant access to the information recorded in the central directory and to clearly specify the purpose of such access.

text: The EDPS welcomes, as a matter of principle that the Proposal aims to further clarify the roles and responsibilities of the Member States and the Commission within the meaning of data protection law. At the same time, the EDPS notes that

text: Article 25(3) of Directive 2011/16/EU

text: (both in its current form and as it would be amended by the Proposal) defines the respective roles of the Member States and Commission within the meaning of data protection law in a horizontal manner. To avoid unnecessary duplication, the EDPS recommends deleting the last two sentences of

text: Article 8

text: ad(10) as provided in Article 1(6) of the Proposal. Concerning

text: Article 25(3)

text: as it would be amended by the Proposal, the EDPS recommends clearly indicating in which cases the entities involved in the data processing shall be considered as a controller (alone) and when they shall be considered as joint controller.

text: Finally, the EDPS considers that the Proposal should provide not only for minimum, but also for a maximum period of storage duration. In addition, the Proposal should specify that the records of information received through the exchange of information must be deleted after the maximum data retention period, or earlier, if they are no longer necessary.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 8 December 2022, the European Commission issued a Proposal for a Council Directive (EU) amending Directive

text: on administrative cooperation in the field of taxation (‘the Proposal’) .

text: 2. The objectives of the Proposal are : - to introduce provisions for the reporting, due diligence and exchange of information on certain crypto-assets and e-money; - to introduce the obligation for the competent authorities of the Member States to exchange information on tax rulings with a cross-border element concerning high net worth individuals; - to introduce provisions on penalties to be applied to infringements of the national provisions transposing Directive

text: (‘the Directive’) .

text: 3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 9 February 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in recital 43 of the Proposal. The EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General comments

text: 4. The EDPS welcomes the objectives pursued by the Proposal, notably to ensure tax administrations have access to information that is necessary to perform their duties 4 effectively and to strengthen the general compliance with the provisions of the Directive. The initiative will require in particular crypto-assets service providers to report relevant information to the competent authorities of the Member States on crypto-transactions.

text: 5. The EDPS recalls that on 28 October 2020 issued his Opinion on a proposal for an amendment of

text: Council Directive 2011/16/EU

text: relating to administrative cooperation in the field of taxation . The EDPS recalls that in his Opinion he highlighted the importance of the implementation of the principles of data protection by design and by default, data minimisation and data accuracy in the context of automatic exchanges of information between national tax authorities. Compliance with this principle is also relevant having regard to the implementation of the exchanges of information pursuant to the Proposal.

text: 6. The Proposal specifies, in recital 44, that it respects the fundamental rights and observes the principles recognised by the Charter of Fundamental Rights of the European Union. In particular, the Proposal ‘seeks to’ ensure full respect for the right of protection of personal data laid down and the freedom to conduct business. The EDPS recommends deleting the words ‘seeks to’ in order to indicate clearly that the Proposal ‘ensures’ full respect for the right of protection of personal data laid down in Article 8 of the Charter. In addition, the EDPS recommends to explicitly recall in the recital the applicability of GDPR and EUDPR to the processing of personal data in the context of the Proposal.

text: 3. Specific comments

text: 3.1. Purpose limitation

text: 7. The EDPS observes that the Proposal would amend Article 16(1) of the Directive to provide that the information to be exchanged pursuant to the Directive may be used for the assessment, administration and enforcement of the national law of Member States concerning the taxes referred to in Article 2 of the Directive as well as VAT, other indirect taxes, customs duties and anti-money laundering and countering the financing of terrorism .

text: 8. The EDPS notes that Article 16(2) of the Directive, as it would be amended by the Proposal, also provides for the possibility for the competent authority receiving the information to use the information and documents received pursuant to this Directive for other purposes than those referred to in

text: Article 16(1)

text: . However, this can be done only with the permission of the competent authority of the Member State communicating the information, and only in so far as this is allowed under the legislation of the Member State of the competent authority receiving the information .

text: 9. The EDPS also notes that the revised wording of

text: Article 16(2)

text: would allow for the use of information for other purposes than those referred to in

text: Article 16(1)

text: without the permission of the authority sending the information. However, this can be done only in accordance with national law and to the extent that the information and documents to be used and the intended purposes are referred to in a list which is made publically available by the competent authority of each Member State and which is also communicated to the competent authorities of all other Member States.

text: 10. Furthermore,

text: Article 16(2)

text: as it would be amended by the Proposal provides that the competent authority that receives the information may use it without the permission of the sending Member State for any purpose that is covered by an act based on Article 215 of the Treaty on the Functioning of the European Union (TFEU) and share it for such purpose with the competent authority in charge for restrictive measures in the Member State concerned.

text: 11. The EDPS recalls that the purpose limitation principle requires that any processing of personal data must be done for a specified, explicit and legitimate purpose and not further processed in a manner that is incompatible with the original purpose .

text: 12. Any processing of personal data, including processing carried out by public authorities such as competent authorities in charge of taxation, must satisfy the conditions of lawfulness set by

text: Article 6 of Regulation (EU) 2016/679

text: (‘GDPR’) . In this regard, according to

text: Article 6(1)

text: (e) GDPR, the processing of personal data is lawful if it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In addition, according to

text: Article 6(1)

text: (c) GDPR, the processing of personal data is lawful if it is necessary for compliance with a legal obligation to which the controller is subject. In accordance with

text: Article 6(3)

text: GDPR, read in combination with recital 45 GDPR, the basis for the processing referred to in

text: Article 6(1)

text: (e) or (c) is to be defined by EU law or by Member State law to which the controller is subject. Moreover, the EU or Member State law must meet an objective of public interest and be proportionate to the legitimate aim pursued . The combined provisions of

text: Article 6(1)

text: (e) or (c) GDPR and

text: Article 6(3)

text: therefore require a legal basis, EU or Member State law, which serves as a basis for the processing of personal data by the relevant controllers .

text: 13. Where the processing of personal data is carried out for a purpose other than that for which those data have been collected, it follows from

text: Article 6(4)

text: GDPR that such processing is allowed provided that it is based on EU or Member State law and that it constitutes a necessary and proportionate measure in a democratic society to safeguard one of the objectives referred to in

text: Article 23(1)

text: GDPR .

text: 14. It is important to recall that, in order to safeguard the objective of general public interest, the controller (in the case at hand, the competent taxation authority) would thus be allowed to further process the personal data regardless of the compatibility of that processing with the purposes for which the personal data were initially collected .

text: 15. Consequently, the Proposal should clarify that any personal data received may only be used for a different purpose if the further processing is based on EU or Member State law that constitutes a necessary and proportionate measure in a democratic society to safeguard one of the objectives referred to in

text: Article 23(1)

text: GDPR.

text: 16. In order to provide a higher level of harmonisation and legal certainty, the EDPS additionally recommends to provide in the Proposal itself an (exhaustive) list of purposes for which personal data might be further processed.

text: 3.2. Central register for the exchange of information reported by Reporting Crypto-Asset Service Providers

text: 17. The Proposal provides that the Commission shall establish a central register (‘the central register’) to support the mandatory automatic exchange of information reported by Reporting Crypto-Asset Service Providers . The practical arrangements necessary for the establishment of the central register will be adopted by the Commission .

text: 18. The EDPS notes that the categories of information that may be processed in the central register are specified in subparagraph F(2) of Section V of Annex V . In addition, information to be communicated in the framework of

text: Article 8

text: ad(2) and (3) will be recorded in the central directory on administrative cooperation in the field of taxation (see further Section 3.3. of this Opinion) .

text: 19. The EDPS notes that

text: Article 8

text: ad(10), as provided by the Proposal, defines the Commission’s role and responsibilities within the meaning of data protection law in relation to the central register. According to this Article, the Commission, when processing personal data for the purpose of this Directive must be considered to process the personal data on behalf of the controllers and must comply with the requirements for processors in the EUDPR. Moreover,

text: Article 8

text: ad(10) specifies that the processing of personal data will be governed by a contract within the meaning of

text: Article 28(3)

text: GDPR and

text: Article 29(3)

text: EUDPR.

text: 20. The EDPS welcomes, as a matter of principle, that the Proposal seeks to define the role and responsibilities of the actors involved in the processing. The EDPS notes, however, that Article 25(3) of the Directive (both in its current form and as it would be amended by the Proposal), defines the respective roles of the Member States and Commission within the meaning of data protection law in a horizontal manner (i.e. as regards ‘all exchange of information pursuant to this Directive’) (see further section 3.5 of this Opinion). To avoid unnecessary duplication, the EDPS recommends deleting the last two sentences of

text: Article 8

text: ad(10) as provided in Article 1(6) of the Proposal.

text: 3.3. Central directory on administrative cooperation in the field of taxation

text: 21. The EDPS notes that the Proposal provides that the Commission, acting on behalf of the Member States, will develop and provide with technical and logistical support a central directory on administrative cooperation in the field of taxation (‘the central directory’), where the information to be exchanged between competent authorities under

text: Article 8

text: ad(2) and (3) will be recorded .

text: 22. According to recital 36 of the Proposal, the central directory would be accessible to the Member States and only for statistical purposes to the Commission. In this regard, the EDPS notes that the specification on the access only for statistical purpose by the Commission is not explicitly reflected in the enacting terms of the Proposal as such, which provide that “The Commission shall also have access to the information recorded in that directory for the purposes of complying with its obligations under this Directive, however with the limitations set out in

text: Article 8

text: Article 8

text: ab(17) and

text: Article 8

text: 23. The EDPS recommends resolving the discrepancy between recital 36 of the Proposal and the enacting terms, in particular clarifying which specific obligations of the Commission under the Directive warrant access to the information recorded in the central directory, s well as what the specific purpose of such access shall be. Moreover, the EDPS recalls that, pursuant to Article 21(7) of the Directive, the Commission shall have only have access to anonymous and aggregated data for statistical purposes.

text: 24. The EDPS recalls that

text: Article 13

text: EUDPR and

text: Article 89

text: GDPR stipulate that when personal data are (further) processed for statistical purposes, those data shall in principle be rendered anonymous (or alternatively pseudonymous), provided that the statistical purpose be fulfilled in this manner . In this regard, the EDPS notes that

text: Article 21(7) of Council Directive 2011/16/EU

text: already provides that “[f]or the purpose of collecting statistics, the Commission shall have access to information about the exchanges recorded to the interface and which can be extracted automatically. The Commission shall have only access to anonymous and aggregated data”.

text: 3.4. Amendments to Article 25 of the Proposal

text: 25. Article 25(3) of the Directive, as it would be amended by the Proposal, specifies that Reporting Financial Institutions, intermediaries, Reporting Platform Operators, Reporting Crypto-Asset Service Providers and the competent authorities of Member States shall be considered to be controllers, ‘acting alone or jointly’. When processing personal data for the purpose of this Directive, the Commission shall be considered to process the personal data on behalf of the controllers and shall comply with the requirements for processors in

text: 26. The EDPS welcomes that the Proposal aims to further clarify the roles and responsibilities of the Member States and the Commission within the meaning of data protection law. However, the EDPS considers that the Proposal should clearly indicate in which cases the entities involved in the processing shall be considered as a controller (alone) and when they shall be considered as joint controllers. In this regard, the EDPS notes that the Explanatory Memorandum to the Proposal indicates that the Member States act as joint controllers .

text: 3.5. Storage duration

text: 27. The EDPS notes that Article 22 of the Directive as it would be amended by the Proposal provides for a retention period for all records of information received through the exchange of information between Member States pursuant to

text: Articles 8

text: to 8ad of the Directive of a minimum of five years from the date of receipt by the receiving competent authority .

text: 28. The EDPS recalls that the principle of storage limitation requires that personal data are stored in a form that permits identification of data subjects for no longer than is necessary for the purpose for which the personal data are processed. Therefore, the Proposal should contain a (harmonised) maximum, not only a minimum, data retention period.

text: 29. The EDPS also recommends specifying in

text: Article 22

text: 3.6. Implementing acts

text: 30. The EDPS notes that, in accordance with the new

text: Article 8

text: ad(9), the Commission shall, by means of implementing acts, lay down the practical arrangements necessary for the registration and identification of Reporting Crypto-Asset Service Providers.

text: 31. In this regard, the EDPS recalls that, when a proposal for legislation has a possible impact on the protection of personal data, the European Commission has to submit it to the EDPS for consultation.

text: 4. Conclusions

text: 32. In light of the above, the EDPS makes the following recommendations: (1) to indicate that the Proposal ensures full respect for the right of protection of personal data laid down in Article 8 of the Charter and to recall the applicability of GDPR and the EUDPR to the processing of personal data in the context of the Proposal; (2) to clarify that the reuse of personal data by the competent authority of each Member State may only be allowed if it is grounded in Union or Member State law which lays down a list of purposes for which the further processing may be lawfully authorised constituting a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in

text: Article 23(1)

text: GDPR and to provide in the Proposal itself an (exhaustive) list of purposes for which personal data might be further processed; (3) to amend the enacting terms of the Proposal to clarify which specific obligations of the Commission under the Directive warrant access to the information recorded in the central directory; (5) concerning Article 25(3) of the Directive as it would be amended by the Proposal, to clearly indicate in which cases the entities involved in the processing shall be considered as a controller (alone) and when they shall be considered as joint controllers; (6) to provide for a maximum period of storage duration and to specify that the records of information received through the exchange of information must be deleted after the maximum data retention period, or earlier, if they are no longer necessary. Brussels, 3 April 2023 [e-signed] Wojciech Rafał WIEWIÓROWSKI 10


text: COM(2023) 779 final. 1

text: COM(2023) 779 final, p 3. COM(2023) 779 final, p 8. 7 Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, Chemicals Strategy for Sustainability Towards a Toxic-Free Environment, COM (2020) 667 final, p. 17. 8 Communication from the Commission to the European Parliament, the European Council, the Council, the European Economic and Social Committee and the Committee of the Regions, The European Green Deal, COM (2019) 640 final, p. 15. 9 Recital 2 of the Proposal. 10 See in particular recitals 16, 24, 25 and

text: Article 6(3)

text: -(6) of the Proposal. 11

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1). 5

text: See Article 6(3) of the Proposal. 15 Article 6(5) of the Proposal. The anonymised data would be made available through the Information Platform for Chemical Monitoring (‘IPCHEM’), a dedicated service of the common data platform pursuant to

text: Article 3(5)

text: (c) of the Proposal. 16 Article 6(2) of the Proposal. 17 Article 5(5) of the Proposal. 18 Anonymous, pseudonymous or identifiable data. 19 See

text: Article 6(3)

text: and (4) and recital 24 of the Proposal. 7

text: As defined in Article 2(2) of the Proposal. 21

text: Article 5(2)

text: , second sentence, provides that the Commission or the Agencies shall indicate whether that data or information is made available to the public under the originating Union act. The EDPS therefore understands that if such data is not made available to the public under the originating Union act, such data is considered to be ‘confidential data’. 8

identifier: EDPS yttrande 09/2024

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 9/2024 on the Proposal for a Regulation establishing a common data platform on chemicals

serie: yttranden

text: 29 January 2024

type: rubrik

text: Opinion 9/2024

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council establishing a common data platform on chemicals, laying down rules to ensure that the data contained in it are findable, accessible, interoperable and reusable and establishing a monitoring and outlook framework for chemicals .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: The EDPS welcomes the objectives of the Proposal, namely to ensure the efficient delivery of coherent hazard and risk assessments of chemicals to achieve a high level of protection of human health and the environment, to enable the development and use of sustainable chemicals, to ensure the proper functioning of the single market for chemicals, and to improve the Union’s citizens’ trust in the scientific base for the decisions taken under Union legal acts on chemicals.

text: While the Proposal focuses mainly on the processing of chemicals data, the EDPS notes that the Proposal also envisages the processing of personal data, albeit to a limited extent. The EDPS therefore suggests a number of clarifications in relation to the provisions that are relevant from a data protection perspective.

text: The Proposal provides for the establishment and management by the European Chemicals Agency of a common data platform on chemicals, providing access to chemicals data. Insofar as personal data is processed via this platform, the EDPS considers that the future Regulation should specify the roles within the meaning of data protection law. In particular the Proposal should clarify the role of the European Chemicals Agency as the manager of the platform, and of the entities providing personal data to which the common data platform provides access.

text: The Proposal also provides rules on the processing of human biomonitoring data by the European Environment Agency (‘EEA’), which may involve the processing of personal data. The EDPS positively notes the attention paid to data protection aspects in this regard. In particular the EDPS welcomes the explicit indication that the EEA shall make human biomonitoring data they hold or host publicly available only in anonymised form through the Information Platform for Chemical Monitoring. The EDPS suggests however further clarifications with regard to the processing of human biomonitoring personal data carried out by the EEA. He recommends clarifying that any processing of biomonitoring data constituting personal data by the EEA for the purposes set out in the Proposal shall not entail the sharing of such data with third parties. Furthermore, the EDPS recommends to provide in the Proposal the obligation for the EEA to inform the providers of human biomonitoring data of the type of data that they should make available to the EEA. The EDPS recalls that when personal data are processed for scientific research and statistical purposes those data shall, in principle, be rendered anonymous (or alternatively pseudonymous), provided that the purposes can be fulfilled in this manner.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 7 December 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council establishing a common data platform on chemicals, laying down rules to ensure that the data contained in it are findable, accessible, interoperable and reusable and establishing a monitoring and outlook framework for chemicals (‘the Proposal’).

text: 2. The objective of the Proposal is to ensure the efficient delivery of coherent hazard and risk assessments of chemicals where those assessments are required by Union legal acts, to achieve a high level of protection of human health and the environment, to enable the development and use of sustainable chemicals, to ensure the proper functioning of the single market for chemicals, and to improve the Union’s citizens’ trust in the scientific base for the decisions taken under Union legal acts on chemicals .

text: 3. In order to fulfil the commitment to start using the ‘one substance, one assessment’ approach and in order to collate relevant information on the safety and sustainability of chemicals and on early warning signals for chemicals risks, the Proposal aims to: • develop a common data platform bringing together chemicals data from multiple sources, including environmental sustainability-related data; • ensure that information contained in the common data platform is secure, of high quality, findable, accessible, interoperable and re-usable; • enable the commissioning of testing and monitoring of substances as part of the regulatory framework when further information is considered necessary; • keep records of studies commissioned or carried out by businesses in a chemicals regulatory context and set up an early warning system for emerging chemical risks; • establish a monitoring and outlook framework for chemicals .

text: 4. The Proposal would not create any new data requirements. Instead, the Proposal aims to streamline information flows and to centralise the data collected under current EU legislation.

text: 5. The development of a common open data platform on chemicals was already announced in the Chemicals Strategy for Sustainability , which in its turn was announced by the European Green Deal .

text: 6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 7 December 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 51 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of the EUDPR.

text: 2. General remarks

text: 7. The EDPS welcomes the objective of the Proposal to increase the level of protection of the environment and human health from the risks arising from hazardous chemicals, as well as to facilitate the functioning of the internal market for chemicals .

text: 8. While the Proposal focuses mainly on the processing of chemicals data, the EDPS notes that the Proposal also envisages the processing of personal data , albeit to a limited extent. The EDPS recommends to clarify in the recitals that any processing of personal data pursuant to the Proposal should be carried out in accordance with Union law on the protection of personal data. In that regard, any processing of personal data by the Union institutions, bodies, offices and agencies shall take place in accordance with the EUDPR. Similarly, the future regulation should clarify that any processing of personal data pursuant to this Proposal by competent authorities of the Member States or researchers or research consortia should take place in accordance with

text: Regulation (EU) 2016/679

text: (‘GDPR’) .

text: 9. With the remainder of this Opinion, the EDPS suggests a number of additional clarifications in relation to the provisions of the Proposal that are relevant from a data protection perspective.

text: 3. Common data platform on chemicals

text: 10. Article 3(1) of the Proposal provides that the European Chemicals Agency (‘ECHA’) shall establish and manage a common data platform on chemicals (‘the common data platform’). Article 3(2) of the Proposal provides that the common data platform shall provide access to all chemicals data: • generated or submitted as part of the implementation of the Union acts listed in Annex I to this Regulation and held by the Agencies or the Commission; • generated as part of Union, national or international programmes or research activities in the sphere of chemicals and held by the ECHA, the EEA, the EFSA, the EU-OSHA or the Commission; • listed in Annex II and held by the EMA.

text: 11. Although the platform is primarily meant to host data concerning chemicals , the EDPS understands that information to which the common data platform would provide access may in some instances also include or constitute personal data (e.g., the contact details of the chemicals data owner).

text: 12. As the common data platform will bring together data originating from different entities, the EDPS recommends to clarify their roles within the meaning of data protection law (i.e. as controller, joint controller(s), or processor). In particular the Proposal should clarify the role of the European Chemicals Agency as the manager of the platform, and the entities providing personal data to which the common data platform provides access.

text: 4. Human biomonitoring data

text: 13. Article 6 of the Proposal concerns human biomonitoring data, defined as concentrations of chemicals measured in human matrices such as blood or urine . The EDPS understands that human biomonitoring data should be considered as a type of chemicals data as referred to in Articles 2(10) and 3(2) of the Proposal.

text: 14. As human biomonitoring data can also constitute personal data , the EDPS welcomes the specification that the European Environment Agency (‘EEA’) shall (only) make such data publicly available in anonymised form .

text: 15. The EDPS also positively notes that Article 6(6) of the Proposal clearly designates the EEA as the controller for the human biomonitoring personal data it holds or hosts and processes for the purposes referred to in paragraph 2. For the sake of completeness, the EDPS considers that the reference to paragraph 2 should be replaced with a reference to paragraphs 3, 4 and 5.

text: 16. In addition, the EDPS welcomes that Article 6(4) of the Proposal clearly specifies the purposes of the processing of biomonitoring data constituting personal data. He understands that these purposes are meant to achieve the objective of providing support to the Commission and Agencies, as provided for in Article 6(3) of the Proposal. For the sake of legal certainty, the EDPS therefore considers it necessary that

text: Article 6(4)

text: provides an explicit reference to Article 6(3) of the Proposal.

text: 17. With regards to Article 6(4) of the Proposal, the EDPS also recommends clarifying that any processing of biomonitoring data constituting personal data by the EEA for the purposes stipulated in this Article shall not entail the sharing of such data with third parties, as the purposes can be achieved without any further sharing of such data.

text: 18. The EDPS understands that the EEA would receive human biomonitoring data from the Commission , and from researchers or research consortia funded by Union framework programmes . In the interest of legal certainty, the EDPS recommends to clarify in the Proposal whether the EEA would also receive such data from any other sources, either at national or Union level.

text: 19. The EDPS further recommends to provide in the Proposal the obligation for the EEA to inform the providers of human biomonitoring data of the type of data that they should make available to the EEA, taking into account the public interests which the EEA is meant to achieve. These processing operations in the public interests may also entail processing for scientific, research or statistical purposes. The EDPS recalls that according to

text: Article 89

text: GDPR and

text: Article 13

text: EUDPR, processing for such purposes shall be subject to appropriate safeguards. Moreover, they stipulate that, when personal data are processed for these purposes, those data shall, in principle, be rendered anonymous (or alternatively pseudonymous), provided that the purposes can be fulfilled in this manner. The EDPS therefore recommends to also make explicit reference to

text: Article 89

text: GDPR and

text: Article 13

text: EUDPR in a recital to the Proposal.

text: 20. Regarding human biomonitoring data constituting personal data processed by the EEA, the EDPS recalls that it should not be kept in a form which permits identification of data subjects longer than is necessary for the purposes for which the personal data are processed. The EDPS considers it necessary that the appropriate storage period for the EEA to hold the data is specified in the future regulation, or that the future regulation provides for an implementing or delegated act that will define such storage period.

text: 5. Access rights to the common data platform on chemicals and transparency

text: 21. Article 16(1) of the Proposal provides the Authorities with access to all the chemicals data in the common data platform, including data which is deemed to be confidential under

text: Article 5(2)

text: , second sentence .

text: 22. The EDPS recalls that any processing of personal data by Authorities, including access to chemicals data in the common data platform, should comply with the data minimisation principle. Therefore, the EDPS considers that the Proposal should clarify that the access rights of Authorities to personal data in the common data platform shall be limited to what is necessary in relation to the purposes for which personal data are processed by Authorities.

text: 6. Implementing and delegated acts

text: 23. Article 4(1) of the Proposal provides that the Commission shall adopt and publish an implementation plan identifying datasets for inclusion in the common data platform together with a timeline for their inclusion by means of an implementing decision.

text: Article 4(4)

text: provides for the adoption of a Commission implementing decision adopting and publishing the governance scheme, further detailed in

text: Article 4(5)

text: Article 4(5)

text: (e) states that the governance scheme shall, among others, describe any other rules or requirements necessary for the operation of the common data platform such as the data update, archiving and deletion policy. With regard to the archiving and deletion policy, the EDPS recalls that insofar personal data is concerned, it should not be kept in a form which permits identification of data subjects longer than is necessary for the purposes for which the personal data are processed. This should be taken into account when defining the storage period in the implementing decision. Furthermore, Article 23 of the Proposal empowers the Commission to adopt delegated acts to amend Annexes I, II, and III of the Proposal for the purposes specified in the provision.

text: 24. The EDPS recalls that, when a proposal for a delegated or implementing act has a possible impact on the protection of personal data, the European Commission is required to submit it to the EDPS for consultation in accordance with

text: Article 42

text: EUDPR.

text: 7. Conclusions

text: 25. In light of the above, the EDPS makes the following recommendations: (1) clarify in the recitals that any processing of personal data pursuant to the Proposal by Union institutions, bodies, offices and agencies shall comply with the EUDPR; (2) clarify in the recitals that any processing of personal data pursuant to the Proposal by competent authorities of the Member States or researchers or research consortia shall comply with the GDPR; (3) clarify the role of the European Chemicals Agency as the manager of the common data platform, and the entities providing personal data to which the common data platform provides access; (4) replace the reference to paragraph 2 in Article 6(6) of the Proposal with a reference to paragraphs 3, 4 and 5 of the same provision; (5) include a reference to

text: Article 6(3)

text: in

text: Article 6(4)

text: ; (6) clarify that any processing of biomonitoring data constituting personal data by the EEA for the purposes stipulated in Article 6(4) of the Proposal shall not entail the sharing of such data with third parties; (7) clarify whether the EEA receives human biomonitoring data from sources other than the Commission and researchers or research consortia; (8) provide the obligation for the EEA to inform the providers of human biomonitoring data of the type of data that they should make available to the EEA; (9) refer in the recitals to the compliance with

text: Article 89

text: GDPR and

text: Article 13

text: EUDPR regarding the processing of personal data for scientific research and statistical purposes; (10)provide for a storage period for human biomonitoring data constituting personal data held by the EEA, either in the future regulation or in a implementing or delegated act; and (11)clarify that the rights to access to personal data in the common data platform by Authorities pursuant to

text: Article 16(1)

text: shall be limited to what is necessary in relation to the purposes for which they are processed by Authorities. Brussels, 29 January 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 9

type: vagledning

utgivare: edps


text: COM(2025) 101 final 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2025) 101 final. 4 See p. 3 and 5 of COM(2025) 101 final (Explanatory Memorandum of the Proposal) and p. 3 of the Legal, Financial and Digital Statement. p. 3 of the Legal, Financial and Digital Statement. 6

text: Regulation (EU) 2024/1351

text: of the European Parliament and of the Council of 14 May 2024 on asylum and migration management, amending Regulations

text: (EU) 2021/1147

text: and

text: (EU) 2021/1060

text: and repealing

text: Regulation (EU) No 604/2013

text: . OJ L 2024/1351, 22.5.2024. 4

text: See EDPS Opinion 7/2017 on the new legal basis of the Schengen Information System, 2 May 2017; EDPS Opinion 9/2020 on the New Pact on Migration and Asylum 30 November 2020; Formal Comments on the Proposal for a Regulation on the European Border and Coast Guard, issued on 30 November 2018 at the request of the European Parliament; Formal Comments on the Commission Proposal for a Directive on common standards and procedures in Member States for returning illegally staying thirdcountry nationals (recast), issued on 10 January 2019 at the request of the European Parliament. 8

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: , OJ L 119, 4.5.2016, p. 1–88. 5

text: YS v Minister voor Immigratie, Integratie en Asiel and Minister voor See also Judgment of the Court of Justice of 17 July 2014, Immigratie, Integratie en Asiel v M, S, Joined Cases

text: and

text: , at paragraph 48. 10 See further also European Data Protection Board (EDPB), Guidelines 10/2020 on restrictions under

text: Article 23

text: GDPR, Version 2.1, adopted on 13 October 2021, paragraph 20. 6

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89). 12 Judgment of the Court of Justice of 4 June 2013, ZZ v Secretary of State for the Home Department.,

text: Case C‑300/11

text: , ECLI identifier: ECLI:EU:C:2013:363, par. 56 to 69. 7

text: Regulation (EU) 2024/1356

text: of the European Parliament and of the Council of 14 May 2024 introducing the screening of thirdcountry nationals at the external borders and amending Regulations

text: (EC) No 767/2008

text: (EU) 2017/2226

text: (EU) 2018/1240

text: and

text: (EU) 2019/817

text: , OJ L, 2024/1356, 22.5.2024. 14

text: Article 46(2)

text: (a) GDPR and

text: Article 48(2)

text: (a) EUDPR. 15

text: Article 46(3)

text: (b) GDPR and

text: Article 48(3)

text: (b) EUDPR. 16

text: Regulation (EU) 2019/1896

text: of the European Parliament and of the Council of 13 November 2019 on the European Border and Coast Guard and repealing Regulations

text: (EU) No 1052/2013

text: and

text: (EU) 2016/1624

text: , OJ L 295, 14.11.2019, p. 1–131. 8

text: Regulation (EU) 2019/816

text: of the European Parliament and of the Council of 17 April 2019 establishing a centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (ECRIS- TCN) to supplement the European Criminal Records Information System and amending

text: Regulation (EU) 2018/1726

text: , OJ L 135, 22.5.2019, p. 1–26. 18

text: Regulation (EU) 2024/1356

text: (EC) No 767/2008

text: (EU) 2017/2226

text: (EU) 2018/1240

text: and

text: (EU) 2019/817

text: , OJ L, 2024/1356. 9

text: Regulation (EU) 2018/1861

text: of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of border checks, and amending the Convention implementing the Schengen Agreement, and amending and repealing

text: Regulation (EC) No 1987/2006

text: , OJ L 312, 7.12.2018, p. 14–55.

text: Article 19 of Regulation (EU) 2018/1860 of 28 November 2018

text: on the use of the Schengen Information System for the return of illegally staying third-country nationals refers to

text: Regulation (EU) 2018/1861

text: , in particular as regards the review period for alerts, data processing, data protection. 20 See

text: Article 11 of Regulation (EU) 2024/1356

text: (Screening Regulation),

text: Article 19 of Regulation (EU) 2024/1351

text: (Regulation on asylum and migration management) and

text: Article 52 of Regulation (EU) 2018/1861

text: (SIS Regulation in the field of border checks). 10

identifier: EDPS yttrande 09/2025

title: Opinion on the Proposal for a Regulation establishing a common system for the return of third-country nationals staying illegally in the EU

text: Opinion 9/2025

text: on the Proposal for a Regulation establishing a common system for the return of third-country nationals staying illegally in the Union

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council establishing a common system for the return of third-country nationals staying illegally in the Union, and repealing Directive

text: of the European Parliament and of the Council,

text: Council Directive 2001/40/EC

text: and

text: Council Decision 2004/191/EC

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: Council Directive 2001/40/EC

text: and

text: Council Decision 2004/191/EC

text: . This Proposal aims to complement the legislative framework of the Pact on Migration and Asylum adopted in May 2024.

text: The EDPS acknowledges the need for a more effective enforcement of existing EU and national laws in the areas of migration and asylum. At the same time, as stated in the EDPS Strategy 2020- 2024, data protection is one of the last lines of defence for vulnerable individuals, such as migrants and asylum seekers approaching the EU external borders. Therefore, the EDPS considers that the proposed comprehensive approach must be based on full respect to the fundamental rights of persons who seek international protection and other migrants, including their right to data protection and privacy.

text: In the light of the impact of the Proposal on fundamental rights, including on the rights to privacy and to the protection of personal data of the persons concerned, the EDPS considers that an indepth fundamental rights impact assessment should be carried out.

text: The EDPS also recommends to align the information about the rights conferred on data subjects by the applicable Union data protection law to be provided pursuant to Article 24 of the Proposal with the relevant provisions of the already adopted legal acts in the area of migration and asylum. Furthermore, in the context of access to an effective remedy, he stresses that the limitation of the information about reasons in fact of the return decision to the essence of the grounds on which it is taken should not be applied as a rule but only in exceptional cases, where it is strictly necessary, such as where disclosure would be contrary to the interest of State security.

text: In addition, the EDPS highlights the need for additional safeguards in case of transfers to third countries of data relating to criminal convictions of third-country nationals and recommends further specifying the conditions under which personal data of children may be transferred to the third country of return.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 11 March 2025, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council establishing a common system for the return of thirdcountry nationals staying illegally in the Union, and repealing Directive

text: Council Directive 2001/40/EC

text: and

text: Council Decision 2004/191/EC

text: (‘the Proposal’).

text: 2. The objective of the Proposal is to ensure the effective return and readmission of illegally staying third-country nationals by providing Member States with clear, modern, simplified and common rules .

text: 3. In addition, the Proposal pursues several specific objectives, namely (1) creating a more unified approach among Member States rules on returns, overcoming divergent practices by establishing a common EU system for returns and avoiding the potential circumvention of return rules by third-country nationals, (2) streamlining the return procedure, making return rules easy and efficient to apply while improving clarity including on procedural safeguards, and (3) incentivising cooperation by the third-country nationals concerned through a combination of obligations, incentives to cooperate and consequences for non-cooperation .

text: 4. This proposal is part of the comprehensive approach to managing migration as set out in the Asylum and Migration Management Regulation and complements the legislative framework of the Pact on Migration and Asylum adopted in May 2024.

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 12 March, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 55 of the Proposal.

text: 2. General remarks

text: 6. The EDPS understands that the existence of an effective common EU system for returns is an integral element of a comprehensive migration policy of the Union. The EDPS also acknowledges that, in accordance with Article 52(1) of the EU Charter of Fundamental Rights, important objectives of general interest may justify limitations on the exercise of the fundamental rights and freedoms of the individual.

text: 7. At the same time, the EDPS notes with regret that, despite its likely significant impact on the fundamental rights of the persons concerned, the Proposal is not accompanied by an Impact Assessment. Having regard not only to the complexity of the global system of migration management but, first and foremost, to the impact of the Proposal on fundamental rights, including on the rights to privacy and to the protection of personal data of the persons concerned, the lack of an Impact Assessment makes the assessment of necessity and proportionality of the proposed measures more difficult. Therefore, the EDPS calls for an in-depth fundamental rights impact assessment to be delivered before the Proposal is adopted.

text: 8. The Proposal would also provide for the creation of ‘return hubs’, allowing the return of individuals with a final return decision to a third country through bilateral or EU-level agreements. In this regard, the EDPS notes that compliance with data protection rules and principles will need to be ensured, in particular regarding lawful grounds for transfers of personal data.

text: 9. In addition, the EDPS notes that, despite being a regulation, the Proposal would leave an important margin of manoeuver to the Member States when implementing some of its provisions. In order to enhance legal certainty and foreseeability, the EDPS recommends including the Proposal more detailed rules applicable to the processing of personal data in the context of the common procedure for return, in particular as regards the right of access, rectification of inaccurate data, erasure of unlawfully stored data, and the duration of personal data storage.

text: 10. The EDPS recalls his previous opinions and formal comments issued on the different pieces of legislation composing the Pact on Migration and Asylum, which remain relevant in the context of the present opinion.

text: 11. The EDPS welcomes the reference to

text: Regulation (EU) 2016/679

text: (GDPR) and to

text: Regulation (EU) 2018/1725

text: (EUDPR) in Recital 41, as well as the inclusion of a specific chapter dedicated to the ‘sharing and transfer of personal data’. At the same time, this Opinion highlights a number of elements, further specified below, which should be further developed in order to ensure compliance with the EU legal framework for data protection.

text: 3. Information about the reasons of the return decision

text: 12. The EDPS notes that Article 7 of the Proposal lays down the procedure for issuance of return decisions and that paragraph 2 thereof provides for certain procedural safeguards for the affected third-country nationals, including the right to be informed about the “reasons in fact and in law” for the issuance of the return decision.

text: 13. At the same time, Article 7(3) of the Proposal lays down the legal possibility for the competent authorities to limit the information about “reasons in fact” justifying the return decision, or to not provide it at all to the third-country national. The reasons for such restriction, pursuant to the Proposal, could be safeguarding public order, public security or national security and the prevention, investigation, detection and prosecution of criminal offences. The EDPS has already acknowledged that, in accordance with Article 52(1) of the EU Charter of Fundamental Rights, important objectives of general interest may justify limitations on the exercise of the fundamental rights and freedoms of the individual. In this regard, the EDPS notes that in all cases of limiting the information on reasons in fact, referred to in Article 7(3) of the Proposal, the thirdcountry national should be informed of “the essence of the grounds on which a return decision is taken for the purpose of access to an effective remedy”.

text: 14. The aim of the right to information under Article 7 of the Proposal is to support the right to an effective judicial remedy, and thus is separate from and without prejudice to the rights to information and to access under the Union data protection legislation. That being said, the EDPS would like to point out that the ‘reasons in fact’ leading to a return decision are very likely to also contain, if not principally, personal data of the addressee of the decision . Therefore, the EDPS considers that the safeguards and conditions for restrictions of the rights of access under

text: Article 23

text: GDPR should also be taken into account. In accordance with

text: Article 23

text: GDPR, any restriction should respect the essence of the fundamental rights and freedoms and be a necessary and proportionate measure in a democratic society to safeguard one of the interests enumerated in

text: Article 23(1)

text: GDPR. Furthermore,

text: Article 23(2)

text: GDPR provides for a number of specific requirements to be included in the legislative measure laying down the restrictions. It is important to note that the list of possible grounds for restrictions mentioned in

text: Article 23(1)

text: GDPR is exhaustive, meaning that restrictions cannot be carried out under any other conditions .

text: 15. In this context, the EDPS notes that the Proposal includes ‘public order’ as a ground for restriction of the right to information under Article 7 of the Proposal. The EDPS has doubts whether such a broad and general notion as ‘public order’ should be given the same weight as ‘national security’ or ‘investigation of criminal offences’. He also recalls that ‘public order’ is not included among the grounds for restriction enumerated in

text: Article 23(1)

text: GDPR, nor is it included in the similar provision of

text: Article 15 of Directive (EU) 2016/680

text: (Law Enforcement Directive) .

text: 16. The EDPS also recalls the relevant case law of the European Court of Justice, where the Court admits that in a similar context of refusing a citizen of the European Union admission to another Member State it may be necessary not to disclose certain information to the person concerned. However, this should be possible only “in exceptional cases” and should be “limited to that which is strictly necessary”, in particular for reasons of State security . The EDPS notes that Article 7(3) of the Proposal appears to be drafted in much broader terms.

text: 17. In light of the above, the EDPS is convinced that limiting the information to the “essence of the grounds” on which a decision is based should be considered as an exception and not as the rule. Therefore, the EDPS recommends to further circumscribe in Article 7(3) of the Proposal the legal possibility to restrict the information about the reasons in fact on which the return decision is taken, in order to ensure that it is applied only in exceptional cases when it is strictly necessary, such as where disclosure would be contrary to the interest of State security.

text: 4. Special categories of personal data

text: 18. The EDPS notes that the Proposal provides for the processing of special categories of data, including data concerning health, e.g. in the context of information sharing between Member States on ‘vulnerability, health and medical needs of the third-country national’ pursuant to

text: Article 38(6)

text: (k) of the Proposal, or in cases of transfer of health data of third-country nationals to third countries for the purposes of carrying out the return operation and reintegration pursuant to Article 41 of the Proposal.

text: 19. It is the understanding of the EDPS that the current Proposal for Regulation would function as the Union law mentioned in 9(2)(g) GDPR, which sets the legal basis for processing of such data necessary for reasons of substantial public interest. This interpretation is also supported by Recital 41 of the Proposal. Moreover, the EDPS notes that processing of information about vulnerability, health and medical needs of the third-country nationals may generally be considered to be in their own interest.

text: 20. In this context, the EDPS recalls that, pursuant to

text: Article 9

text: GDPR, special categories of data, which include data concerning health, can only be processed under specific conditions. In particular, in accordance with

text: Article 9(3)

text: GDPR, when the processing is necessary for the purpose of a medical diagnosis, data must be processed by or under the responsibility of a professional subject to the obligation of professional secrecy. Similarly,

text: Recital 36

text: of

text: Regulation (EU) 2024/1356

text: (Screening Regulation) explicitly clarifies that health checks should be carried out by qualified medical personnel.

text: 21. In addition, the EDPS considers that, given their sensitive nature, the different categories of biometric data to be shared between Member States for purposes of carrying out the return or readmission procedure or providing reintegration assistance should be exhaustively listed in

text: Article 38(6)

text: (b). In other words, the qualifier ‘in particular’ should be deleted. In addition, the Proposal should define “biometric data”, “facial images” and “dactyloscopic data”, e.g. by referring to definitions already laid down in other legal acts.

text: 5. Transfers of personal data to third countries

text: 22. Articles 39, 40 and 41 of the Proposal are dedicated to transfers of personal data of thirdcountry nationals to third countries. In particular,

text: Article 39

text: relates to transfers of data for the purposes of readmission and reintegration,

text: Article 40

text: relates to the transfers of data relating to criminal convictions of third-country nationals for the same purposes, and

text: Article 41

text: relates to transfers of health data for the purposes of carrying out the return operation and reintegration.

text: 23. The EDPS welcomes the reference in each of these three articles to Chapters V of the GDPR and the EUDPR. However, there is no further consideration of the applicable provisions, especially in case of absence of an adequacy decision pursuant to

text: article 45

text: GDPR, which would be the case for most of the third countries of return. The EDPS understands that in such cases transfers could nevertheless take place on the basis of other legal grounds for transfers provided for in Chapter V of the GDPR and the EUDPR, e.g. on the basis of a legally binding and enforceable instrument between public authorities or bodies , or provisions to be inserted into administrative arrangements between public authorities or bodies which include enforceable and effective data subject rights . The EDPS recalls that in the latter case such administrative arrangements are subject to authorisation from the competent national supervisory authority or the EDPS.

text: 24. In the same vein, given the active role of Frontex in the return procedures, the EDPS reminds that the working arrangements between the Agency and third countries, referred to in

text: Article 73 (4) of Regulation (EU) 2019/1896

text: (Frontex Regulation) , which provide for the transfer of personal data, should be subject to prior authorization by the EDPS.

text: 25. Furthermore, Article 40 of the Proposal would allow the transfer of data to third countries relating to criminal convictions of third nationals. The EDPS recalls that pursuant to

text: Article 10

text: GDPR processing of personal data relating to criminal convictions and offences must be carried out ‘only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects’. Moreover, the EDPS notes that

text: Article 18 of Regulation (EU) 2019/816

text: (ECRIS-TCN Regulation) prohibits the transfer to a third country or an international organisation of information obtained from the EU Centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (ECRIS-TCN) concerning a third-country national.

text: 26. The EDPS positively notes that Article 40 of the Proposal provides for certain safeguards, in particular the transfer should not risk breaching the principle of non-refoulement and Article 50 of the Charter (ne bis in idem). However, the EDPS considers that in such cases the safeguards should be further enhanced and consequently transfers to third countries of data relating to criminal convictions should be subject to a strict necessity test. In addition, he recommends explicitly providing for in the Proposal that the transferred data must not lead to handing down or executing a death penalty or any form of cruel and inhuman treatment.

text: 27. As regards in particular the return of unaccompanied children, Article 20(3) of the Proposal provides that before their removal from the territory of a Member State, ‘the authorities of that Member State shall be satisfied that (the child) be returned to a member of his or her family, a nominated guardian or adequate reception facilities in the country of return’. The EDPS notes, however, that the Proposal does not specify under which conditions the personal data of the child could be transferred to the country of return. As minors constitute an especially vulnerable group within the vulnerable group of migrants, the Proposal needs to ensure that their personal data is only transferred to the countries of origin after a thorough assessment that the transfer is in the minor’s best interest and will not endanger the well-being of the minor.

text: 6. Consistent application of the EU data protection framework

text: 28. The system implemented by the Proposal would rely not only on information, including personal data from the Union databases, but also on national ones, thus allowing Member States to choose between different sources of information. For instance, in the context of detection and initial checks carried out in relation to third-country nationals, Article 6 of the Proposal provides that competent authorities shall rely upon previous checks, including screening pursuant to

text: Regulation (EU) 2024/1356

text: , or ‘equivalent checks under national law’. Similarly, Recital 12 of the Proposal provides for the possibility for Member Stated to identify the third-country national and verify possible security risks ’by querying the relevant Union and national databases’.

text: 29. In the same vein, Article 21(5) of the Proposal provides that Member States must establish either in national law the method of communication with the third-country nationals and the point in time at which the communication is considered received by and notified to the thirdcountry nationals, or make use of digital system developed and/or supported by the EU for the purpose of such communication.

text: 30. Thus, notwithstanding the choice of a Regulation to establish a common return system, the Proposal allows for the simultaneous use of European and national information and rules, which might lead to potential discrepancies. For instance, the storage duration of third-country nationals’ data kept in national databases might be different from the storage and review periods for alerts on persons, based on the same personal data and for the similar purposes, established by the Union legal framework, such as

text: Regulation (EU) 2018/1861

text: on the establishment, operation and use of the Schengen Information System (SIS) in the field of border checks .

text: 31. In this context, the EDPS notes that the Commission intends to propose a separate initiative on digitalisation of case management in the area of return, readmission and integration, as announced in the ‘Legal, Financial and Digital Statement’, which accompanies the Proposal. The EDPS understands that this upcoming initiative would aim at harmonising the management of the processes established by the Proposal.

text: 32. In order to achieve this objective, the EDPS underlines the need for the current and the forthcoming proposals to ensure consistent application of the EU data protection in the context of the return procedures as regard in particular the right of access, rectification of inaccurate data and erasure of unlawfully stored data, the storage duration as well as the determination of roles and responsibilities of the different authorities processing the data of the third-country nationals.

text: 7. Information about data protection rights

text: 33. The EDPS notes that Article 24 of the Proposal specifies the information to be provided to third-country nationals subject to the return procedure. However, unlike other regulations linked to the Pact on Migration and Asylum, such as Screening Regulation, SIS Regulation in the field of border checks or Regulation on asylum and migration management, there is no reference to the rights to information conferred on data subjects by the applicable Union data protection law, in particular the GDPR and the EUDPR . While the relevant data protection law remains fully applicable even without an explicit reference, the absence of such information in the Proposal may lead to legal uncertainty about the information that must be provided to the third-country nationals concerned.

text: 34. In order to ensure the necessary legal certainty and also to align the Proposal with the other legal acts already adopted in the area of migration and asylum, the EDPS recommends including in

text: Article 24

text: the Proposal a reference to the rights conferred on data subjects by the applicable Union data protection law.

text: 8. Conclusions

text: In light of the above, the EDPS makes the following recommendations: (1) to conduct an in-depth fundamental rights impact assessment of the Proposal, including the implications of the introduction of ‘return hubs’, (2) to further circumscribe in Article 7(3) of the Proposal the legal possibility to restrict the information about the reasons in fact on which the return decision is taken, in order to ensure that it is applied only in exceptional cases when it is strictly necessary, (3) to include in Article 24 of the Proposal a reference to the rights conferred on data subjects by the applicable Union data protection law, (4) to list in an exhaustively manner in

text: Article 38(6)

text: (b) of the Proposal which categories of biometric data could be shared between Member States for the purpose of carrying out the return or readmission procedure, or providing reintegration assistance, (5) to specify in Article 40 of the Proposal that transfers to third countries of data relating to criminal convictions of third-country nationals should be subject to a strict necessity test and must not lead to handing down or executing a death penalty or any form of cruel and inhuman treatment, (6) to specify under which conditions personal data of the children could be transferred to the country of return.

text: Brussels, 23 May 2025

text: (e-signed)

text: Wojciech Rafał WIEWIÓROWSKI