text: . COM(2025) 480 final, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52025PC0480&qid=1757831232294 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2025) 480 final, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52025PC0480&qid=1757831232294. 4

text: Council Decision (EU) 2017/38 of 28 October 2016

text: on the provisional application of the Comprehensive Economic and Trade Agreement (CETA) between Canada, of the one part, and the European Union and its Member States, of the other part, OJ L 11, 14.1.2017, p. 1080, ELI: http://data.europa.eu/eli/dec/2017/38/oj. https://digital-strategy.ec.europa.eu/en/news/canada-european-union-digital-partnership. 6 European Commission. Joint Statement following the European Union - Canada 2025 Summit: Enduring Partnership, Ambitious Agenda. 7 Article 1 of the Recommendation and COM(2025) 480 final, p. 2. 4

text: EDPS Opinion 18/2023 on the Recommendation for a Council Decision authorising the opening of negotiations for digital trade disciplines with the Republic of Korea and with Singapore, issued on 15 May 2023. 9 EDPS Opinion 4/2025 on the Proposals for Council Decisions on the signing and conclusion, on behalf of the Union, of the Digital Trade Agreement between the European Union and the Republic of Singapore, issued on 21 March 2025. 10 EDPS Opinion 03/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, issued on 22 February 2021, paragraph 14. 11 Section 2(3)(d) of the Annex. 12 https://ec.europa.eu/newsroom/just/items/627665/en. 13 EDPS Opinion 03/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, issued on 22 February 2021, paragraph 15. 5

text: EDPS Opinion 03/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, issued on 22 February 2021, paragraphs 16-22 and 38. 15 https://ec.europa.eu/commission/presscorner/detail/en/MEX_18_546. 16 EDPS Opinion 3/2024 on the signing and conclusion on behalf of the European Union, of the Protocol amending the Agreement between the European Union and Japan for an Economic Partnership regarding free flow of data, issued on 10 January 2024, paragraphs 17 and 18. 17 EDPS Opinion 4/2025 on the Proposals for Council Decisions on the signing and conclusion, on behalf of the Union, of the Digital Trade Agreement between the European Union and the Republic of Singapore, issued on 21 March 2025, paragraphs 11 and 12. 18 Section (2)(6) of the Annex. 19 COM(2022) 336 final, Recital 4, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52022PC0336&from=FR. 20

text: : Commission Decision of 20 December 2001 pursuant to Directive

text: of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act (notified under document number C(2001) 4539) (OJ L 2, , pp. 13–16) 21 Report from the Commission to the European Parliament and the Council on the first review of the functioning of the adequacy decisions adopted pursuant to

text: Article 25(6) of Directive 95/46/EC

text: , COM/2024/7 final, adopted on 15 January 2024, Section 4.3. 22

text: Article 45(1)

text: GDPR and

text: Article 1

text: and Recital 5 of the Adequacy Decision. 6

text: Section 2(4) of the Annex. 24 Section 2(6) of the Annex. 25 Section 2(9) of the Annex. 26

text: Article 86 of Regulation (EU) 2025/327

text: of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive

text: and

text: Regulation (EU) 2024/2847

text: , OJ L, 2025/327, 5.3.2025, ELI: http://data.europa.eu/eli/reg/2025/327/oj. See also EDPB-EDPS Joint Opinion 03/2022 on the Recommendation for a Regulation on the European Health Data Space, issued on 12 July 2022, paragraph 111. 27 EDPS Opinion 17/2022 on the Recommendation for a Council Decision authorising the opening of negotiations for the inclusion of provisions on cross-border data flows in the Agreement between the European Union and Japan for an Economic Partnership, issued on 9 August 2022, paragraph 15. 7

identifier: EDPS yttrande 26/2025

amnesord:
Finance
International Agreements
Transfers of data

title: EDPS Opinion 26/2025 on the Recommendation for a Council Decision authorising the opening of negotiations for a digital trade agreement with Canada

text: Opinion 26/2025

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to Commission Recommendation for a Council Decision authorising the opening of negotiations for a digital trade agreement with Canada . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Commission Recommendation for a Council Decision authorising the opening of negotiations for a digital trade agreement with Canada that are relevant from a data protection perspective.

text: Executive Summary

text: On 10 September 2025, the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for a digital trade agreement with Canada.

text: The objective of this Recommendation is to authorise the Commission to open negotiations with Canada to complement the existing free trade agreement between the EU and Canada by establishing comprehensive rules on digital trade between the EU and Canada. These negotiations may cover cross-border data flows with trust, data localisation requirements and personal data protection.

text: The EDPS recalls that, as the protection of personal data is a fundamental right in the Union, it cannot be subject to negotiations in the context of EU trade agreements. Dialogues on data protection and trade negotiations with third countries can complement each other but must follow separate tracks. Personal data flows between the EU and third countries should be enabled by using the mechanisms provided under the EU data protection legislation. The EDPS recalls that in 2018, the Commission endorsed horizontal provisions for cross-border data flows and personal data protection in trade negotiations. The EDPS considers that these provisions reach a balanced compromise between public and private interests as they allow the EU to tackle protectionist practices in third countries in relation to digital trade, while ensuring that trade agreements cannot be used to challenge the high level of protection guaranteed by the Charter of Fundamental Rights of the EU and the EU legislation on the protection of personal data. The EDPS understands from the Recommendation that the negotiations on data flows and data protection should be opened with a view to agree on provisions that are coherent with these horizontal provisions. For the sake of clarity, the EDPS recommends to make an express reference to these horizontal provisions.

text: In addition, the EDPS notes that Canada has already been granted an adequacy finding by the Commission in 2002. Consequently, transfers of personal data from a controller or a processor in the European Economic Area (EEA) to organisations in Canada covered by the adequacy decision may take place without the need to obtain any further authorisation. Therefore, the EDPS recommends to further explain why, despite the adequacy decision, further negotiations on crossborder data flows and data protection are considered to be necessary in the case of Canada.

text: Furthermore, the EDPS understands the negotiating directives and the horizontal provisions as allowing, in duly justified cases, measures that would require controllers or processors to store personal data in the EU/EEA. The EDPS recalls that the recently adopted Regulation on the European Health Data Space allows EU Member States to require that the storage of personal electronic health data for the purpose of primary use be located within the Union, subject to specific conditions. For the avoidance of doubt, the EDPS recommends to expressly clarify in the negotiating directives that the negotiated rules should not prevent the EU or the Member States from adopting, in duly justified cases, measures that would require controllers or processors to store personal data in the EU/EEA.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 10 September 2025, the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for a digital trade agreement with Canada (‘the Recommendation’). An annex to the Recommendation details the directives for the negotiation of a digital trade agreement with Canada and the proposed content of the rules and commitments (‘the Annex’).

text: 2. The European Union (‘EU’) and Canada have entered into a free trade agreement called the Comprehensive Economic and Trade Agreement (‘CETA’), which has been provisionally applied since 2017. Furthermore, the EU and Canada launched the EU-Canada Digital Partnership in November 2023 , providing a framework for regulatory cooperation on digital policies in key areas of mutual interest. At the EU-Canada Summit on 23 June 2025, the European Union and Canada agreed to modernise their approach to trade by launching work towards a Digital Trade Agreement (‘DTA’) that would complement the CETA.

text: 3. The objective of the Recommendation is to authorise the Commission to open negotiations with Canada to complement the CETA by establishing comprehensive rules on digital trade between the EU and Canada, in accordance with

text: Article 218(3)

text: and (4) TFEU, on the basis of the negotiating directives set out in the Annex.

text: 4. The Explanatory Memorandum of the Recommendation states that “[t]he negotiating directives proposed follow a consistent approach as the EU pursued for its recent DTA negotiations with Singapore and Korea”. The EDPS was consulted and issued Opinions on the Recommendation for a Council Decision authorising the opening of negotiations for digital trade disciplines with the Republic of Korea and with Singapore , as well as on the Proposals for Council Decisions on the signing and conclusion, on behalf of the Union, of the Digital Trade Agreement between the European Union and the Republic of Singapore .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 16 September 2025, pursuant to Article 42(1) of EUDPR.

text: 2. General remarks

text: 6. The EDPS has long taken the view that, as the protection of personal data is a fundamental right in the Union, it cannot be subject to negotiations in the context of EU trade agreements. It is for the EU alone to decide how to implement fundamental rights protections in Union law. The Union cannot and should not embark on any international trade commitments that are incompatible with its domestic data protection legislation. Dialogues on data protection and trade negotiations with third countries can complement each other but must follow separate tracks. Personal data flows between the EU and third countries should be enabled by using the mechanisms provided under the EU data protection legislation.

text: 7. In this context, the EDPS notes that the negotiating directives, included in the Annex, provide that ‘the negotiations may cover cross-border data flows with trust, data localisation requirements and personal data protection’.

text: 8. The EDPS recalls that in 2018, the Commission endorsed horizontal provisions for crossborder data flows and personal data protection in trade negotiations (‘the Horizontal Provisions’).

text: 9. The EDPS recalls that he supports the legal wording of the Horizontal Provisions as the best outcome achievable to preserve individual’s fundamental rights to data protection and privacy. The Horizontal Provisions reach a balanced compromise between public and private interests as they allow the EU to tackle protectionist practices in third countries in relation to digital trade, while ensuring that trade agreements cannot be used to challenge the high level of protection guaranteed by the Charter of Fundamental Rights of the EU and the EU legislation on the protection of personal data.

text: 10. In his Opinion 3/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, the EDPS recommended that the wording agreed with the UK on data protection and privacy (which modified the Horizontal Provisions) remained an exception and would not be the basis for future trade agreements with other third countries. The EDPS recalls that the Commission has repeatedly stated that as ‘the protection of personal data is a fundamental right in the EU, it cannot be subject to negotiations in the context of EU trade agreements’. Consequently, the Horizontal Provisions should not be up for negotiation. Still, the EDPS reiterated this recommendation in relation to wording that differed from the text of the Horizontal Provisions in the context of subsequent trade agreements, such as with Japan and Singapore .

text: 11. The EDPS understands from the Recommendation that the negotiations on data flows and data protection should be opened with a view to agree on provisions that are coherent with the Horizontal Provisions . For the sake of clarity, the EDPS recommends to make an express reference to the Horizontal Provisions, as was done for instance in the Commission’s Recommendation for a Council Decision authorising the opening of negotiations for the inclusion of provisions on cross-border data flows in the Agreement between the European Union and Japan for an Economic Partnership.

text: 12. The EDPS recalls that Canada has already been granted an adequacy finding by the 20 21 Commission on 20 December 2002 (‘the Adequacy Decision’) , which remains valid . Consequently, transfers of personal data from a controller or a processor in the European Economic Area (EEA) to commercial organisations in Canada that are subject to the Personal Information Protection and Electronic Documents Act (the ones covered by the Adequacy Decision) may take place without the need to obtain any further authorisation.

text: 13. In view of the Adequacy Decision, the need for having additional rules covering crossborder data flows and data protection as regards Canada in the context of digital trade is unclear. In other words, the EDPS recommends to explain why, despite the Adequacy Decision, further negotiations on cross-border data flows and data protection are considered to be necessary in the case of Canada.

text: 3. Negotiations on cross-border data flows and data protection

text: 14. The negotiating directives, included in the Annex, provide that:  The negotiated rules and commitments ʽshould be in line with the EU legal framework and should preserve the regulatory autonomy required to implement and develop the EU data and digital policies’ ;  The ʽnegotiations should result in rules covering cross-border data flows addressing unjustified data localisation requirements, while neither negotiating nor affecting the EU’s personal data protection rules and should, notably be in line with the EU legal framework on the protection of personal and non-personal data’ ; and  ‘The Agreement should not prevent the European Union, its Member States and their national, regional and local authorities from regulating economic activity in the public interest, to achieve legitimate public policy objectives such as (...) privacy and personal data protection’ .

text: 15. The EDPS welcomes the directives, which are in line with Article 2(2) of the Horizontal Provisions, according to which ‘[e]ach Party may adopt and maintain the safeguards it deems appropriate to ensure the protection of personal data and privacy, including through the adoption and application of rules for the cross-border transfer of personal data. Nothing in this agreement shall affect the protection of personal data and privacy afforded by the Parties’ respective safeguards.’

text: 16. The EDPS understands the negotiating directives and the Horizontal Provisions as allowing, in duly justified cases, measures that would require controllers or processors to store personal data in the EU/EEA. The EDPS recalls that the recently adopted Regulation on the European Health Data Space allows EU Member States to require that the storage of personal electronic health data for the purpose of primary use be located within the Union, subject to specific conditions. For the avoidance of doubt, the EDPS recommends to expressly clarify in the negotiating directives that the negotiated rules should not prevent the EU or the Member States from adopting, in duly justified cases, measures that would require controllers or processors to store personal data in the EU/EEA.

text: 4. Reference to this Opinion

text: 17. The EDPS notes that the Recommendation does not refer to the EDPS consultation. Therefore, the EDPS recommends inserting a reference to the EDPS consultation in a recital of the Recommendation.

text: 5. Conclusions

text: 18. In light of the above, the EDPS makes the following recommendations: (1) to make an express reference to the fact that the negotiations on data flows and data protection should be opened with a view to agree on provisions that are coherent with the horizontal provisions for cross-border data flows and personal data protection in trade negotiations endorsed by the Commission in 2018; (2) to explain in a recital why, despite the adequacy decision granted to Canada, further negotiations on cross-border data flows and data protection are considered to be necessary with this country; (3) to clarify, in the negotiating directives included in the annex to the Recommendation, that the negotiated rules should not prevent the EU or the Member States from imposing on controllers and processors, in duly justified cases, to store personal data in the EU/EEA; and (4) to insert a reference to the EDPS consultation in a recital of the Council Decision. Brussels, 16 October 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8 9


text: COM(2023) 223 final. COM(2023) 221 final. 1

text: OJ L 295, 21.11.2018, p. 39. 4 COM(2023) 223 final. COM(2023) 221 final. 6 COM(2023) 223 final, Explanatory Memorandum, p. 1. 4

text: COM(2023) 223 final. 8 COM(2023) 221 final. 9 See Article 36(4) of the national SPC Proposal and Article 35(4) of the unitary SPC Proposal. 10 Article 9(2) and 22 of the national SPC Proposal and Article 12 of the unitary SPC Proposal. 11

text: Article 9(1)

text: juncto Article 12 of the unitary SPC Proposal. 12 Under the national SPC Proposal, publication by the Office is envisaged in case of a centralised application (Articles 20-22 of the national SPC Proposal). 5

text: See also Judgment of the European Court of Justice of 9 November 2010 in Joint Cases

text: and

text: , Volker und Markus Schecke GbR (

text: ) and Hartmut Eifert (

text: ) v Land Hessen, ECLI:EU:C:2010:662, par. 53. 14 Cf. Recital 30 of the national SPC Proposal. 15 Cf. Article 14 of the unitary SPC Proposal. 16 A general statement declaring the information to be ‘of public interest’ without further qualification or explanation does not constitute a clearly defined objective of public interest justifying public accessibility. 17 See further EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: , 7 November 2019, p.8. 6

identifier: EDPS yttrande 27/2023

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 27/2023 on the Proposals for Regulations on supplementary protection certificates for plant protection products

serie: yttranden

text: 21 June 2023

type: rubrik

text: Opinion 27/2023

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on the supplementary protection certificate for plant protection products (recast) and to the Proposal for a Regulation of the European Parliament and of the Council on the unitary supplementary protection certificate for plant protection products . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 27 April 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on the supplementary protection certificate for plant protection products (recast) and the Proposal for a Regulation of the European Parliament and of the Council on the unitary supplementary protection certificate for plant protection products. The objective of the Proposals is to simplify the EU’s Supplementary Protection Certificates (SPCs) system as regards national SPCs for plant protection products, as well as improve its transparency and efficiency, and to create a unitary certificate for plant protection products, complementing the unitary patent system.

text: The Proposals provide for (a notification of) an application for a certificate, including personal data such as the applicant’s address, to be published in a Register. As the publication of personal data constitutes an interference with the right to data protection, the Proposal should clearly articulate the specific purposes for which personal data may be made available. In addition, the EDPS recommends to consider providing for a mechanism that would allow access not to the public, but only to parties capable of demonstrating a legitimate interest linked to the Proposal’s objectives.

text: The EDPS notes the Proposals provide for unlimited retention of all entries in the Register and in an administrative database. At the same time, the Proposals provide that the party concerned may request removal of personal data from the database 18 months after expiry of the certificate or the closure of an inter partes procedure. As personal data should not be kept for longer than is necessary to achieve the purposes of the processing, the EDPS considers that personal data in the Register and database should not be kept indefinitely. The EDPS invites the legislature to consider whether an 18-month retention period could be prescribed as a rule for personal data regardless of the submission of a request, both for the Register and the database, with the possibility to extend the retention period, where necessary, to safeguard the rights of individuals (e.g., in the context of possible exercise of legal claims).

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 27 April 2023, the European Commission issued • the Proposal for a Regulation of the European Parliament and of the Council on the supplementary protection certificate for plant protection products (recast) (‘the national SPC Proposal’) and • the Proposal for a Regulation of the European Parliament and of the Council on the unitary supplementary protection certificate for plant protection products (‘the unitary SPC Proposal’) (together ‘the Proposals’).

text: 2. The Proposals are part of a larger package of new EU rules on patents. Four Proposals deal with Supplementary Protection Certificates (SPC), two of which are the subject of this Opinion.

text: 3. An SPC is an intellectual property right sui generis that extends the 20-year term of patents for medicinal or plant protection products by up to 5 years. However, SPC protection so far is only available at national level. As a result, according to the Commission, the current system suffers from fragmentation, which leads to complex and costly procedures, as well as legal uncertainty .

text: 4. The objective of the national SPC Proposal is to simplify the EU’s SPCs system as regards national SPCs for plant protection products, as well as improve its transparency and efficiency. The Proposal is a Recast of

text: Regulation (EC) No 1610/96

text: , which provides for SPCs for plant protection products. The Proposal also aims to introduce a centralised procedure for granting SPCs for plant protection products. This would allow applicants to obtain SPCs in the respective designated Member States by filing a single ‘centralised SPC application’ that would undergo a single centralised examination procedure by the European Union Intellectual Property Office (‘the Office’), supported by national offices.

text: 5. The main objectives of the unitary SPC Proposal are to simplify the EU’s SPC system, as well as improve its transparency and efficiency, by creating a unitary certificate for plant protection products, and to complement the unitary patent system (‘European patent with unitary effect’). Under the Proposal, the unitary SPC can be requested by filing an application that would then be subjected to the same centralised examination procedure by the European Union Intellectual Property Office (‘the Office’) as applicable to ‘centralised SPC applications’ mentioned in the previous paragraph.

text: 6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 27 April 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the 7 8 reference to this consultation in Recitals 53 and 43 respectively of the two Proposals.

text: 2. General remarks

text: 7. The EDPS takes note of the fact that the emphasis of these Proposals is not on the processing of personal data. However, launching an application for a certificate or unitary certificate will involve the processing of certain personal data, even if the applicant is a legal and not a natural person. Against this background, this Opinion will focus on the provisions requiring publication of personal data, as well as the proposed storage duration.

text: 8. The EDPS notes that both Proposals make reference to

text: Regulation (EC) No 45/2001

text: . As this legal act has been repealed by the EUDPR, the EDPS recommends making reference to the EUDPR instead.

text: 3. Publication of personal data of applicants and representatives

text: 9. Both Proposals require (notification of) an application for a certificate to be published in a public register . The Proposals diverge, however, as to when information relating to the representatives of the applicant, if any, should be published. While the unitary SPC Proposal would require publication of the name and address of the representative by the Office in a Register , the national SPC Proposal would not require the competent industrial property office of the relevant Member State to publish such information .

text: 10. The reason for this difference in treatment of personal data concerning representatives is not immediately apparent. If the publication of such data is not necessary to achieve the purposes of the processing, it should not be provided for.

text: 11. The EDPS recognizes that the applicant does not need to be the inventor, but instead will often be a company. Even then, however, the natural persons authorised to represent the company are regularly named as well. Company names may also contain the name of the natural person who is the owner of the company .

text: 12. The Proposals mention transparency and legal certainty, especially a reduced risk of subsequent challenges of a granted SPC, as objectives of the publication . However, the EDPS recalls that transparency can only justify the processing of personal data to the extent it is necessary and proportionate. In the view of the EDPS, this does not seem to be the case in relation to the publication of the address of natural person applicants.

text: 13. The EDPS also has doubts as to whether the objective to allow for speedy intervention by interested parties would justify to publish the addresses of natural persons as applicants prior to the issuance of a certificate. The publication of applications under the Proposals prior to a decision on the applications would enable for observations by third parties to be submitted during the examination phase conducted by the European Union Intellectual Property Office, which is also maintaining the Register, allowing for the early assertion of any objections . As the Office receiving the observations is also competent to examine the applications, it is not apparent why a third party coming forward with an observation would need to obtain the full address of the applicant from the public entry in the Register.

text: 14. Against this background, the EDPS invites the co-legislators to consider whether the publication of personal data envisaged by the Proposal is necessary to achieve its objectives. As the publication of personal data constitutes an interference with the right to data protection, the Proposal should clearly articulate the specific purposes for which personal data may be made available . In addition, the EDPS recommends to consider providing for a mechanism that would allow access not to the public, but only to parties capable of demonstrating a legitimate interest linked to the Proposal’s objectives. A clear specification of the purposes and conditions under which access may be granted would constitute an important safeguard to ensure that access to and use of these personal data would be limited to the purposes for which they are made available.

text: 4. Roles and Responsibilities

text: 15. The Proposals determine the purposes and means of the processing of personal data in the Register as well as in the additional electronic database. In line with Article 3(8) of the EUDPR, the EDPS recommends to designate EUIPO as controller for the personal data processing .

text: 5. Retention period

text: 16. According to Article 34(9) of the national SPC Proposal, Article 33(8) of the unitary SPC Proposal respectively, all entries in the Register shall be kept for an indefinite period of time ‘for reasons of legal certainty’. Likewise, according to Article 35(5) of the national SPC Proposal and Article 34(5) of the unitary SPC Proposal, all data in the ‘database’ shall be kept indefinitely. However, the party concerned may request the removal of any personal data from the database after 18 months from the expiry of the certificate or, the case being, the closure of the relevant inter partes procedure.

text: 17. According to

text: Article 4(1)

text: (e) of the EUDPR, personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. Therefore, personal data is to be removed ex officio once its processing is no longer necessary. In this regard, the EDPS invites the legislature to consider whether an 18-month retention period could be prescribed as a rule for personal data regardless of the submission of a request, both for the Register and the database, with the possibility to extend the retention period, where necessary, to safeguard the rights of individuals (e.g., in the context of possible exercise of legal claims).

text: 6. Conclusions

text: 18. In light of the above, the EDPS makes the following recommendations: (1) to replace the references to

text: Regulation (EC) No 45/2001

text: with a references to

text: Regulation (EU) 2018/1725

text: ; (2) to clearly articulate the specific purposes for which personal data may be made available and consider providing for a mechanism that would allow access not to the public, but only to parties capable of demonstrating a legitimate interest linked to the Proposal’s objectives (3) to designate EUIPO as controller within the meaning of the EUDPR for processing of personal data in the Register as well as in the additional electronic database; (4) to align the provisions on the deletion of personal data from the Register and the database with

text: Article 4(1)

text: (e) of the EUDPR by providing a maximum storage duration. Brussels, 21 June 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7

type: vagledning

utgivare: edps


text: OJ L 295, 21.11.2018, p. 39. 2 COM(2025) 478 final. 3 COM(2025) 479 final. 4 Article 1 of the Signing Proposal. Article 1 of the Conclusion Proposal. 4

text: COM(2023) 230 final. 7 EDPS Opinion 18/2023 on the Recommendation for a Council Decision authorising the opening of negotiations for digital trade disciplines with the Republic of Korea and with Singapore, 15 May 2023. 8 Council Decision 8886/23. 9 COM(2025) 478 final, p. 1. 10 OJ L 127, 14.5.2011. 11 OJ L 20, 23.1.2013. 12 https://digital-strategy.ec.europa.eu/en/news/eu-and-republic-korea-digital-partnership-strengthening-our-economic-resilience. 13

text: Article 2(2)

text: (c) of the Digital Trade Agreement. 14

text: Article 16(2)

text: (g) of the Digital Trade Agreement. 15 https://ec.europa.eu/newsroom/just/items/627665/en. 16 EDPS Opinion 03/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, issued on 22 February 2021, paragraph 14. 5

text: In this regard, the EDPS positively notes that Korea has already been granted an adequacy finding by the Commission on 23 January 2019 (‘the Adequacy Decision) . Consequently, transfers of personal data from a controller or a processor in the European Economic Area (EEA) to organisations in Korea covered by the Adequacy Decision may take place without the need to obtain any further authorisation .

text: In this context, the EDPS notes that the Digital Trade Agreement concerns, inter alia, crossborder data flows between the European Union and Korea. In view of the Adequacy Decision, the need for having additional rules covering cross-border data flows (including of personal data) should be expressed in more detail so that the justification for the inclusion of such rules is made clearer. In other words, the EDPS recommends to further explain why, despite the Adequacy Decision, further negotiations on cross-border data flows (including of personal data) are considered necessary.

text: Commission Implementing Decision

text: (EU) 2022/254

text: of 17 December 2021 pursuant to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council on the adequate protection of personal data by the Republic of Korea under the Personal Information Protection Act (notified under document C(2021) 9316), C/2021/9316, OJ L 44, 24.2.2022, pp. 1–90. 18

text: Article 45(1)

text: GDPR and Recital 7 of the Adequacy Decision. 19 EDPS Opinion 03/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, issued on 22 February 2021, paragraph 15. 20 EDPS Opinion 18/2023 on the Recommendation for a Council Decision authorising the opening of negotiations for digital trade disciplines with the Republic of Korea and with Singapore, 15 May 2023, paragraph 11. 21 https://ec.europa.eu/commission/presscorner/detail/en/MEX_18_546. 6

text: Article B(2) of the Horizontal Provisions. 23 This is particularly concerning given the wording of Article 39(5) of the Digital Trade Agreement, which provides that “the Parties agree that nothing in this Agreement requires them to act in a manner inconsistent with their obligations under the WTO Agreement”. 7

text: As an example, the EDPS and the European Data Protection Board (EDPB) have recommended the co-legislators to require that controllers and processors, established in the EU/EEA and processing personal electronic health data within the scope of the Commission’s Proposal for a Regulation on the European Health Data Space, should be required to store this data in the EU/EEA, without prejudice to the possibility to transfer personal electronic health data in compliance with Chapter V GDPR. See EDPB- EDPS Joint Opinion 03/2022 on the Recommendation for a Regulation on the European Health Data Space, issued on 12 July 2022, paragraph 111. The final version of the text allows EU Member States to require that the storage of personal electronic health data for the purpose of primary use be located within the Union, subject to specific conditions. See

text: Article 86 of Regulation (EU) 2025/327

text: of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive

text: and

text: Regulation (EU) 2024/2847

text: , OJ L, 2025/327, 5.3.2025, ELI: http://data.europa.eu/eli/reg/2025/327/oj. 25 Footnote 16 of the Digital Trade Agreement clarifies that “conditions of general application" refer to conditions formulated in objective terms that apply horizontally to an unidentified number of economic operators and thus cover a range of situations and cases. 8

text: Article 11(1) of the Digital Trade Agreement. 27 Article 11(3) of the Digital Trade Agreement. 28 For example, entities in Korea may be covered by the GDPR by virtue of its

text: Article 3(2)

text: . 9

identifier: EDPS yttrande 27/2025

amnesord:
International Agreements
Transfers of data

title: EDPS Opinion 27/2025 on the Proposals for Council Decisions on the signing and conclusion, on behalf of the Union, of the Digital Trade Agreement between the European Union and the Republic of Korea

text: Opinion 27/2025

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the (i) Proposal for a Council Decision on the signing, on behalf of the European Union, of the Digital Trade Agreement between the European Union and the Republic of Korea, and (ii) the Proposal for a Council Decision on the conclusion, on behalf of the European Union, of the Digital Trade Agreement between the European Union and the Republic of Korea. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 14 April 2023, the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for digital trade disciplines with the Republic of Korea and with Singapore (the ‘Recommendation’), on which the EDPS issued his Opinion 18/2023 of 15 May 2023. On 27 June 2023, the Council authorised the Commission to negotiate digital trade disciplines with the Republic of Korea. The Commission, on behalf of the Union, and the Republic of Korea launched the negotiations on 31 October 2023. The negotiations were concluded in principle on 10 March 2025. The Digital Trade Agreement will complement the existing EU-Korea Free Trade Agreement and give effect to the trade provisions of the EU-Korea Framework Agreement.

text: On 10 September 2025, the European Commission issued two proposals for Council Decisions on the signing and conclusion, on behalf of the European Union, of the Digital Trade Agreement between the European Union and the Republic of Korea.

text: The Digital Trade Agreement concerns, among other matters, cross-border data flows and personal data protection. Like in his Opinion 18/2023 on the Recommendation, the EDPS recalls that the protection of personal data is a fundamental right in the Union and cannot be subject to negotiations in the context of EU trade agreements. Dialogues on data protection and trade negotiations with third countries can complement each other but must follow separate tracks. Given that Korea has already been granted an adequacy finding by the Commission which allows personal data to flow from the EU to Korea without the need to obtain any further authorisation, the EDPS recommends to further explain why, despite the Adequacy Decision, further negotiations on cross-border data flows (including of personal data) are considered necessary.

text: The EDPS welcomes the fact that the Digital Trade Agreement makes a reference to the horizontal provisions for cross-border data flows and personal data protection in trade negotiations and recommends making such reference in a recital of the Digital Trade Agreement. At the same time, the EDPS considers that certain amendments to the wording of the horizontal provisions might create legal uncertainty as to the Union’s position on the protection of personal data in connection with EU trade agreements.

text: To better reflect the EU commitment to the protection of personal data, the EDPS recommends amending the Digital Trade Agreement to clarify that each party may adopt and maintain the safeguards it deems appropriate to ensure the protection of personal data and privacy, including through rules for the cross-border transfer of personal data. The EDPS also recommends clarifying that nothing in the Digital Trade Agreement shall affect the protection of personal data and privacy afforded by the parties’ respective safeguards. To give effect to this, the EDPS further recommends specifying that the "legitimate public policy objectives" allowing regulatory authorities to require access to source code include not only the ones currently listed in the Digital Trade Agreement, but also the protection of individuals with regard to the processing of personal data.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 10 September 2025, the European Commission issued: a. a Proposal for a Council Decision on the signing, on behalf of the European Union, of the Digital Trade Agreement between the European Union and the Republic of Korea (‘the Signing Proposal’); b. a Proposal for a Council Decision on the conclusion, on behalf of the European Union, of the Digital Trade Agreement between the European Union and the Republic of Korea (‘the Conclusion Proposal’).

text: 2. The objective of the Signing Proposal is to authorise the signing, on behalf of the Union, of the Digital Trade Agreement . The objective of the Conclusion Proposal is to approve the Digital Trade Agreement, which is attached to the Conclusion Proposal as an Annex .

text: 3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 10 September 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in the third citation of both the Signing Proposal and Conclusion Proposal.

text: 2. General remarks

text: 4. On 14 April 2023, the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for digital trade disciplines with the Republic of Korea and with Singapore (the ‘Recommendation’). The EDPS was consulted on this matter and issued on 15 May 2023 his Opinion 18/2023 on the Recommendation .

text: 5. On 27 June 2023, the Council authorised the Commission to negotiate digital trade disciplines with the Republic of Korea (‘Korea’). The Commission, on behalf of the Union, and Korea launched the negotiations on 31 October 2023. The negotiations were concluded in principle on 10 March 2025. The Digital Trade Agreement aims to enhance consumer protection online, provide legal certainty for businesses that want to engage in cross-border digital trade, and address unjustified barriers to digital trade . It will complement the existing EU-Korea Free Trade Agreement (‘FTA’) and give effect to the trade provisions of the EU-Korea Framework Agreement (‘PCA’). The Digital Trade Agreement also builds on the EU-Korea Digital Trade Principles, a deliverable of the EU-Korea Digital Partnership .

text: 6. The commitments in the Digital Trade Agreement are of a binding nature and range from commitments on cross-border data flows and online consumer protection, to commitments on the protection of source code of software. The EDPS notes that the Digital Trade Agreement would also apply to open government data , as long as (among other conditions) each Party ensures such data is made available for reuse in full compliance with its personal data protection rules, including appropriate anonymisation .

text: 7. According to the Explanatory Memorandum of the Conclusion Proposal, section A of chapter two of the Digital Trade Agreement, on data flows with trust, includes provisions that are in line with EU practice based on the 2018 horizontal provisions on cross-border data flows and the protection of personal data and privacy in trade agreements (‘the Horizontal Provisions’), which recognise each Party's right to determine the appropriate level of privacy and personal data protection in their jurisdictions.

text: 8. The EDPS has long taken the view that, as the protection of personal data is a fundamental right in the Union, it cannot be subject to negotiations in the context of EU trade agreements. It is for the EU alone to decide how to implement fundamental rights protections in Union law. The Union cannot and should not embark on any international trade commitments that are incompatible with its domestic data protection legislation. Dialogues on data protection and trade negotiations with third countries can complement each other but must follow separate tracks. Personal data flows between the EU and third countries should be enabled by using the mechanisms provided under the EU data protection legislation .

text: 3. Horizontal provisions on cross-border data flows

text: 11. The EDPS recalls that he supports the wording of the Horizontal Provisions as the best outcome achievable to preserve individual’s fundamental rights to data protection and privacy. The Horizontal Provisions reach a balanced compromise between public and private interests as they allow the EU to tackle protectionist practices in third countries in relation to digital trade, while ensuring that trade agreements cannot be used to challenge the high level of protection guaranteed by the Charter of Fundamental Rights of the EU and the EU legislation on the protection of personal data .

text: 12. In his Opinion 18/2023, the EDPS welcomed that Section (2)(6) of the Annex to the Recommendation established that negotiations on data flows and data protection ‘should result in rules covering cross-border data flows addressing unjustified data localisation requirements, while neither negotiating nor affecting the EU’s personal data protection rules and should, notably be in line with the EU legal framework on the protection of personal and non-personal data’ . He also recommended to ensure consistency with and make an express reference to the Horizontal Provisions, which the Conclusion Proposal only does in its Explanatory Memorandum. Therefore, the EDPS recommends including this reference in a recital of the Conclusion Proposal.

text: 13. On this note, the EDPS recalls that the Commission has repeatedly stated that as ‘the protection of personal data is a fundamental right in the EU, it cannot be subject to negotiations in the context of EU trade agreements’. Consequently, the Horizontal Provisions should not be up for negotiation .

text: 4. Differences and similarities between the Horizontal Provisions and the Digital Trade Agreement

text: 14. The EDPS notes that the Digital Trade Agreement does not integrally incorporate the Horizontal Provisions. In amending the wording of the Horizontal Provisions, the EDPS considers that the Digital Trade Agreement could create legal uncertainty as to the Union’s position on the protection of personal data in connection with EU trade agreements and risks creating friction with the EU data protection legal framework. The EDPS recalls that, as a matter of principle, the wording of the Horizontal Provisions should be kept in EU trade agreements containing provisions for cross-border data flows and personal data protection. He also stresses that any different wording resulting from negotiations in a specific case should not serve as a precedent for negotiations of EU trade agreements with other third countries on matters of cross-border data flows and personal data protection.

text: 15. In particular, the EDPS notes that Article 6 of the Digital Trade Agreement does not state that ‘[n]othing in this agreement shall affect the protection of personal data and privacy afforded by the Parties’ respective safeguards’. This wording, as reflected in the Horizontal Provisions, is meant to ensure that if EU laws protecting privacy and related to data protection were challenged in a trade dispute, the EU would not need to justify its data protection and privacy laws under strict tests based on Article XIV of the World Trade Organization’s (WTO) General Agreement on Trade in Services. Its absence in the Digital Trade Agreement might not prevent the EU from having to pass strict trade tests to justify its measures safeguarding the fundamental rights to privacy and personal data protection .

text: 16. The EDPS welcomes that Article 14(3) of the Digital Trade Agreement - which is akin to Article X of the Horizontal Provisions - mandates the Parties to cooperate in relation to their respective rules and safeguards for the protection of personal data and privacy, including on cross-border transfers of personal data, subject to the application of Article 6 of the Digital Trade Agreement on data protection.

text: 5. Other data protection safeguards in the Digital Trade Agreement

text: 17. The EDPS welcomes that Article 3 of the Digital Trade Agreement recognises the Parties’ right to regulate within their territories to achieve legitimate policy objectives, such as the protection of public health, social services, public education, safety, environment or public morals, social or consumer protection, privacy and data protection, and the promotion and protection of cultural diversity. The EDPS welcomes that Article 5(3) of the Digital Trade Agreement would allow the EU to adopt or maintain measures that would require inter alia the localisation of data (including personal data) in the territory of the EU for storage or processing or require the use of computing facilities or network elements in the territory of the EU for processing of data to achieve a “legitimate public policy objective” (other than the protection of personal data and privacy), under certain conditions.

text: 18. The EDPS notes that

text: Article 5(2)

text: (f) of the Digital Trade Agreement would establish that a Party shall not adopt or maintain measures which prohibit or restrict the cross-border transfer of data between the Parties by “requiring the approval of the Party prior to the transfer of data to the territory of the other Party”. The EDPS welcomes that footnote 10 of the Digital Trade Agreement clarifies that this provision would not prevent the EU from subjecting the use of a specific transfer instrument or a particular cross-border transfer of data to approval on grounds relating to the protection of personal data and privacy, in compliance with Article 6 of the Digital Trade Agreement.

text: 19. However, the EDPS is concerned that the Digital Trade Agreement, in its current wording, could affect the possibility for the EU to, in duly justified cases, enact measures that would require controllers or processors to store personal data in the EU/EEA . It appears that Article 6(5) of the Digital Trade Agreement would only allow the Parties to adopt and apply rules for the cross-border transfer of personal data if they also provide for instruments enabling such transfers under conditions of general application for the protection of the data transferred. It is not clear whether all duly justified cases in which the EU would decide to require specific controllers or processors to store specific categories of personal data in the EU/EEA based on grounds related to the fundamental rights to data protection and privacy would qualify as conditions of general application under Article 6(5) of the Digital Trade Agreement .

text: 20. In any event, the EDPS considers that it is possible to interpret Article 6(5) of the Digital Trade Agreement as allowing the EU to require, in duly justified cases, specific controllers or processors to store specific categories of personal data in the EU/EEA based on grounds related to the fundamental rights to data protection and privacy, as long as there is a general framework (such as Chapter V of the GDPR) enabling transfers under conditions of general application.

text: 21. The EDPS welcomes that

text: Articles 6(2)

text: and (4) of the Digital Trade Agreement establish that “Each Party Party shall adopt or maintain a legal framework that provides for the protection of the personal data of individuals” and that “provides non-discriminatory protection of personal data for individuals”. The EDPS recommends the removal of the qualifier “engaged in digital trade” from Article 6(2) of the Digital Trade Agreement, to ensure an encompassing protection of individuals with regards to the processing of their personal data. The EDPS also welcomes the reference in Article 6(3) of the Digital Trade Agreement to core data protection principles (such as lawfulness, purpose specification and transparency) that should be reflected in each Party’s legal framework for the protection of personal data

text: 6. Access to source code

text: 22. The EDPS also notes that the Digital Trade Agreement would prohibit the Parties from requiring the transfer of, or access to, the source code of software owned by a natural or legal person of the other Party, as a condition for the import, export, distribution, sale or use of such software, or of products containing such software, in or from its territory . The provision contains several exceptions, including where regulatory authorities require the transfer of, or access to, source code of software for investigation, inspection or examination, enforcement action or judicial proceeding purposes, to secure compliance with its laws and regulations pursuing legitimate public policy objectives .

text: 23. The EDPS notes that personal data protection is not listed among the “legitimate public policy objectives” in footnote 22, which accompanies Article 11(3) of the Digital Trade Agreement. Data protection supervisory authorities under the GDPR or the EUDPR should not be prevented from requiring access to source code from entities in third countries (such as Korea), notably when access to such source code is necessary to monitor compliance with such Regulations by such entities . Therefore, the EDPS considers it necessary to specify in footnote 22 that "legitimate public policy objectives" allowing authorities to require access to source code include not only the ones listed in the footnote to Article 5(3) of the Digital Trade Agreement, but also the protection of individuals with regard to the processing of personal data.

text: 7. Conclusions

text: 24. In light of the above, the EDPS makes the following recommendations: (1) to detail in a recital the reasons why, despite the Adequacy Decision, further rules on crossborder data flows (including of personal data) between the EU and Korea are considered to be necessary; (2) to remove the qualifier “engaged in digital trade” from Article 6(2) of the Digital Trade Agreement, to ensure an encompassing protection of individuals with regards to the processing of their personal data; (3) to clarify in Article 6 of the Digital Trade Agreement that each Party may adopt and maintain the safeguards it deems appropriate to ensure the protection of personal data and privacy; and (4) to include the protection of individuals with regard to the processing of personal data in the list of "legitimate public policy objectives" allowing authorities to require access to source code in footnote 22 of the Digital Trade Agreement. Brussels, 3 November 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 10


text: COM(2023) 231 final. COM(2023) 222 final. 1

text: OJ L 295, 21.11.2018, p. 39. 4 COM(2023) 231 final. COM(2023) 222 final. 6 COM(2023) 222 final, Explanatory Memorandum, p. 1. 7

text: Regulation (EC) No 469/2009

text: of the European Parliament and of the Council of 6 May 2009 concerning the supplementary protection certificate for medicinal products (Codified version), OJ L 152, 16.6.2009, p. 1–10. 4

text: COM(2023) 231 final. 9 COM(2023) 222 final. 10 See Article 37(4) of the national SPC Proposal and the unitary SPC Proposal. 11 Article 9(2) and 23 of the national SPC Proposal and Article 12 of the unitary SPC Proposal. 12

text: Article 9(2)

text: juncto Article 12 of the unitary SPC Proposal. 13 Under the national SPC Proposal, publication by the Office is envisaged in case of a centralised application (Articles 21-23 of the national SPC Proposal). 5

text: See also Judgment of the European Court of Justice of 9 November 2010 in Joint Cases

text: and

text: , Volker und Markus Schecke GbR (

text: ) and Hartmut Eifert (

text: ) v Land Hessen, ECLI:EU:C:2010:662, par. 53. 15 Cf. Recital 28 of the national SPC Proposal. 16 Cf. Article 14 of the unitary SPC Proposal. 17 A general statement declaring the information to be ‘of public interest’ without further qualification or explanation does not constitute a clearly defined objective of public interest justifying public accessibility. 18 See further EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: , 7 November 2019, p.8. 6

text: p.o. Leonardo CRVERA NAVAS Acting Head of EDPS Secretariat

identifier: EDPS yttrande 28/2023

title: EDPS Opinion 28/2023 on the Proposals for Regulations on supplementary protection certificates for medicinal products

text: 21 June 2023

text: Opinion 28/2023

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on the supplementary protection certificate for medicinal products (recast) and to the Proposal for a Regulation of the European Parliament and of the Council on the unitary supplementary protection certificate for medicinal products, and amending

text: Regulation (EU) 2017/1001

text: Regulation (EC) No 1901/2006

text: as well as

text: Regulation (EU) No 608/2013

text: . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 27 April 2023 the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on the supplementary protection certificate for medicinal products (recast) and the Proposal for a Regulation of the European Parliament and of the Council on the unitary supplementary protection certificate for medicinal products, and amending

text: Regulation (EU) 2017/1001

text: Regulation (EC) No 1901/2006

text: as well as

text: Regulation (EU) No 608/2013

text: . The objective of the Proposals is to simplify the EU’s Supplementary Protection Certificates (SPCs) system as regards national SPCs for medicinal products, as well as improve its transparency and efficiency, and to create a unitary certificate for medicinal products, complementing the unitary patent system.

text: The Proposals provide for (a notification of) an application for a certificate, including personal data such as the applicant’s address, to be published in a Register. As the publication of personal data constitutes an interference with the right to data protection, the Proposal should clearly articulate the specific purposes for which personal data may be made available. In addition, the EDPS recommends to consider providing for a mechanism that would allow access not to the public, but only to parties capable of demonstrating a legitimate interest linked to the Proposal’s objectives.

text: The EDPS notes the Proposals provide for unlimited retention of all entries in the Register and in an administrative database. At the same time, the Proposals provide that the party concerned may request removal of personal data from the database 18 months after expiry of the certificate or the closure of an inter partes procedure. As personal data should not be kept for longer than is necessary to achieve the purposes of the processing, the EDPS considers that personal data in the Register and database should not be kept indefinitely. The EDPS invites the legislature to consider whether an 18-month retention period could be prescribed as a rule for personal data regardless of the submission of a request, both for the Register and the database, with the possibility to extend the retention period, where necessary, to safeguard the rights of individuals (e.g., in the context of possible exercise of legal claims).

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 27 April 2023, the European Commission issued • the Proposal for a Regulation of the European Parliament and of the Council on the supplementary protection certificate for medicinal products (recast) (‘the national SPC Proposal’) and • the Proposal for a Regulation of the European Parliament and of the Council on the unitary supplementary protection certificate for medicinal products, and amending

text: Regulation (EU) 2017/1001

text: Regulation (EC) No 1901/2006

text: as well as

text: Regulation (EU) No 608/2013

text: (‘the unitary SPC Proposal’) (together ‘the Proposals’).

text: 2. The Proposals are part of a larger package of new EU rules on patents. Four Proposals deal with Supplementary Protection Certificates (SPC), two of which are the subject of this Opinion.

text: 3. An SPC is an intellectual property right sui generis that extends the 20-year term of patents for medicinal or plant protection products by up to 5 years. However, SPC protection so far is only available at national level. As a result, according to the Commission, the current system suffers from fragmentation, which leads to complex and costly procedures, as well as legal uncertainty .

text: 4. The objective of the national SPC Proposal is to simplify the EU’s SPCs system as regards national SPCs for medicinal products, as well as improve its transparency and efficiency. The Proposal is a Recast of

text: Regulation (EC) No 469/2009

text: , which provides for SPCs for plant medicinal products. The Proposal also aims to introduce a centralised procedure for granting SPCs for medicinal products. This would allow applicants to obtain SPCs in the respective designated Member States by filing a single ‘centralised SPC application’ that would undergo a single centralised examination procedure by the European Union Intellectual Property Office (‘the Office’), supported by national offices.

text: 5. The main objectives of the unitary SPC Proposal are to simplify the EU’s SPC system, as well as improve its transparency and efficiency, by creating a unitary certificate for medicinal products, and to complement the unitary patent system (‘European patent with unitary effect’). Under the Proposal, the unitary SPC can be requested by filing an application that would then be subjected to the same centralised examination procedure by the European Union Intellectual Property Office (‘the Office’) as applicable to ‘centralised SPC applications’ mentioned in the previous paragraph.

text: 6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 27 April 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the 8 9 reference to this consultation in Recitals 71 and 45 respectively of the two Proposals.

text: 2. General remarks

text: 7. The EDPS takes note of the fact that the emphasis of these Proposals is not on the processing of personal data. However, launching an application for a certificate or unitary certificate will involve the processing of certain personal data, even if the applicant is a legal and not a natural person. Against this background, this Opinion will focus on the provisions requiring publication of personal data, as well as the proposed storage duration.

text: 8. The EDPS notes that both Proposals make reference to

text: Regulation (EC) No 45/2001

text: . As this legal act has been repealed by the EUDPR, the EDPS recommends making reference to the EUDPR instead.

text: 3. Publication of personal data of applicants and representatives

text: 9. Both Proposals require (notification of) an application for a certificate to be published in a public register . The Proposals diverge, however, as to when information relating to the representatives of the applicant, if any, should be published. While the unitary SPC Proposal would require publication of the name and address of the representative by the Office in a Register , the national SPC Proposal would not require the competent industrial property office of the relevant Member State to publish such information .

text: 10. The reason for this difference in treatment of personal data concerning representatives is not immediately apparent. If the publication of such data is not necessary to achieve the purposes of the processing, it should not be provided for.

text: 11. The EDPS recognizes that the applicant does not need to be the inventor, but instead will often be a company. Even then, however, the natural persons authorised to represent the company are regularly named as well. Company names may also contain the name of the natural person who is the owner of the company .

text: 12. The Proposals mention transparency and legal certainty, especially a reduced risk of subsequent challenges of a granted SPC, as objectives of the publication . However, the EDPS recalls that transparency can only justify the processing of personal data to the extent it is necessary and proportionate. In the view of the EDPS, this does not seem to be the case in relation to the publication of the address of natural person applicants.

text: 13. The EDPS also has doubts as to whether the objective to allow for speedy intervention by interested parties would justify to publish the addresses of natural persons as applicants prior to the issuance of a certificate. The publication of applications under the Proposals prior to a decision on the applications would enable for observations by third parties to be submitted during the examination phase conducted by the European Union Intellectual Property Office, which is also maintaining the Register, allowing for the early assertion of any objections . As the Office receiving the observations is also competent to examine the applications, it is not apparent why a third party coming forward with an observation would need to obtain the full address of the applicant from the public entry in the Register.

text: 14. Against this background, the EDPS invites the co-legislators to consider whether the publication of personal data envisaged by the Proposal is necessary to achieve its objectives. As the publication of personal data constitutes an interference with the right to data protection, the Proposal should clearly articulate the specific purposes for which personal data may be made available . In addition, the EDPS recommends to consider providing for a mechanism that would allow access not to the public, but only to parties capable of demonstrating a legitimate interest linked to the Proposal’s objectives. A clear specification of the purposes and conditions under which access may be granted would constitute an important safeguard to ensure that access to and use of these personal data would be limited to the purposes for which they are made available.

text: 4. Roles and Responsibilities

text: 15. The Proposals determine the purposes and means of the processing of personal data in the Register as well as in the additional electronic database. In line with Article 3(8) of the EUDPR, the EDPS recommends to designate EUIPO as controller for the personal data processing .

text: 5. Retention period

text: 16. According to Article 35(10) of the national SPC Proposal, Article 35(8) of the unitary SPC Proposal respectively, all entries in the Register shall be kept for an indefinite period of time ‘for reasons of legal certainty’. Likewise, according to Article 36(5) of both Proposals, all data in the ‘database’ shall be kept indefinitely. However, the party concerned may request the removal of any personal data from the database after 18 months from the expiry of the certificate or, the case being, the closure of the relevant inter partes procedure.

text: 17. According to

text: Article 4(1)

text: (e) of the EUDPR, personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. Therefore, personal data is to be removed ex officio once its processing is no longer necessary. In this regard, the EDPS invites the legislature to consider whether an 18-month retention period could be prescribed as a rule for personal data regardless of the submission of a request, both for the Register and the database, with the possibility to extend the retention period, where necessary, to safeguard the rights of individuals (e.g., in the context of possible exercise of legal claims).

text: 6. Conclusions

text: 18. In light of the above, the EDPS makes the following recommendations: (1) to replace the references to

text: Regulation (EC) No 45/2001

text: with a references to

text: Regulation (EU) 2018/1725

text: ; (2) to clearly articulate the specific purposes for which personal data may be made available and consider providing for a mechanism that would allow access not to the public, but only to parties capable of demonstrating a legitimate interest linked to the Proposal’s objectives (3) to designate EUIPO as controller within the meaning of the EUDPR for processing of personal data in the Register as well as in the additional electronic database; (4) to align the provisions on the deletion of personal data from the Register and the database with

text: Article 4(1)

text: (e) of the EUDPR by providing a maximum storage duration. Brussels, 21 June 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7


text: COM(2025) 490 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2025)490 final. 4 See COM(2025)490 final, Explanatory Memorandum, p. 2 and 3. See COM(2029)490 final, Explanatory Memorandum, p. 4. 6 Council Conclusions of 7 June 2021 on the transfer of Passenger Name Record (PNR) data to third countries, in particular Australia and the United States, for the purpose of combating terrorism and serious crime, Council Document 9605/21 of 8 June 2021: “Calls on the Commission to pursue a consistent and effective approach regarding the transfer of PNR data to third countries for the purpose of combating terrorism and serious crime, building on the ICAO SARPs, and in line with the relevant requirements established under Union law”. 4

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1. 8

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89–131. 9

text: Directive (EU) 2016/681

text: of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, OJ L 119, 4.5.2016, p. 132–149. 10 See COM(2025)490 final, p. 3. 11 Opinion 1/15 of the Court of Justice (Grand Chamber) of 26 July 2017, EU:C:2017:592. 5

text: See https://www.icao.int/safety/airnavigation/nationalitymarks/annexes_booklet_en.pd 13 Annex 9, Chapter 9, Section D to the International Convention on Civil Aviation. 14 Commission Implementing Decision

text: (EU) 2022/254

text: of 17 December 2021 pursuant to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council on the adequate protection of personal data by the Republic of Korea under the Personal Information Protection Act (OJ L 44, 24.2.2022, p. 1–90). 15 See more at https://commission.europa.eu/news-and-media/news/joint-press-statement-commissioner-michael-mcgrath-andchairperson-haksoo-ko-entry-force-korean-2025-09-16_en 16 Opinion 1/15 of the Court of Justice (Grand Chamber) of 26 July 2017, EU:C:2017:592; paragraph 224 and 225. 6

text: This is of particular importance in the context of automated processing of PNR data, see Opinion 1/15 of the Court of Justice (Grand Chamber) of 26 July 2017, EU:C:2017:592; paragraph 174. 7

identifier: EDPS yttrande 28/2025

title: EDPS Opinion 28/2025 on the Proposal on the negotiating mandate for an Agreement between the EU and the Republic of Korea on the transfer of Passenger Name Record data

text: Opinion 28/2025

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Republic of Korea on the transfer of Passenger Name Record data from the European Union to the Republic of Korea for the prevention, detection, investigation and prosecution of terrorist offences and serious crime .

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 15 September 2025, the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Republic of Korea on the transfer of Passenger Name Record (PNR) data from the European Union to the Republic of Korea for the prevention, detection, investigation and prosecution of terrorist offences and serious crime.

text: The aim of the future Agreement is to allow the transfer of PNR data from the European Union to the Republic of Korea and to allow its designated competent authorities to receive and process PNR data from the European Union, subject to appropriate data protection safeguards. In addition, such an agreement would be a means to foster law enforcement cooperation through enhancing the possibilities to exchange PNR data as well as analytical information resulting from the processing of PNR, between the Republic of Korea and EU Member States competent authorities, for the purpose of preventing, detecting, investigating and prosecuting terrorist offences and serious crime.

text: In this Opinion, the EDPS stresses the need for the future PNR Agreement between the EU and the Republic of Korea to adduce all the necessary and appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU.

text: In addition to this general comment, the EDPS makes two specific recommendations. Firstly, it recommends to further detail in the future PNR Agreement between the EU and the Republic of Korea the right to information, including also the right to individual notification in case of disclosure of PNR data, provided that it does not jeopardise ongoing investigations.

text: Secondly, the EDPS suggests considering the possibility to include in the future PNR Agreement between the EU and the Republic of Korea the possibility to amend the Agreement, where deemed necessary, through a joint consultation or review mechanism or another appropriate arrangement.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 15 September 2025, the European Commission (‘the Commission’) issued a Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Republic of Korea on the transfer of Passenger Name Record (‘PNR’) data from the European Union to the Republic of Korea for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (‘the Recommendation’).

text: 2. The aim of the Recommendation is to allow the transfer of PNR data from the European Union to the Republic of Korea and to allow its designated competent authority to receive and process PNR data from the European Union, subject to appropriate data protection safeguards.

text: 3. In addition, such an agreement would be a means to foster law enforcement cooperation through enhancing the possibilities to exchange PNR data as well as analytical information resulting from the processing of PNR, between the Republic of Korea and EU Member States competent authorities, for the purpose of preventing, detecting, investigating and prosecuting terrorist offences and serious crime .

text: 4. The Recommendation is part of a broader effort of the Commission to pursue a consistent and effective approach regarding the transfer of PNR data to third countries, in line with the Union legal framework and case-law on PNR . Such an approach was also requested by the Council in its Conclusions of June 2021 .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 6 of the Recommendation.

text: 2. General remarks

text: 6. PNR data is information provided by passengers and collected by and held in the air carriers’ reservation and departure control systems for their own commercial purposes. While useful for combating terrorism and serious crime, the transfer of PNR data to third countries and the subsequent processing by their authorities constitutes an interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter of Fundamental Rights (‘the Charter’). For this reason, it requires a legal basis under EU law and must be necessary, proportionate and subject to strict limitations and effective safeguards.

text: 7. In addition to the Charter, the applicable legal rules in case of transfer and processing of PNR within the EU data include also the horizontal EU legal framework on data protection, namely

text: Regulation (EU) 2016/679

text: (the GDPR) and

text: Directive (EU) 2016/680

text: (the Law Enforcement Directive) , as well as the specific

text: Directive (EU) 2016/681

text: (the EU PNR Directive) .

text: 8. Furthermore, as highlighted in the Recommendation , the Court of Justice of the EU (CJEU) on two occasions interpreted the legal framework on PNR and provided guidance as regards proportionality and the necessity of PNR data processing, namely in Opinion 1/15 of 26 July 2017 and, for what concerns the EU PNR Directive, Judgment in Case C- 817/2019 of 21 June 2022.The requirements laid down by the CJEU in the cited case law constitute an important point of reference for the assessment of this Recommendation and any future EU agreement on the transfer of PNR data.

text: 9. The EDPS also recalls that, in addition, PNR data is subject to international rules and standards. The United Nations Security Council Resolution 2396 (2017) on threats to international peace and security caused by returning foreign terrorist fighters, adopted on 21 December 2017, and the subsequent UN Security Council Resolution 2482 (2019) of 19 July 2019, called on UN Member States to develop the capability to collect and use PNR data, based on Standards and Recommended Practices on PNR (SARPs) of the International Civil Aviation Organization (ICAO) in 2020, by means of Amendment 28 to Annex 9 to the Convention on International Civil Aviation (Chicago Convention) , which became applicable in February 2021 .

text: 10. Another important aspect that deserves attention is the adequacy decision in relation to the transfer of personal data from the EU to the Republic of Korea, adopted by the Commission on 17 December 2021 , which concluded that the Republic of Korea ensures an essentially equivalent level of protection to the one guaranteed under the GDPR. The decision became effective on 16 September 2025 and cover both private and public sectors .

text: 11. At the same time, the EDPS recalls that the transfer of PNR data envisaged in the future Agreement does not fall under the scope of this adequacy decision. Consequently, the future PNR Agreement between the EU and the Republic of Korea should adduce all the appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU.

text: 12. In addition to these general comments, the EDPS has two specific recommendations concerning the negotiating mandate, notably as regards the right to information and the review mechanism.

text: 3. Right to information

text: 13. The EDPS welcomes the reference to ’enforceable data subjects' rights, including the right to information, access, rectification and erasure, in the negotiating directive 16. He also positively notes that the future Agreement would circumscribe the specific grounds that may allow for any necessary and proportionate restrictions to those rights.

text: 14. In this regard, the EDPS recalls the specific importance given by the CJEU in its case-law to the right to information and the transparency requirements in relation to the transfer and further processing of PNR data. According to the Court, the right to information also includes notifying air passengers individually in cases where their PNR data is disclosed to other government authorities or to individuals, provided that such notification is ‘no longer liable to jeopardise the investigations being carried out by the [competent] government authorities’ . Accordingly, the EDPS invites the Commission to ensure that the content of the right to information is defined in sufficient details in the future Agreement.

text: 4. Review mechanism

text: 15. The EDPS notes that the negotiating directive 19 provides that the future Agreement should include provisions on monitoring and periodic evaluation but does not expressly foresee a mechanism for consultation and (joint) review. It further notes that such a mechanism usually set out in international agreements - enables the possibility to make amendments to the envisaged Agreement, when deemed necessary following the evaluation of its practical application.

text: 16. In this regard, the EDPS recalls that, pursuant to the CJEU, one of the important objectives of the joint reviews of PNR agreements is to assess the reliability and topicality of preestablished models and criteria and the databases used to process and cross-check PNR data . The EDPS therefore invites the Commission to consider including in the future PNR Agreement between the EU and the Republic of Korea, e.g. through a joint consultation or review mechanism, or another appropriate arrangement, the possibility to amend the Agreement, where deemed necessary.

text: 5. Conclusions

text: 17. In light of the above, the EDPS makes the following recommendations: (1) to adduce in the future PNR Agreement between the EU and the Republic of Korea the necessary safeguards for the protection of the fundamental rights to privacy and data protection in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU; (2) further detail in the future PNR Agreement between the EU and the Republic of Korea the right to information, including the right of individual notification in case of disclosure of PNR data, provided that it would not jeopardise ongoing investigations; (3) to consider including in the future PNR Agreement between the EU and the Republic of Korea, the possibility to amend the Agreement, where deemed necessary, through a joint consultation or review mechanism, or another appropriate arrangement. Brussels, 6 November 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI