text: OJ L 295, 21.11.2018, p. 39.

text: See Article 1 of Proposal API Border management. 3

text: Council Directive 2004/82/EC of 29 April 2004

text: on the obligation of carriers to communicate passenger data, OJ L 261, 6.8.2004, p. 24. 4 COM(2022) 731 final, Explanatory memorandum to the Proposal API Law enforcement, page 3.

text: Directive (EU) 2016/681

text: of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, OJ L 119, 4.5.2016, p. 132– 149.

text: COM(2021) 277 final 7 UN Security Council Resolutions 2178(2014), 2309(2016), 2396(2017), 2482(2019), and OSCE Ministerial Council Decision 6/16 of 9 December 2016 on Enhancing the use of Advance Passenger Information. 8 See Recital 11 of Proposal API Law enforcement. 9

text: Regulation (EU) 2016/399

text: of the European Parliament and of the Council of 9 March 2016 on a Union Code on the rules governing the movement of persons across borders (Schengen Borders Code), OJ L 77, 23.3.2016, p. 1–52. 10 CJEU judgment of 21 June 2022, case

text: , Ligue des droits humains, ECLI:EU:C:2022:491. 11 COM(2022) 731 final, Explanatory memorandum of the Proposal API Law enforcement, page 3. 5

text: See Annex I to the PNR Directive. 13 COM(2022) 731 final, Explanatory memorandum of the Proposal API Law enforcement, page 1. 14

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (Text with EEA relevance) (OJ L 119, 4.5.2016, p. 1). 15

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89–131. 16 See Recital 25 of API Border management and Recital 17 of API Law enforcement. 17 See

text: Article 3

text: (c) of API Border management and

text: Article 3

text: (b) of API Law enforcement. 18 There seems to be a contradiction (possible clerical error) in

text: Article 1

text: (a) of Proposal API Law enforcement, which refers to selected intra-EU flights. However, from

text: Article 4

text: and the overall explanations in the recitals and the explanatory memorandum (page 10) of the same Proposal, it is clear that the intended selection is to take place after the transfer to the router to avoid disclosing the selected flights. 6

text: See

text: Article 5

text: and Recital 14 of Proposal API Law enforcement. 20

text: Article 4(8)

text: (b) of Proposal API Law enforcement. 21 COM(2022) 731 final, Explanatory memorandum of Proposal API Law enforcement, page 11. 22 See CJEU judgments of 21 June 2022, case

text: , Ligue des droits humains, ECLI:EU:C:2022:491, paragraph 116, and of 2 October 2018, Ministerio Fiscal,

text: , EU:C:2018:788, paragraph 55, and the cited case-law. 23 CJEU judgment of 21 June 2022, case

text: , Ligue des droits humains, ECLI:EU:C:2022:491, p. 7 of the ruling and paragraphs 171 and 173. 7

text: SWD(2022) 422 final, Impact Assessment Report, Annex 4, page 71. 25 See CJEU judgment of 21 June 2022, case

text: , Ligue des droits humains, paragraph 174. 8

text: Article 17 of Proposal API Border management. 27 Article 8 of Proposal API Law enforcement. 28 See Article 15 of API Border management and Article 7 of API Law enforcement. 29 Article 16 of API Border management. 30 https://edps.europa.eu/sites/default/files/publication/19-11- 07_edps_guidelines_on_controller_processor_and_jc_reg_2018_1725_en.pdf 9

text: See EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR, paragraph 35. 33 See Articles 17, 22-24 of API Border management. 10

text: Regulation (EU) 2019/817

text: of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of borders and visa and amending Regulations

text: (EC) No 767/2008

text: (EU) 2016/399

text: (EU) 2017/2226

text: (EU) 2018/1240

text: (EU) 2018/1726

text: and

text: (EU) 2018/1861

text: of the European Parliament and of the Council and Council Decisions

text: and 2008/633/JHA (OJ L 135, 22.5.2019, p. 27).

text: https://edps.europa.eu/sites/default/files/publication/2018-04-16_interoperability_opinion_en.pdf 36 https://edps.europa.eu/sites/edp/files/publication/16-09-21_smart_borders_en.pdf 37 https://edps.europa.eu/sites/edp/files/publication/17-03-070_etias_opinion_en.pdf 38 https://edps.europa.eu/sites/edp/files/publication/17-05-02_sis_ii_opinion_en.pdf 39 https://edps.europa.eu/sites/default/files/publication/18-12-13_opinion_vis_en.pdf 40 https://edps.europa.eu/sites/edp/files/publication/17-10-10_eu-lisa_opinion_en_0.pdf 11

identifier: EDPS yttrande 06/2023

amnesord:
Regulation 2018/1725
PNR
Borders, Asylum, Migration
EU Passengers Name Record

title: EDPS Opinion on the Proposals for Regulations on the collection and transfer of advance passenger information (API)

text: 8 February 2023

text: Opinion 6/2023

text: on the Proposals for Regulations on the collection and transfer of advance passenger information (API)

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on the collection and transfer of advance passenger information (API) for enhancing and facilitating external border controls, amending

text: Regulation (EU) 2019/817

text: and

text: Regulation (EU) 2018/1726

text: , and repealing

text: Council Directive 2004/82/EC

text: (COM/2022/729 final), and the Proposal for a Regulation of the European Parliament and of the Council on the collection and transfer of advance passenger information for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, and amending

text: Regulation (EU) 2019/818

text: (COM/2022/731 final).

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the two Proposals that are relevant from a data protection perspective.

text: Executive Summary

text: On 13 December 2022 the European Commission issued two legislative proposals on the collection and transfer of advance passenger information (“API”): a Proposal for a Regulation of the European Parliament and of the Council on the collection and transfer of advance passenger information for enhancing and facilitating external border controls (“API Border management Proposal”), and a Proposal for a Regulation of the European Parliament and of the Council on the collection and transfer of advance passenger information for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (“API Law enforcement Proposal”) (together “the Proposals”).

text: The objective of the API Border management Proposal is enhancing and facilitating the effectiveness and efficiency of border checks at external borders and combating illegal immigration, and replacing the existing

text: Council Directive 2004/82/EC

text: (“API Directive”). The objective of the API Law enforcement Proposal is to lay down better rules for the collection and transfer of API data by air carriers for the purpose of preventing, detecting, investigating, and prosecuting terrorist offences and serious crime, complementing the existing

text: Directive (EU) 2016/681

text: (“PNR Directive”).

text: Taking into account that the data processing operations that would result from the Proposals correspond to or complement already existing data processing operations provided for in Union law, the Opinion focuses primarily on the necessity and proportionality of the envisaged processing of API data from intra-EU flights and its compatibility with the PNR Directive as interpreted by the CJEU judgment in case

text: While the EDPS considers the proposed solution for intra-EU flights broadly sufficient to ensure compliance with the CJEU judgment on Article 2 of the PNR Directive, he nevertheless invites the co-legislators to consider the development of harmonised criteria for the selection of intra-EU flights, from which API data should be collected, in line with the conditions spelled out by the Court. Furthermore, the EDPS recommends further strengthening of the security of processing of API data in the router with additional safeguards, such as pseudonymisation and/or encryption of the API data, if technically and operationally feasible.

text: The Opinion also provides other specific recommendations, such as the need to explicitly clarify in the Proposals that in case of technical impossibility of the router to transmit the API data transferred by the air carriers to the competent national authorities, the data should be automatically deleted.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 13 December 2022 the European Commission issued two legislative proposals on the collection and transfer of advance passenger information (“the Proposals”): - a Proposal for a Regulation of the European Parliament and of the Council on the collection and transfer of advance passenger information (API) for enhancing and facilitating external border controls, amending

text: Regulation (EU) 2019/817

text: and

text: Regulation (EU) 2018/1726

text: , and repealing

text: Council Directive 2004/82/EC

text: (“API Border management Proposal”), - a Proposal for a Regulation of the European Parliament and of the Council on the collection and transfer of advance passenger information for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, and amending

text: Regulation (EU) 2019/818

text: (“API Law enforcement Proposal”).

text: 2. The objective of the API Border management Proposal is enhancing and facilitating the effectiveness and efficiency of border checks at external borders and combating illegal 2 3 immigration , thus replacing the existing

text: Council Directive 2004/82/EC

text: (“API Directive”’) .

text: 3. The objective of the API Law enforcement Proposal is to lay down better rules for the collection and transfer of API data by air carriers for the purpose of preventing, detecting, investigating, and prosecuting terrorist offences and serious crime , complementing the existing

text: Directive (EU) 2016/681

text: (“PNR Directive”) .

text: 4. The Proposals are consistent with the Schengen Strategy of June 2021, presented in the Commission Communication “A strategy towards a fully functioning and resilient Schengen area” which specifically underlined the need for an increased use of API data in combination with PNR data to significantly enhance internal security, in compliance with the fundamental right to the protection of personal data and the fundamental right to 4 freedom of movement . Moreover, at international level, the United Nations’ Security Council and the Organization for Security and Co-operation in Europe (OSCE) also repeatedly called for the establishment and global rollout of API and PNR systems for law enforcement purposes .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 14 December 2022 pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 44 of the API Border management Proposal and Recital 29 of the API Law enforcement Proposal. In this regard, the EDPS also positively notes that he has already been informally consulted on the Proposals pursuant to recital 60 of EUDPR.

text: 6. In view of the close alignment between the Proposals , including the numerous crossreferencing between them, it seems most appropriate for the EDPS to assess them in a single Opinion.

text: 2. General remarks

text: 7. The EDPS notes that the specific data processing operations provided for in the Proposals correspond to or complement already existing data processing operations, provided for in the Union law. Regarding the API Border management Proposal, it is the legal framework on border checks at the external borders, in particular the Schengen Borders Code , and for API Law enforcement Proposal, it is the already mentioned PNR Directive.

text: 8. Furthermore, the EDPS takes into account that the Court of Justice of the European Union (CJEU) in recent case

text: confirmed the validity of the PNR Directive, while providing important clarifications on a number of its provisions, including in substance additional limitations on the processing of personal data to ensure compliance with Articles 7 and 8 of the Charter. In particular, the Court laid down a number of conditions that national laws transposing the PNR Directive must comply with relation to the application of the PNR Directive to intra-EU flights.

text: 9. The requirements laid down by the Court in its judgment constitute an important point of reference for the assessment of the Proposals, in particular with regard to the processing of API data from intra-EU flights. In this context, EDPS positively notes the explicit reference to the Court judgment in Recital 14 and in the Explanatory memorandum of the API Law enforcement Proposal .

text: 10. At the same time, it should be borne in mind that the CJEU judgment concerns the processing of PNR data that comprises 18 data categories . API data is only one subset of them. The impact of the processing of API data on the fundamental rights of the passengers could therefore arguably be considered lesser compared to the processing of PNR data, despite the newly created obligation at EU level to collect API data. Furthermore, it should be recalled that air carriers already collect API data during check-in of the passenger (online check-in and at the airport), while at the same time their practices are diverse and inconsistent .

text: 11. Finally, as regards the relationship between the two Proposals and the EU legal framework on data protection, the EDPS positively notes the clarification that the generally applicable acts of Union law on the protection of personal data, in particular

text: Regulation (EU) 2016/679

text: 14 15 (GDPR) , the EUDPR and

text: Directive (EU) 2016/680

text: (LED) , would not be affected by the envisaged API Regulations . However, the EDPS does not deem it useful, nor accurate to indicate that the proposed legislation would ‘complement’ the generally applicable acts on the protection of personal data, as the proposed act would simply be in line with them, as all sectorial legislation.

text: 3. Processing of API data from intra-EU flights

text: 12. Similarly to the current legal framework - the API Directive and the PNR Directive - the two Proposals make a distinction between extra-EU and intra-EU flights . The API data from extra-EU flights is processed for the purposes of (1) border checks at external borders and of combating illegal immigration (further limited only to flights into the EU), and (2) preventing, detecting, investigating and prosecuting terrorist offences and serious crime. Conversely, the API data from intra-EU flights can be processed only for preventing, detecting, investigating and prosecuting terrorist offences and serious crime, as defined in the PNR Directive, and not for immigration purposes.

text: 13. The EDPS notes that pursuant to

text: Article 2

text: and

text: Article 4 (1)

text: and (6) of the API Law enforcement Proposal, air carriers would be obliged to collect and subsequently transfer to a “router” the API data on [all] “scheduled or non-scheduled extra-EU flights or intra-EU flights” . The router would then transmit to the Passenger Information Units (‘PIU’) of the Member States on the territory of which the flight will depart and will land only the API data of the intra-EU flights selected by the Member States pursuant to Article 2 of the PNR Directive, as interpreted in the CJEU judgment. To this end, eu-LISA would maintain a confidential list of the selected intra-EU flights, which would be regularly updated .

text: 14. The EDPS further notes that according to

text: Article 12

text: (b) of the for API Border management Proposal, the API data from intra-EU flights other than those included in the list would be deleted from the router “immediately, permanently and in an automated manner”. Likewise, air carriers would be obliged to immediately and permanently delete the API data from intra-EU flights after the transfer to the router is completed .

text: 15. According to the Commission, the proposed technical solution aims to limit the transmission of API data to PIUs to designated flights only and without disclosing confidential information on which intra-EU flights have been selected, in view of the risk of circumvention by the persons involved in serious crime or terrorist activities .

text: 16. The EDPS is of the view that when assessing compliance of the proposed solution for intra- EU flights, the conditions set out in the CJEU judgment mentioned above, while being an important point of reference, need to be applied by analogy (mutatis mutandis). The Court has clarified that an interference with Articles 7 and 8 of the Charter may be justified by assessing the seriousness of the interference and by verifying that the importance of the objective of general interest pursued by that limitation is proportionate to that seriousness . In the present context, it should be taken into account that the ruling concerns a different system involving, among others, processing of many more categories of personal data than API. As a consequence, the EDPS considers that the Proposal would entail a lower level of interference with those fundamental rights than that considered by the Court.

text: 17. According to the CJEU, EU law, in particular Article 2 of Directive 2016/681, read in the light of

text: Article 3(2)

text: TEU,

text: Article 67(2)

text: TFEU and Article 45 of the Charter, precludes national legislation, which establishes a system for the transfer, by air carriers, and for the processing, by the competent authorities, of the PNR data of all intra-EU flights. By contrast, such processing can be allowed when a Member State is “confronted with a terrorist threat which is shown to be genuine and present or foreseeable” .

text: 18. In this context, the relevant question is whether the proposed technical solution leads in practice to indiscriminate transfer of API data from all intra-EU flights to the competent national authorities (PIUs), outside the exceptional situations of terrorist threat, or not.

text: 19. In the view of the EDPS, the envisaged automatic processing in the router - the ‘filtering’ of the API data based on an official list of selected airports or routes, the transmission of data only from pre-selected flights, and the immediate deletion of the data from nonselected flights, precludes the possibility for PIUs to receive and process in any manner API data from intra-EU flights they are not entitled to.

text: 20. Moreover, the EDPS considers that collection and transfer to the router of API data, on the one hand, and processing of the API data by the competent national authorities, on the other hand, are intrinsically linked and therefore should not be considered in isolation. Therefore, as it is not only legally precluded but also technically impossible for the Member States to access API data from intra-EU flights they have not formally selected and communicated, then the EDPS considers this element of the Proposals as compliant with the relevant EU law as interpreted by the CJEU.

text: 21. Furthermore, it is the EDPS’ understanding that, at this stage, no satisfactory (readily available, technically viable and economically effective) alternative solution exists that would offer comparable guarantees and safeguards for intra-EU flights.

text: 22. For instance, transferring of API data by air carriers for all intra-EU flights directly to the PIUs and leaving it to the Member States to decide which API data is necessary and to delete the rest, appears problematic. It would indeed entail systematic processing by national authorities of data from all intra-EU flights, including those not selected by them.

text: 23. In turn, “filtering” of API data at air carrier level does not offer sufficient guarantees and could create additional challenges related to confidentiality (e.g. circumvention by persons involved in serious crime or terrorist activities), reliability and consistency of the processing, as the API data will be filtered by multiple actors based on instructions from all Member States. In this regard, it should be noted that according to the Impact Assessment to the Proposals, there are currently around 1000 air carriers operating in the EU, and approximately 150 of them operate exclusively within the Union .

text: 24. It follows that the processing of all API data taking place at the level of the router in the light of the level of interference with the fundamental rights concerned, the safeguards provided, in particular the legal and technical impossibility for the Member States’ PIUs to receive and otherwise process API data not related to the selected flights, remains proportionate to the objective pursued.

text: 25. Finally, the EDPS recalls that in accordance with the CJEU judgment, the selection of intra- EU flights must be limited to what is strictly necessary. To this end, the Member States’ choice has to be justified on the basis of [objective] indications and to be subject to regular reviews . Therefore, in order to avoid divergent practices, the EDPS invites the colegislators to consider introducing provisions, including specific empowerment to the Commission in accordance with

text: Articles 290

text: and/or 291 TFEU if deemed appropriate, for the development of harmonised criteria and methodology for the selection of intra-EU flights, from which API data should be collected.

text: 4. Security of API data

text: 26. Given the scale of the processing and the affected number of data subjects, the envisaged collection and transfer of API data may create potential risks and therefore must be accompanied by effective safeguards ensuring a high level of security. In this regard, the EDPS notes that the API Border management Proposal provides for a detailed provision on the security of the API data and the router, in addition to the general obligations on the security of personal data pursuant to Article 33 of the EUDPR and Article 32 of the GDPR . At the same time, the respective provision in the API Law enforcement Proposal is very general and neither provides for any specific measures, nor refers to the relevant rules in the API Border management Proposal.

text: 27. Furthermore, the EDPS recalls the obligation of Member States authorities, air carriers and eu-LISA, to implement appropriate technical and organisational measures in line with the requirements of data protection by design and by default pursuant to Article 27 of the EUDPR, Article 25 of the GDPR and Article 20 of the LED.

text: 28. The EDPS therefore recommends that the API Law enforcement Proposal should provide for specific measures ensuring the security of API data processed for the purpose of preventing, detecting, investigating and prosecuting terrorist offences and serious crime, or, alternatively, should refer to the relevant rules in the API Border management Proposal.

text: 29. Furthermore, the EDPS recommends to eu-LISA, when designing and developing the router, to consider the use of pseudonymisation and/or encryption of the API data, if technically and operationally feasible.

text: 5. Roles and responsibilities

text: 30. The Proposals would designate the air carriers as controllers, within the meaning of

text: Article 4(7)

text: GDPR, for the processing of API data constituting personal data in relation to their collection of that data and their transfer thereof to the router .

text: 31. Furthermore, competent border authorities are designated as controllers in relation to the processing of API data constituting personal data through the router, including the transmission, as well as in relation to their processing of API data constituting personal data under the API Border management Proposal. Similarly, PIUs would be controllers, within the meaning of

text: Article 3

text: , point (8) of

text: Directive (EU) 2016/680

text: in relation to the processing of API data constituting personal data through the router, including transmission, under the API Law enforcement Proposal.

text: 32. Finally, eu-LISA is designated as processor within the meaning of

text: Article 3

text: , point (12) of

text: Regulation (EU) 2018/1725

text: for the processing of API data constituting personal data through the router .

text: 33. Given the division of responsibilities between the various actors, interpreted in the light of the relevant provisions of the GDPR, the EUDPR and the LED, and also taking into account the EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: as well as the EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR , the EDPS considers this designation of roles appropriate, for the following reasons.

text: 34. The EDPS notes that Member States authorities, acting as controllers, determine the purposes and essential means of the processing via the router, within the legal framework established by the Proposals. According to the EDPB Guidelines, “essential means” are closely linked to the purpose and the scope of the processing. Concerning the purposes, although eu-LISA will process all API data, the data eventually processed by the Member States authorities is only the data related to the flights selected by the Member States. The latter therefore determine what specific subsets of data they will receive and “why” within the meaning of the above mentioned EDPB guidelines 7/2020 . Concerning the essential means, they are determined by the law: the API data that is presented to eu-LISA; the duration of the processing; the categories of recipients (the competent PIUs and border authorities) and the categories of data subjects whose personal data will be processed (air travellers that fall within the scope of the API Regulations).

text: 35. The “non-essential means” concern more practical aspects of implementation, such as the choice for a particular type of hardware or software or the detailed security measures what eu-LISA is supposed to do - and could be left to the processor to decide on. Moreover, according to the EDPB, it is not necessary that the controller actually has access to the data that is being processed (i.e. to the data in the router).

text: 36. In practice, the eu-LISA is offering a communication channel between the air carriers and the Member State controllers – rather than a standalone database (there is no 'true' storage of API data in the router). The Agency does not have any other purposes for the processing of API data, other than transmitting it to competent controllers in the Member States.

text: 37. Notwithstanding the designation of eu-LISA as processor on behalf of Member States authorities, the Proposals place a significant responsibility for ensuring a lawful and secure processing of the API data in the router on the Agency. eu-LISA has to guarantee, inter alia, that only properly selected API data regarding intra-EU flights would reach the PIUs, the deletion of the remaining API data, as well as high level of security to prevent any unauthorised access to the data .

text: 38. In this regard, the EDPS recalls that the EUDPR does not make a distinction between controllers and processors with regard to the supervisory powers of the EDPS under

text: Article 58

text: or the possible sanctions for infringements under

text: Article 66

text: thereof. In any event, the EDPS plans to closely supervise the exercise of the tasks of eu-LISA under the Proposals, in line with his mandate pursuant to the EUDPR.

text: 6. Reporting and statistics

text: 39. The EDPS notes that, in accordance with Article 31 of the API Border management Proposal, eu-LISA would have the task to store daily statistics from the processing of data in the router in the central repository for reporting and statistics (CRRS) established in

text: Article 39 of Regulation (EU) 2019/817

text: (Interoperability Regulation) as well as to produce various statistical reports. To this end, eu-LISA would have the right to access certain API data transmitted through to the router, “without however such access allowing for the identification of the travellers concerned”.

text: 40. In his Opinion 4/2018 on the Proposals for two Regulations establishing a framework for interoperability , the EDPS has already cautioned that the proposed establishment of CRRS would impose a heavy responsibility on eu-LISA. This position has been repeated in 36 37 38 39 40 the EDPS Opinions on EES , ETIAS , SIS , VIS and eu-LISA . In this context, the EDPS has made a number of recommendations regarding the CRRS, including on the need for a thorough information security risk assessment, adequate security measures, and privacy by design. These recommendations remain fully valid in the context of the Proposals.

text: 7. Deletion of API data from the router

text: 41. Article 12 of the API Border management Proposal would provide for two situations that would trigger automatic deletion of API data from the router: (a) where the transmission of the API data to the relevant competent border authorities or PIUs, as applicable, has been completed; (b) in respect of API law enforcement Proposal, where the API data relates to other intra- EU flights than those included the lists referred to in Article 5(2) of that Regulation (i.e. not selected by any Member State).

text: 42. The EDPS also notes that Article 14 of the API Border management Proposal describes the actions that have to be taken in case of technical impossibility to use the router. In general, is such situations air carriers would have no obligation to transfer API data to the router. However, the Proposals do not stipulate explicitly what should happen if an air carrier has transferred API data to the router before becoming aware of a technically impossibility of the router to subsequently transmit the API data because of a failure of the systems or infrastructure of Member State(s).

text: 43. The EDPS therefore recommends clarifying in Article 12 of the API Border management Proposal that in case of technically impossibility of the router to subsequently transmit the API data to the competent national authorities, the data is automatically deleted.

text: 8. Other comments

text: 44. The EDPS notes that

text: Article 4(1)

text: , second sentence of the API law enforcement Proposal specifically clarifies the allocation of the obligation to transfer API data in cases where the flight is code-shared between several air carriers. However, the API Border management Proposal does not include a similar rule. Therefore, the EDPS recommends adding a similar provision on code-shared flights also in the API Border management Proposal.

text: 9. Conclusions

text: 45. In light of the above, the EDPS recommends to the co-legislators to: (1) consider the development of harmonised criteria and methodology for the selection of intra-EU flights, from which API data should be collected; (2) provide for specific measures in API Law enforcement Proposal ensuring the security of API data processed for the purpose of preventing, detecting, investigating and prosecuting terrorist offences and serious crime, or, alternatively, refer to the relevant rules on security in the API Border management Proposal; (3) clarify in Article 12 of the API Border management Proposal that in cases of technical impossibility of the router to subsequently transmit the API data to the competent national authorities, the data should be automatically deleted; (4) to clarify in the API Border management Proposal the allocation of the obligation to transfer API data in cases where the flight is code-shared between several air carriers. Brussels, 8 February 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 12


text: COM(2023) 753 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3

text: Regulation (EC) No 261/2004

text: of the European Parliament and of the Council of 11 February 2004 establishing common rules on compensation and assistance to passengers in the event of denied boarding and of cancellation or long delay of flights, and repealing

text: Regulation (EEC) No 295/91

text: (Text with EEA relevance), OJ L 46 , 17.2.2004, p. 1-8. 4

text: Regulation (EC) No 1107/2006

text: of the European Parliament and of the Council of 5 July 2006 concerning the rights of disabled persons and persons with reduced mobility when travelling by air (Text with EEA relevance), OJ L 204, 26.7.2006, p. 1–9.

text: Regulation (EU) No 1177/2010

text: of the European Parliament and of the Council of 24 November 2010 concerning the rights of passengers when travelling by sea and inland waterway and amending

text: Regulation (EC) No 2006/2004

text: (Text with EEA relevance), OJ L 334, 17.12.2010, p. 1–16. 6

text: Regulation (EU) No 181/2011

text: of the European Parliament and of the Council of 16 February 2011 concerning the rights of passengers in bus and coach transport and amending

text: Regulation (EC) No 2006/2004

text: (Text with EEA relevance), OJ L 55, 28.2.2011, p. 1–12. 7

text: Regulation (EU) 2021/782

text: of the European Parliament and of the Council of 29 April 2021 on rail passengers’ rights and obligations (recast) (Text with EEA relevance), OJ L 172, 17.5.2021, p. 1–52. 8 COM(2023) 753 final, p. 13. 4

text: COM(2023) 752 final. 10 EDPS Opinion 5/2024 on the Proposal for a Regulation on passengers rights in the context of multimodal journeys, issued on 24 January 2024. 11 COM (2023) 753 final,

text: Article 1

text: , amending

text: Regulation (EC) No 261/2004

text: , inserting

text: Article 14

text: a. 12 COM (2023) 753 final,

text: Article 1

text: , amending

text: Regulation (EC) 261/2004

text: , inserting

text: Article 16

text: aa. 13

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (Text with EEA relevance), OJ L 119, 4.5.2016, p. 1-88. 14

text: Article 1

text: , amending

text: Regulation (EC) 261/2004

text: , inserting

text: Article 16

text: aa;

text: Article 3

text: , amending Regulation (EU) no 1177/2010, inserting

text: Article 19

text: a;

text: Article 4

text: , amending

text: regulation (EU) 181/2011

text: , inserting

text: Article 19

text: a, 15 EDPS Formal comments on the draft Commission Implementing Regulation establishing a common form for rail passengers’ reimbursement and compensation requests for delays, missed connections and cancellations of rail services in accordance with

text: Regulation (EU) 2021/782

text: of the European Parliament and of the Council, issued on 29 March 2023. 5

text: Regulation (EU) 2021/782

text: of the European Parliament and of the Council of 29 April 2021 on rail passengers’ rights and obligations (recast), OJ L 172, 17.5.2021, p. 1–52. 17 COM (2023) 753 final,

text: Article 1

text: , amending

text: Regulation (EC) No 261/2004

text: , inserting

text: Article 14

text: a(2); recital 9 of the Proposal. 18 See also

text: Article 5(1)

text: (b) GDPR. 19

text: Article 5(1)

text: (e) GDPR. 20 Article 1 of the Proposal, amending

text: Regulation (EC) No 261/2004

text: , inserting

text: Article 14

text: a(3). 21 Article 1 of the Proposal, amending

text: Regulation (EC) No 261/2004

text: , inserting

text: Article 15

text: a. 22 Article 1 of the Proposal, amending

text: Regulation (EC) No 261/2004

text: , inserting

text: Article 15

text: a. 23 Article 3 of the Proposal, amending

text: Regulation (EC) No 1177/2010

text: Article 24

text: a. 24 Article 4 of the Proposal, amending

text: Regulation (EU) No 181/2011

text: Article 26

text: a. 6

identifier: EDPS yttrande 06/2024

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 6/2024 on the Proposal for a Regulation amending Regulations (EC) No 261/2004, (EC) No 1107/2006, (EU) No 1177/2010, (EU) No 181/2011 and (EU) 2021/782 as regards enforcement of passenger rights in the Union

serie: yttranden

text: 24 January 2024

type: rubrik

text: Opinion 6/2024

text: (EC) No 261/2004

text: (EC) No 1107/2006

text: (EU) No 1177/2010

text: (EU) No 181/2011

text: and

text: (EU) 2021/782

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’. Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’. This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council amending Regulations

text: (EC) No 261/2004

text: (EC) No 1107/2006

text: (EU) No 1177/2010

text: (EU) No 181/2011

text: and

text: (EU) 2021/782

text: as regards enforcement of passenger rights in the Union . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: (EC) No 261/2004

text: (EC) No 1107/2006

text: (EU) No 1177/2010

text: (EU) No 181/2011

text: and

text: (EU) 2021/782

text: The aim of the Proposal is to enhance the level of protection of passenger rights having regard to travel by air, rail, sea and inland waterways, and bus and coach. More specifically, the Proposal aims to ensure: reimbursement when the ticket was booked via an intermediary; improving information to passengers on their rights at the time of booking and during journey disruptions; service quality standards; common form for reimbursement and compensation requests; risk-based approach to the monitoring of compliance; sharing of information with national enforcement bodies and information about alternative dispute resolution ADR by national enforcement bodies.

text: The EDPS welcomes the attention paid to the data protection aspects of the Proposal, notably having regard to the transmission of the contact details of the passenger to the carrier in case the passenger booked the ticket via an intermediary, as well as the specification that the carrier’s report on service quality standards should not contain personal data. In the light of the above, the EDPS does not have specific recommendations on the Proposal.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 29 November 2023, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council amending Regulations

text: (EC) No 261/2004

text: , (EC) No 4 5 6 7 1107/2006 ,

text: (EU) No 1177/2010

text: (EU) No 181/2011

text: and

text: (EU) 2021/782

text: as regards enforcement of passenger rights in the Union (‘the Proposal’). The Proposal is accompanied by four annexes on minimum service quality standards.

text: 2. The objective of the Proposal is to provide, having regard to travel by air, rail, sea and inland waterways, and bus and coach. More specifically, the Proposal aims to ensure reimbursement when the ticket was booked via an intermediary; improving information to passengers on their rights at the time of booking and during journey disruptions; service quality standards; common form for reimbursement and compensation requests; risk-based approach to the monitoring of compliance; sharing of information with national enforcement bodies and information about alternative dispute resolution ADR by national enforcement bodies.

text: 3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 29 November 2023, pursuant to Article 42(1) of EUDPR. The EDPS positively notes that he was already previously informally consulted pursuant to Recital 60 of EUDPR.

text: 2. General remarks

text: 4. The EDPS recognises the importance of enhancing consumer’s rights of passengers travelling by air, rail, sea and inland waterways, and bus and coach. The EDPS also notes that the proposal is consistent with the proposal the Proposal for a Regulation on passenger rights in the context of multimodal journeys . The EDPS adopted his Opinion on that Proposal on 25 January 2024 .

text: 6. The EDPS observes that the Proposal entails the processing of personal data, notably of the passenger’s contact details , or about his or her qualification as ‘person with reduced 12 13 mobility’ , by the carriers.

text: Regulation (EU) 2016/679

text: (‘the GDPR’) is therefore applicable to the processing of personal data in the context of the Proposal. The EDPS welcomes the reference to the applicability of the GDPR under recital 8 of the Proposal. The EDPS also welcomes, in the same recital, the specification that the obligations to provide information to passengers concerning their (consumer) rights are without prejudice to the obligation of the controller to provide information to the data subject pursuant to the GDPR.

text: 3. Common form for reimbursement and compensation requests

text: 7. The EDPS notes that the Proposal would empower the Commission to adopt an implementing act establishing a common form for reimbursement and compensation requests .

text: 8. The EDPS recalls the Commission that the EDPS should be consulted on these implementing acts pursuant to

text: Article 42(1)

text: EUDPR where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data. The EDPS also recalls that he has already provided formal comments on the draft Commission Implementing Regulation establishing a common form for rail passengers’ reimbursement and compensation requests for delays, missed connections and cancellations of rail services in accordance with

text: Regulation (EU) 2021/782

text: 4. Transmission of passenger contact details by intermediaries

text: 9. The EDPS notes that the Proposal contains provisions on the transmission of contact details of the passenger and of the booking details by the intermediary to the carrier . In this regard, the EDPS welcomes that the Proposal describes the purposes of the processing in a clear and explicit manner . In particular, the EDPS positively notes that these provisions specify that the contact details of the passenger can only be used by the carrier to the extent necessary to comply with its obligations to provide information, provision of care, reimbursement, re-routing and compensation, and to fulfil its obligations under applicable Union law on safety and security.

text: 10. In accordance with the principle of storage limitation, personal data may not be retained in a form which permits identification for longer than is necessary . The EDPS therefore welcomes the specification that the carrier must delete the contact details within 72 hours after the completion of the contract of carriage, unless further retention of the contact details is justified to fulfil its obligations in respect of the passenger’s right to re-routing, reimbursement or compensation .

text: 5. Information to be transmitted by carriers to the national enforcement bodies

text: 11. The EDPS notes that the Proposal requires air carriers to establish service quality standards (covering the items listed in Annex II), monitor their performance, and publish a report on service quality performance on the carrier’s website .

text: 12. The EDPS welcomes the specification that “this report shall not contain personal data” . The same specification is made having regard, respectively, to the service quality standards 23 24 for waterborne passengers and for passengers by bus and coach . Indeed, the EDPS remarks that the report on service quality standards, to fulfil its function, can be limited to statistical data (e.g. on the number of complaints, types of complaints, etc.).

text: 6. Conclusions

text: 13. In light of the above, the EDPS has no specific recommendation to be made on the Proposal. Brussels, 24 January 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7

type: vagledning

utgivare: edps


text: COM(2025) 143 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2025) 143 final. 4

text: Regulation (EU) 2018/1727

text: of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council Decision 2002/187/JHA, OJ L 295, 21.11.2018, p. 138. See p. 1-4 of COM(2025) 143 final. 6 See p. 4 of COM(2025) 143 final. 4

text: See

text: Article 1

text: , point 10 of the

text: Regulation (EU) 2023/2131

text: of the European Parliament and of the Council of 4 October 2023 amending

text: Regulation (EU) 2018/1727

text: of the European Parliament and of the Council and Council Decision 2005/671/JHA, as regards digital information exchange in terrorism cases, OJ L, 2023/2131, 11.10.2023. 8 See p. 1 of COM(2025) 143 final. 9 Idem. 10 See p. 2 of COM(2025) 143 final. 11 See p. 4 of COM(2025) 143 final. 12 See

text: Article 71(1)

text: (c) EUDPR. 13 See

text: Article 71(1)

text: (e) EUDPR. 14 See e.g. Judgment of 8 April 2014, Digital Rights Ireland and Seitlinger and others ,

text: and

text: , EU:C:2014:238, par. 64. 5

text: See p. 4 of COM(2025) 143 final. 16 Idem. 6

identifier: EDPS yttrande 06/2025

amnesord:
Necessity & Proportionality
Judicial Cooperation

title: Opinion 6/2025 on the Proposal for a Regulation amending Eurojust Regulation as regards the extension of the timeframe for the establishment of the Eurojust case management system

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to Proposal for a Regulation of the European Parliament and of the Council amending

text: Regulation (EU) 2018/1727

text: as regards the extension of the timeframe for the establishment of the Eurojust case management system .

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 2 April 2025, the European Commission consulted the EDPS on a Proposal for a Regulation of the European Parliament and of the Council amending

text: Regulation (EU) 2018/1727

text: (‘Eurojust Regulation’) as regards the extension of the timeframe for the establishment of the Eurojust case management system.

text: The Proposal will amend

text: Article 80(9) of Regulation (EU) 2018/1727

text: , by extending the statutory deadline for maintaining the ‘old’ Eurojust case management system (‘CMS’) and the establishment of the ‘new’ CMS, from 1 December 2025 to 1 December 2027. This change would give Eurojust two additional years to ensure a successful transition to the ‘new’ CMS. During the transitional period, the two systems would need to run in parallel, in order to migrate the data from the ‘old’ CMS to the ‘new’ CMS and to verify the correctness of the migrated data.

text: The EDPS considers the Proposal for a targeted and time-limited extension of the use of the current CMS of Eurojust and the associated duplication of data both in the ’old’ and the ‘new’ CMS as duly justified and necessary for the specific purpose of a secure transition to the new technical infrastructure. Consequently, the EDPS does not have any objections or recommendations as regards the proposed amendment of Article 80(9) of Eurojust Regulation.

text: Contents

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 2 April 2025, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council amending

text: Regulation (EU) 2018/1727

text: as regards the extension of the timeframe for the establishment of the Eurojust case management system (‘the Proposal’).

text: 2. The objective of the Proposal is to amend

text: (‘Eurojust Regulation’) , by extending the statutory deadline for maintaining the ‘old’ Eurojust case management system (‘CMS’) and the establishment of the ‘new’ CMS, from 1 December 2025 to 1 December 2027. This change would give Eurojust two additional years to ensure a successful transition to the ‘new’ CMS .

text: 3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 2 April 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 9 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 4. The Eurojust CMS has been established to ensure the secure handling of operational personal data relating to national criminal investigations and prosecutions and compliance with retention periods set out in the Eurojust Regulation. To avoid any circumvention of these rules, the Eurojust Regulation prohibits to store operational personal data anywhere outside the CMS .

text: 5. The EDPS notes that the current CMS, where Eurojust stores and exchanges personal operational data at the moment, is considered technically outdated and that Eurojust is in the process of establishing a new, ‘state-of-the-art’ CMS, with a current legal deadline of 1 December 2025 .

text: 6. The EDPS is also aware that Eurojust has raised concerns about the ability to comply with the legal deadline for the set-up of the new CMS due to objective reasons, including the fact that the migration of data from the ‘old’ to the ‘new’ CMS requires much more time than originally envisaged .

text: 7. Moreover, the EDPS notes that, according to the Explanatory Memorandum of the Proposal, the potential use of the ‘old’ CMS beyond the initial transitional period provided for in the Eurojust Regulation, would expose Eurojust to liability for the unlawful processing of operational personal data and might put at risk ongoing and future criminal investigations and prosecutions, including those related to international crimes such as the crime of aggression against Ukraine .

text: 8. The Commission is, therefore, proposing a targeted and time-limited technical amendment to the relevant provision of the Eurojust Regulation to ensure that the use of the ‘old’ CMS remains lawful until the ‘new’ CMS is fully operational, and the relevant data has been transferred to the ‘new’ CMS, in any event not later than 1 December 2027 .

text: 3. Data minimisation and storage limitation

text: 9. The EDPS notes that, in addition to the extension of the legal deadline for the use of the ‘old’ CMS from 1 December 2025 to 1 December 2027, paragraph 9 of Article 80 of the Proposal would also allow for the ‘old’ and the ‘new’ CMS to work in parallel, in order to migrate data from the ‘old’ CMS to the ‘new’ CMS and to verify the correctness of the migrated data. The Proposal acknowledges that this situation would inevitably lead to a duplication of data and therefore would have an impact on the principle of data minimisation , which requires the processing of personal data to be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed .

text: 10. In addition, the EDPS reminds that, in line with the storage limitation principle, personal data should be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed . In accordance with the CJEU case law, the determination of the storage duration must be based on objective criteria .

text: 11. In that regard, the Proposal explains that the purpose of the temporary duplication is to enable the secure transition to the new technical infrastructure, which will consider the data protection by design principle and ensure at the same time highest ICT security standards and therefore provide better data protection safeguards by default . Moreover, according to the Explanatory Memorandum, there is “no other, quicker means to migrate the data from the ’old’ to the ‘new’ CMS” .

text: 12. In addition, the EDPS positively notes that the ‘old’ CMS can only be used until the ‘new’ CMS is in place and the migration and verification of the accuracy of the data have been completed, which may happen before the final statutory deadline of 1 December 2027.

text: 4. Conclusion

text: 13. In light of the above, the EDPS considers the Proposal for the extension of the use of the current CMS of Eurojust and the related duplication of data both in the ’old’ and the ‘new’ CMS as duly justified and necessary for the specific purpose of the secure transition to the new technical infrastructure.

text: 14. Consequently, the EDPS does not have any objections or recommendations as regards the proposed amendment of Article 80 (9) of Eurojust Regulation extending the legal deadline for the technical migration from the ‘old’ CMS to the ‘new’ CMS. Brussels, 16 April 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI


text: COM(2025) 943 final. 1

text: OJ L 295, 21.11.2018, p. 39.

text: Regulation (EU) No 1095/2010

text: of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No

text: and repealing

text: Commission Decision 2009/77/EC

text: , OJ L 331, 15.12.2010, pp. 84–119.

text: Regulation (EU) No 648/2012

text: of the European Parliament and of the Council of 4 July 2012 on OTC derivatives, central counterparties and trade repositories, OJ L 201, 27.7.2012, pp. 1–59.

text: Regulation (EU) No 600/2014

text: of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending

text: Regulation (EU) No 648/2012

text: , OJ L 173, 12.6.2014, pp. 84–148.

text: Regulation (EU) No 909/2014

text: of the European Parliament and of the Council of 23 July 2014 on improving securities settlement in the European Union and on central securities depositories and amending Directives

text: and

text: and

text: Regulation (EU) No 236/2012

text: , OJ L 257, 28.8.2014, pp. 1–72.

text: Regulation (EU) 2015/2365

text: of the European Parliament and of the Council of 25 November 2015 on transparency of securities financing transactions and of reuse and amending

text: Regulation (EU) No 648/2012

text: , OJ L 337, 23.12.2015, pp. 1–34.

text: Regulation (EU) 2019/1156

text: of the European Parliament and of the Council of 20 June 2019 on facilitating cross-border distribution of collective investment undertakings and amending Regulations

text: (EU) No 345/2013

text: (EU) No 346/2013

text: and

text: (EU) No 1286/2014

text: , OJ L 188, 12.7.2019, pp. 55–66.

text: Regulation (EU) 2021/23

text: of the European Parliament and of the Council of 16 December 2020 on a framework for the recovery and resolution of central counterparties and amending Regulations

text: (EU) No 1095/2010

text: (EU) No 648/2012

text: (EU) No 600/2014

text: (EU) No 806/2014

text: and

text: (EU) 2015/2365

text: and Directives

text: and

text: (EU) 2017/1132

text: , OJ L 22, 22.1.2021, pp. 1–102.

text: Regulation (EU) 2022/858

text: of the European Parliament and of the Council of 30 May 2022 on a pilot regime for market infrastructures based on distributed ledger technology, and amending Regulations

text: (EU) No 600/2014

text: and

text: (EU) No 909/2014

text: and Directive

text: , OJ L 151, 2.6.2022, pp. 1–33.

text: Regulation (EU) 2023/1114

text: of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets, and amending Regulations

text: (EU) No 1093/2010

text: and

text: (EU) No 1095/2010

text: and Directives

text: and

text: (EU) 2019/1937

text: , OJ L 150, 9.6.2023, pp. 40–205.

text: Regulation (EC) No 1060/2009

text: of the European Parliament and of the Council of 16 September 2009 on credit rating agencies, OJ L 302, 17.11.2009, pp. 1–31.

text: 14 15 Regulation’) , 2017/2402 (‘Securitisation Regulation’) , 2023/2631 (‘EGBR’) and 2024/3005 (‘ESGRR’) as regards the further development of capital market integration and supervision within the Union (‘the Proposal’).

text: Regulation (EU) 2016/1011

text: of the European Parliament and of the Council of 8 June 2016 on indices used as benchmarks in financial instruments and financial contracts or to measure the performance of investment funds and amending Directives

text: and

text: and

text: Regulation (EU) No 596/2014

text: , OJ L 171, 29.6.2016, pp. 1–65. 14

text: Regulation (EU) 2017/2402

text: of the European Parliament and of the Council of 12 December 2017 laying down a general framework for securitisation and creating a specific framework for simple, transparent and standardised securitisation, and amending Directives

text: and

text: and Regulations

text: (EC) No 1060/2009

text: and

text: (EU) No 648/2012

text: , OJ L 347, 28.12.2017, pp. 35–80. 15

text: Regulation (EU) 2023/2631

text: of the European Parliament and of the Council of 22 November 2023 on European Green Bonds and optional disclosures for bonds marketed as environmentally sustainable and for sustainability-linked bonds (OJ L, 2023/2631, 30.11.2023, ELI: http://data.europa.eu/eli/reg/2023/2631/oj). 16

text: Regulation (EU) 2024/3005

text: of the European Parliament and of the Council of 27 November 2024 on the transparency and integrity of Environmental, Social and Governance (ESG) rating activities, and amending Regulations

text: (EU) 2019/2088

text: and

text: (EU) 2023/2859

text: (OJ L, 2024/3005, 12.12.2024, ELI: http://data.europa.eu/eli/reg/2024/3005/oj). 17 COM(2025) 943 final. 18 Explanatory Memorandum of the draft Proposal, p. 2 and 3. 19 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52020DC0591. 20 Explanatory Memorandum of the draft Proposal, p. 3. 21 See, for example, and EDPS Opinion 6/2021 on the Proposal for a Pilot Regime for Market Infrastructures based on Distributed Ledger Technology, issued on 23 April 2021, and EDPS Opinion 9/2021 on the Proposal for a Regulation on Markets in Cryptoassets, and amending

text: Directive (EU) 2019/1937

text: , issued on 24 June 2021. 5

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1). 6

text: Publication of personal data related to persons who have been sanctioned for an infringement under the draft Proposal should only occur in duly justified exceptional cases, as making such types of personal data available to the general public could be considered as a serious interference with their fundamental rights enshrined in Articles 7 and 8 of the Charter. 24 See in this regard also the EDPS Decision concerning the use of the IOSCO-ESMA Administrative Arrangement by the European Securities and Markets Authority, of 13 March 2019, as well as EDPS Decision on the EDPS Model Administrative Arrangement for Transfers of Personal Data under

text: Regulation (EU) 2018/1725

text: from European Union Institutions, Bodies, Offices and Agencies to International Organisations (Case 2020-0809), of 31 July 2024. 25 This would include

text: Article 6(11)

text: and (15) of the Proposal, in relation to the exchange of information and documentation between competent authorities in relation to marketing notifications and de-notifications of Alternative Investment Funds (AIFs) and Undertakings for Collective Investment in Transferable Securities). 26 Recital 11 of the Proposal. 7

text: See, as a good example, Article 6 of Commission Implementing

text: Regulation (EU) 2024/607 of 15 February 2024

text: on the practical and operational arrangements for the functioning of the information sharing system pursuant to

text: Regulation (EU) 2022/2065

text: of the European Parliament and of the Council (Digital Services Act) (OJ L, 2024/607, 16.2.2024, ELI: http://data.europa.eu/eli/reg_impl/2024/607/oj). 28

text: Regulation (EU) 2023/2859

text: of the European Parliament and of the Council of 13 December 2023 establishing a European single access point providing centralised access to publicly available information of relevance to financial services, capital markets and sustainability, OJ L, 2023/2859, 20.12.2023, ELI: http://data.europa.eu/eli/reg/2023/2859/oj 29

text: Article 3(1)

text: (f) and (5) of

text: Regulation (EU) 2023/2859

text: . 8

identifier: EDPS yttrande 06/2026

title: Opinion 6/2026 on the Commission Proposal for a Regulation as regards the further development of capital market integration and supervision within the Union

text: on the Regulation on the further development of capital market integration and supervision within the Union

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council amending Regulations

text: (EU) No 1095/2010

text: , No 648/2012, No 600/2014, No 909/2014, 2015/2365, 2019/1156, 2021/23, 2022/858, 2023/1114, No 1060/2009, 2016/1011, 2017/2402, 2023/2631 and 2024/3005 as regards the further development of capital market integration and supervision within the Union. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 4 December 2025, the European Commission adopted the Proposal for a Regulation of the European Parliament and of the Council amending Regulations

text: (EU) No 1095/2010

text: The EDPS welcomes the objectives of the Proposal, in particular in relation to the centralisation of supervision of EU laws at EU level (in this case, within the European Securities and Markets Authority). The EDPS recalls that objectives related to regulatory simplification are not incompatible - and, in fact, should be pursued together with - robust protections for individuals in the EU, as investors and as data subjects under EU data protection legislation.

text: The EDPS positively notes that the Proposal acknowledges that the information collected by ESMA may include personal data only if it is relevant and necessary for the exercise of ESMA’s tasks, in compliance with the applicable EU rules on the protection of personal data. As the Proposal would empower ESMA to enter into administrative arrangements and arrangements for the exchange of information with third countries and international organisations, the EDPS recalls that he should issue an authorisation to ESMA under the EUDPR before ESMA can enter into such administrative arrangements or agreements based on

text: Article 48(3)

text: (b) EUDPR.

text: The Proposal would require ESMA to set up a platform to facilitate the collection, storage, access to and processing of information as provided under the ESMA Regulation and other Union acts mandating the use of this platform. The EDPS understands that ESMA would process personal data in the platform as a processor under EU data protection law, but notes that it is not clear who it would be processing personal data on behalf of. Therefore, the EDPS recommends clarifying the role and obligations under EU data protection law of ESMA and of the entities submitting and accessing information in the data platform.

text: The EDPS recalls that information submitted via the European Single Access Point should only contain personal data where this is required by Union or national law or constitutes a necessary element of the information about the entity’s economic activities. When accessing it, ESMA must comply with specific obligations stemming from Union law. The EDPS recommends recalling the relevant requirements in a Recital of the Proposal.

text: Lastly, the EDPS considers it important to empower the Commission to lay down, via delegated or implementing act, requirements for obliged entities that must assess and report to ESMA on the good repute of the persons mentioned in the regulations that would be amended by the Proposal, including by specifying the personal data to be processed in that context.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 4 December 2025, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council amending Regulations

text: (EU) No 1095/2010

text: (‘ESMA Regulation’) , No 648/2012 (‘EMIR’) , No 600/2014 (‘MiFIR’) , No 909/2014 (‘CSDR’) , 2015/2365 (‘SFTR’) , 2019/1156 (‘CBDR’) , 2021/23 (‘CCPRRR’) , 2022/858 (‘DLTPR’) , 2023/1114 (‘MiCA’) , No 1060/2009 (‘CRA Regulation’) , 2016/1011 (‘Benchmarks 4

text: 2. The objective of the Proposal is to remove barriers stemming from the lack of harmonisation of EU rules and supervisory approaches resulting in the fragmentation and underperformance of EU capital markets. The Proposal aims to integrate EU capital markets and improve the functioning of the EU single market in financial services for the benefit of investors, businesses and the wider EU economy. This would entail making supervision more effective, conducive to cross-border activities, and responsive to emerging risks, by strengthening and increasing the supervisory convergence tools of the European Securities and Markets Authority (’ESMA’). The Proposal would also adapt the existing financial services rulebook to accommodate new technologies, like Distributed Ledger Technologies (‘DLT’), thereby implementing the Commission’s Digital Finance Strategy .

text: 3. The Proposal fits within the goal of pursuing regulatory simplification, to make crossborder activities more cost-effective. This would be achieved by moving certain provisions from directives to regulations; narrowing the scope for nationally imposed measures; refining empowerments for the adoption of delegated and implementing acts; and streamlining supervisory arrangements.

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 4 December 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 108 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 5. The EDPS recalls that he was consulted and issued Opinions on some on the legislative proposals that led to the adoption of the Regulations that the Proposal would amend.

text: 2. General remarks

text: 6. The EDPS welcomes the objectives of the Proposal, in particular in relation to centralizing supervision of EU laws at EU level (in this case, within ESMA). The EDPS recalls that objectives related to regulatory simplification are not incompatible - and, in fact, should be pursued together with - robust protections for individuals in the EU, as investors and as data subjects under EU data protection legislation.

text: 7. The EDPS notes that

text: Regulation (EU) 2016/679

text: (‘GDPR’) would apply when personal data would be processed in the context of the Proposal. There would also be cases where EU bodies covered by the Proposal such as ESMA would be subject to the EUDPR (e.g., when assisting a national competent authority in carrying out an on-site inspection). The EDPS would thus recommend including a reference to the application of both the GDPR and EUDPR in a Recital of the Proposal.

text: 3. ESMA’s supervisory tasks

text: 8. Article 1(26) of the Proposal would add a new Chapter IIa to the ESMA Regulation, to define the powers of ESMA over financial market participants under ESMA’s supervision. Within that Chapter,

text: Articles 39

text: b, c, and d would specify the information that ESMA may request from market participants and obtain during investigations and on-site inspections.

text: 9. Article 8(22) of the Proposal would insert a new Chapter 6 in Title VII of the DLTPR, thereby granting supervisory responsibilities, powers and competences to ESMA with respect to crypto-asset service providers. Similar amendments are foreseen under the other frameworks that would be amended by the Proposal to grant supervisory powers to ESMA over the obliged entities under those frameworks.

text: 10. The EDPS welcomes that Recital 13 of the Proposal clarifies that the information collected by ESMA may include personal data, to the extent that it is relevant and necessary for the exercise of ESMA’s tasks, and that the processing of such data should comply with the applicable EU rules on the protection of personal data, in particular the principles of necessity, proportionality and purpose limitation.

text: 11. The EDPS welcomes that new

text: Article 39

text: i of the ESMA Regulation would limit the issuance of public statements by ESMA identifying the person responsible for a breach where this publication is deemed necessary by ESMA to protect the stability of the financial markets or to ensure the effective enforcement of the ESMA Regulation, provided that the publication is limited to what is strictly necessary to ensure those objectives and properly justified. In the same vein, the EDPS welcomes that

text: Article 39

text: k would not entitle ESMA to disclose personal data when publishing fines and periodic penalty payments.

text: 12. Article 9(22) of the Proposal, amending

text: Regulation (EU) 2023/1114

text: on crypto-assets, would introduce

text: Article 138

text: d allowing ESMA to conclude administrative agreements on the exchange of information with third countries in relation to supervisory responsibilities, powers and competences of ESMA with respect to crypto-asset service providers. The EDPS welcomes that the information disclosed would be subject to professional secrecy and the reference to the fact that ESMA shall apply the EUDPR with regards to transfers of personal data to third countries.

text: 13. The EDPS also welcomes that Article 1(23) of the Proposal would empower ESMA to enter into administrative arrangements with third country regulatory and supervisory authorities and international organisations for the purpose of fostering international supervisory cooperation, including through the exchange of information and/or staff. The EDPS notes that such an arrangement shall include provisions governing professional secrecy and take due account of applicable data protection legislation.

text: 14. However, the EDPS recommends clarifying in Article 1(23) of the Proposal that the ESMA shall apply the EUDPR in case personal data is transferred under the administrative arrangement to third countries, also with a view to ensure consistency with the provisions of Article 9(22) of the Proposal. It is also recommended to make clear, both under

text: Article 1(23)

text: and Article 9(22) of the Proposal, that a prior authorisation of the EDPS should be obtained by ESMA before the signature of the administrative arrangement or agreement in case the transfer is based on

text: Article 48(3)

text: (b) EUDPR.

text: 4. Data platform

text: 15. Article 1(25) of the Proposal would impose an obligation on ESMA to set up a platform to facilitate the collection, storage, access to and processing of information as provided under the ESMA Regulation and other Union acts mandating the use of this platform.

text: 16. According to the Proposal, this data platform would contribute to high-quality data governance consistent with ‘FAIR’ principles (Findable, Accessible, Interoperable, Reusable) and include the supervisory technology and other tools to enhance analysis and monitoring capabilities of the relevant authorities and information.

text: 17. Recital 12 of the Proposal provides that the ‘Agency’ (which the EDPS presumes refers to the ‘Authority’, i.e., ESMA) would be acting a processor of personal data. In that capacity, ESMA would be expected to implement appropriate technical and organisational measures to ensure the security, availability, maintenance and development of the software and IT infrastructure of the platform. ESMA should also limit its processing of personal data in the platform to what is necessary to facilitate the collection, storage, access to and processing of the information submitted in accordance with the Union acts mentioned in paragraph 12 of this Opinion.

text: 18. The EDPS understands that ESMA would process personal data in the platform as a processor under EU data protection law, but notes that it is not clear who it would be processing personal data on behalf of. Therefore, the EDPS recommends clarifying the role and obligations under EU data protection law of ESMA and of the entities submitting and accessing information in the data platform in Article 1(25) of the Proposal, in line with

text: Article 3(12)

text: EUDPR for the role of processor and

text: Article 3(8)

text: for the role of controller. The EDPS also recommends clarifying the roles and responsibilities of entities submitting and accessing information in the data platform under the GDPR and the EUDPR.

text: 5. European Single Access Point

text: 19. Article 3(17) of the Proposal would replace

text: Article 23

text: a of the MiFIR in what concerns accessibility of information via the European Single Access Point (‘ESAP’) established under

text: Regulation (EU) 2023/2859

text: 20. The EDPS notes that the information transmitted via the ESAP would need to indicate whether it contains personal data. The EDPS recalls that entities submitting information via the ESAP should remove personal data therefrom, except where the personal data are required by Union or national law or constitute a necessary element of the information about the entity’s economic activities.

text: 21. In addition to its obligations under the EUDPR, the EDPS recalls that ESMA must also comply with the obligations laid down in

text: Article 11(3) of Regulation (EU) 2023/2859

text: in relation to personal data it accesses via the ESAP. For the sake of clarity, the EDPS recommends recalling these obligations by way of a recital.

text: 6. Good repute

text: 22. Article 2(15) of the Proposal would add

text: Articles 22

text: a to 22e to the EMIR, thereby conferring powers to the ESMA over significant central counterparties (‘CCPs’).

text: Article 22

text: c(5) would mandate ESMA to refuse or subsequently withdraw the appointment of the person or persons referred to in Article 27 of the EMIR if it is not satisfied that the person is of sufficiently good repute.

text: 23. The EDPS recommends empowering the Commission to lay down, via a delegated or implementing act, requirements for CCPs to assess and report to ESMA on the good repute of the persons referred to in Article 27 of the EMIR, including by specifying the personal data to be processed in that context. While such an empowerment already exists under MiCA , an equivalent empowerment should be granted to the Commission in relation to the requirements stemming from: a. novel

text: Article 2

text: d(1) of the MiFIR as proposed by Article 3(3) of the Proposal in relation to the members of the management body of a market operator and the members or participants of investment firms; c. the amended version of Article 5(5) of the DLTPR as proposed under Article 8(6) of the Proposal in relation to participants in DLT settlement systems.

text: 7. Conclusions

text: 24. In light of the above, the EDPS makes the following recommendations: (1) to include a reference to the application of the GDPR and EUDPR in a Recital of the Proposal; (2) to clarify in Article 1(23) of the Proposal that ESMA shall apply the EUDPR in case personal data is transferred under the administrative arrangement to third countries; (3) to clarify that, both under

text: Article 1(23)

text: and Article 9(22) of the Proposal, a prior authorisation of the EDPS should be obtained by ESMA before the signature of the administrative arrangement or agreement in case the transfer is based on

text: Article 48(3)

text: (b) EUDPR; (4) to clarify the roles and responsibilities under the GDPR and the EUDPR of ESMA and of the entities submitting and accessing personal data in the data platform proposed under Article 1(25) of the Proposal; (5) to recall the obligations of ESMA and of the entities submitting information via the ESAP under the EUDPR and

text: Regulation (EU) 2023/2859

text: in relation to personal data they access and submit via the European Single Access Point; and (6) to empower the Commission to lay down via a delegated or implementing act requirements for obliged entities under the Union acts that would be amended by the Proposal to assess and report to ESMA on the good repute of the persons mentioned in those acts, including by specifying the personal data to be processed under those acts. Brussels, 29 January 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI