text: OJ L 295, 21.11.2018, p. 39. 2 COM(2022) 701 final. 3 COM(2022) 703 final. 4 COM(2022) 704 final. COM(2022) 701 final, p 1. 6 COM(2022) 701 final, p. 2. 4

text: COM(2022) 703 final, p. 3. 8 OJ L 119, 4.5.2016, p. 1. 9

text: Article 5(1)

text: (b) GDPR and

text: Article 4(1)

text: (b) EUDPR. 10

text: Article 5(1)

text: (c) GDPR and

text: Article 4(1)

text: (c) EUDPR. 11

text: Article 5(1)

text: (f) GDPR and

text: Article 4(1)

text: (f) EUDPR. 5

text: Recital (4) of the Proposal for a Council Directive. 13 See in particular at page 4 of COM(2022) 703 final: “These shortcomings were rightly highlighted by almost two thirds of informed stakeholders responding to the public consultation who totally or partly agreed that recapitulative statements would be more effective in fighting intra-EU fraud if data were collected on a transaction-by-transaction basis and closer to the moment of the transaction.” See also at page 29 of the Commission Staff Working Document Impact Assessment Report accompanying the VAT Digital Package, Brussels, 8.12.2022, SWD(2022) 393 final. 14 COM (2022) 701 final, p. 20. 15 See

text: Article 264

text: and COM (2022) 701 final, p. 20. 6

text: Article 265

text: as it would be amended by the Proposal for a Council Directive. 17 COM (2022) 703 final, p 1 and see also

text: Article 24

text: g as it would be amended by the Proposal for a Council Regulation. 18

text: Council Regulation (EU) No 904/2010 of 7 October 2010

text: on administrative cooperation and combating fraud in the field of value added tax (recast), OJ L 268, 12.10.2010, p. 1–18. 19 See Section 3 of the Proposal for a Council regulation (Central electronic system for the exchange of VAT information). 20 New

text: Article 24

text: g(1) in the Proposal for a Council Regulation. 7

text: New

text: Article 24

text: g(2) in the Proposal for a Council Regulation. 22 COM(2022) 703 final, p. 6. See also new

text: Article 24

text: g in the Proposal for a Council Regulation. 23 See recital 11 and new

text: Article 24

text: j in the Proposal for a Council Regulation. 24 See in particular

text: Article 24

text: h(2) in the Proposal for a Council Regulation. 25 See under

text: Article 24

text: i and also recital 5, 6 and 7 in the Proposal for a Council Regulation. 26 EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: , adopted on 7 November 2019, p. 8, available at https://edps.europa.eu/sites/edp/files/publication/19-11- 07_edps_guidelines_on_controller_processor_and_jc_reg_2018_1725_en.pdf. 27 EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: , p. 8, footnote 6. 8

text: Regulation (EU) 2018/1725

text: , p.16 mention that the essence of the role of a ‘processor’ is that personal data is processed on behalf of the data controller(s). In practice, the processor has an implementing role and it is up to the controller(s) to determine the purpose (within the limits of the tasks assigned by legislation) and the essential elements of the means. In other words, the processor is following the instructions set out by the controller(s), at least with regards to the purpose and the essential elements of the means. 9

identifier: EDPS yttrande 07/2023

title: EDPS Opinion on the package of legislative Proposals on VAT in the Digital Age

text: 3 March 2023

text: Opinion 7/2023

text: on the package of legislative proposals on VAT in the Digital Age

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall, ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal

text: data’

text: This Opinion relates to the VAT in the Digital Age package that consists of three legislative proposals: a Proposal for a Council Directive amending Directive

text: as regards VAT rules for the digital age; a Proposal for a Council Regulation amending

text: Regulation (EU) No 904/2010

text: as regards the VAT administrative cooperation arrangements needed for the digital age; and a Proposal for a Council Implementing Regulation amending Implementing

text: Regulation (EU) No 282/2011

text: as regards information requirements for certain VAT schemes. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 8 December 2022, the European Commission issued the package of legislative proposals on VAT in the Digital Age that consists of: a Proposal for a Council Directive amending Directive

text: Regulation (EU) No 904/2010

text: Regulation (EU) No 282/2011

text: as regards information requirements for certain VAT schemes.

text: The EDPS welcomes the objectives pursued by the VAT in the Digital Age package, notably the modernisation of VAT reporting obligations, the adaptation of VAT rules applicable to platform economy and the introduction of Single VAT Registration. Having regard to the new rules on digital reporting envisaged by the Proposal for a Council Directive, the EDPS recalls that any processing of personal data must fully comply with the GDPR and the EUDPR, including the principles of purpose limitation and data minimisation. To ensure compliance with the principle of purpose limitation, the EDPS recommends explicitly specifying in the enacting terms of the Proposal that the information collected may only be processed for the purpose of fighting VAT fraud by the competent tax administration.

text: Information contained in invoices may reveal sensitive information concerning specific natural persons, such as information concerning purchased goods (including intimate products), travel arrangements or legal services. The EDPS welcomes that the information to be provided to the tax administration under the digital reporting requirements are an extract (a specified subset) of the information from the invoice and not the whole invoice as such. This is a key safeguard to ensure compliance with the principle of data minimisation under

text: Article 5(1)

text: (c) of the GDPR and

text: Article 4(1)

text: (c) of the EUDPR and to reduce the impact of the processing of personal data on the rights and freedoms of the data subjects. In this regard, the EDPS welcomes that the Proposal for a Council Directive excludes the name and address of the customer and the taxable person from the information to be transmitted.

text: The EDPS also welcomes that the Proposal for a Council Regulation explicitly designates the roles of the Member States and Commission under EU data protection law. At the same time, the EDPS recalls that the designation must be aligned with the responsibilities assigned to each actor. Moreover, any further specification of the responsibilities of the Member States and the Commission by way of implementing acts must be fully in line with the roles established by the legislative act.

text: Finally, the EDPS highlights that the safeguards laid down under Chapter XV of

text: Regulation (EU) No 904/2010

text: (Conditions governing the exchange of information) should remain applicable to the processing of personal data laid down in the Proposal for a Council Regulation.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 8 December 2022, the European Commission (‘Commission’) issued a Proposal for a Council Directive amending Directive

text: as regards VAT rules for the digital age (‘the Proposal for a Council Directive’) ; a Proposal for a Council Regulation amending

text: Regulation (EU) No 904/2010

text: as regards the VAT administrative cooperation arrangements needed for the digital age (‘the Proposal for a Council Regulation’) ; a Proposal for a Council Implementing Regulation amending Implementing

text: Regulation (EU) No 282/2011

text: as regards information requirements for certain VAT schemes (‘the Proposal for a Council Implementing Regulation’) . In the context of this Opinion, we refer to the three legislative proposals as the ‘VAT in the Digital Age package’.

text: 2. The VAT in the Digital Age package is part of the Commission’s 2020 Action Plan for fair 5 6 and simple taxation supporting the recovery . It has three main objectives : 1) modernising VAT reporting obligations, by introducing Digital Reporting Requirements, which will standardise the information that needs to be submitted by taxable persons on each transaction to the tax authorities in an electronic format and, at the same time, it will impose the use of e-invoicing for cross-border transactions; 2) updating the VAT rules applicable to the platform economy, in particular by enhancing the role of the platforms in the collection of VAT; 3) avoiding the need for multiple VAT registrations in the EU and improving the functioning of the tool implemented to declare and pay the VAT due on distance sales of goods, by introducing Single VAT Registration (SVR), improving and expanding the existing systems of One-Stop Shop (OSS)/Import One-Stop Shop (IOSS) and reverse charge in order to minimise the instances for which a taxable person is required to register in another Member State.

text: 3. In addition, the Proposal for a Council Regulation introduces a set of amendments to

text: Regulation (EU) 904/2010

text: , establishing among others a new central system at EU level for the exchange of VAT information between Member States’ tax administrations that is adapted to the specificities of Digital Reporting Requirements (‘central VIES system’) .

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 10 January 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in recital 25 of the Proposal for a Council Regulation. A reference to this consultation is however absent in the recitals of the Proposal for a Council Directive and in the recitals of the Proposal for a Council Implementing Regulation. The EDPS therefore recommends inserting a reference to this consultation in both Proposals.

text: 2. General comments

text: 5. The EDPS welcomes the objectives pursued by the VAT in the Digital Age package, notably the modernisation of VAT reporting obligations, the adaptation of VAT rules applicable to platform economy and the introduction of Single VAT Registration.

text: 6. Having regard to the new rules on digital reporting envisaged by the Proposal for a Council Directive, the EDPS recalls that any processing of personal data must fully comply with the 8 9 GDPR and the EUDPR, and notably with the principle of purpose limitation and data 10 11 minimisation . Integrity and confidentiality are also of key importance, especially with regard to the setting up of the central VIES system at EU level.

text: 7. The Proposal for a Council Regulation specifies, in recital 24, that the latter respects the fundamental rights and observes the principles recognised by the Charter of Fundamental Rights of the European Union. In particular, the Proposal ‘seeks to’ ensure full respect for the right of protection of personal data laid down in Article 8 of the Charter. The EDPS recommends deleting the words ‘seeks to’ in order to indicate clearly that this Regulation ‘ensures’ full respect for the right of protection of personal data laid down in Article 8 of the Charter and to explicitly recall the applicability of GDPR and the EUDPR to the processing of personal data in the context of the proposal.

text: 8. The EDPS notes that the Proposal for a Council Directive, while containing rules on digital reporting that have an impact on the processing of personal data, does not contain a similar recital. The EDPS therefore recommends inserting a recital in the Proposal for a Council Directive recalling that the proposal ensures full respect for the fundamental rights to privacy and to the protection of personal data, as well as the applicability of GDPR and the EUDPR to the processing of personal data in the context of the proposal.

text: 9. Finally, the EDPS recalls that the setting up a centralised information system is likely entail higher risks for data subjects as compared to a decentralised and interconnected information system. The EDPS also points to the large volume of the intra-Community transaction information that would be processed in the central VIES and to the risks stemming from possible cyberattacks and data breaches. It is therefore essential that the central VIES should guarantee an appropriate level of security and the exchange of information between national tax authorities and the central VIES should only take place through a secure common communication network.

text: 3. Specific comments

text: 3.1. Digital reporting requirements

text: 10. The EDPS notes that the Proposal for a Council Directive would replace the obligation to provide recapitulative statements with a digital reporting system for intra-Community transactions. The Digital reporting requirements would provide information to the tax authorities on a transaction-by-transaction basis in order to allow cross-matching of data and increase the control capabilities of tax administrations . Such processing would be functional to the early discovery of the Missing Trader Intra-Community Fraud .

text: Article 264

text: , as it would be amended by the Proposal for a Council Directive, provides for an exhaustive list of information to be transmitted by the taxable person to the tax administration. To a large extent, this information is the same as the information that had to be submitted in the recapitulative statements, but detailed for each transaction instead of aggregated by customer . In addition, there are new fields that have been added to improve the detection of fraud. These new fields are the reference to the previous invoice in case of rectification of invoices, the identification of the bank account into which the payment for the invoice will be credited and the dates agreed for the payment of the amount of the transaction. With a view to a full standardization and interoperability, implementing rules shall be adopted by the Commission to define a common electronic message to this purpose .

text: 12. In case of intra-Community acquisitions of goods, the taxable person identified for VAT purposes in the Member State which issued the VAT identification number under which that person made such acquisitions shall set out the following information in the data to be transmitted: (a) that person’s VAT identification number in that Member State and under which the acquisition and subsequent supply of goods were made; (b) the VAT identification number, in the Member State in which dispatch or transport of the goods ended, of the person to whom the subsequent supply was made by the taxable person; (c) the value, exclusive of VAT, of each supply made by the taxable person in the Member State in which dispatch or transport of the goods ended .

text: 13. The EDPS considers that the processing of information to be provided by the taxable person to tax administration under the digital reporting requirements may be necessary for the purpose of fighting VAT fraud. To ensure compliance with the principle of purpose limitation, the EDPS recommends explicitly specifying in the enacting terms of the Proposal that the information collected may only be processed for the purpose of fighting VAT fraud by the competent tax administration.

text: 14. The EDPS points out that information contained in invoices may reveal sensitive information concerning specific natural persons, such as information concerning purchased goods (including intimate products), travel arrangements or legal services. Moreover, largescale collection of data on the quantity and nature of goods supplied or services rendered to specific individuals on a transaction-by transaction basis would provide the means of establishing a detailed profile of the individuals concerned.

text: 15. The EDPS welcomes that the information to be provided to the tax administration under the digital reporting requirements are an extract (a specified subset) of the information from the invoice and not the whole invoice as such. This is a key safeguard to ensure compliance with the principle of data minimisation under

text: Article 5(1)

text: (c) of the GDPR and

text: Article 4(1)

text: (c) of the EUDPR, as well as to reduce the impact of the processing of personal data on the rights and freedoms of the data subjects. In this regard, the EDPS welcomes that the proposed amendment to Article 264 of the Council Directive excludes the full name and address of the customer and the taxable person from the information to be transmitted.

text: 16. The EDPS also welcomes the specification in recital 15 of the Proposal for a Council Directive, that to achieve the necessary harmonisation in the reporting of data on intra- Community transactions, the information to be reported should be the same in all Member States, without the possibility for Member States to request additional data.

text: 3.2. Central electronic system for the exchange of VAT information

text: 17. The previous section of this Opinion described how the reporting obligations of intra- Community supplies in the form of periodical recapitulative statements for VAT purposes would be replaced by digital reporting requirements. Currently, the recapitulative statements are stored in national VAT databases. These databases are then connected through an electronic interface called VIES (VAT Information Exchange System). In this regard, the Commission manages the communication between the Member States via VIES, while national VIES applications are developed by the Member States .

text: 18. The Proposal for a Council Regulation would amend

text: Regulation (EU) No 904/2010

text: on VAT administrative cooperation , setting up a central electronic system for VAT information (‘the central VIES’) . The central VIES would be developed, maintained, hosted and technically managed by the Commission . Each Member State would develop, maintain, host and technically manage a national electronic system to automatically transmit different categories of information to the central VIES . The most essential part of information exchanged through central VIES would be the information collected through the Digital Reporting Requirements. The other information relates to the identification of the taxable persons. Finally, it is explicitly mentioned that Member States may store the information they have to automatically transmit to the central VIES in the national electronic system which they use for transmitting the information for the purposes of reuse in national controls .

text: 19. The Proposal for a Council Regulation lays down in

text: Article 24

text: j the functions of the central VIES. The central VIES would be able to aggregate per taxable person information on crossborder (intra-Community) business-to-business (B2B) transactions transmitted by the Member States. It would also allow the information transmitted by the Member States to be processed with other VAT information exchanged under

text: Regulation (EU) No 904/2010

text: , such as customs data .

text: Article 24

text: k specifies the access rights to the central VIES by Member State competent authorities. The central VIES would only be accessible to authorised officials appointed by their Member States, including Eurofisc liaison officials, and for the exclusive purpose of the control of compliance with VAT legislation.

text: 21. The EDPS notes that the Proposal for a Council Regulation lays down the role and responsibilities of the Member States having regard to the information transmitted to the central VIES , and specifically having regard to the validity/invalidity of the VAT identification number .

text: 22. Furthermore,

text: Article 24

text: m lays down that the Commission will specify by means of an implementing act the tasks to be carried out by the Commission for the technical management of the central VIES, as well as the roles and responsibilities of Member States as controllers and the Commission as processor under the GDPR and the EUDPR.

text: 23. The EDPS takes note of the proposed qualification of Member States as controllers under the GDPR and the Commission as processor under the EUDPR. A clear designation of roles is in line with the EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: which recommends identifying the controller of specific processing operation(s) already in the basic legislative act, in order to avoid any possible problem of interpretation in assessing that role .

text: 24. As equally mentioned in the EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: , such determination must be aligned with the actual responsibilities assigned to the various actors by the legislative act. In the case at hand, the Proposal for a Council Regulation amending Regulation (EU) No 904/201 does not yet define in detail the actual responsibilities of Member States as controllers and the Commission as processor under the GDPR and the EUDPR. Regarding the Commission’s role,

text: Article 24

text: g(2) only provides that “[t]he Commission shall develop, maintain, host and technically manage an electronic, central VAT information exchange system (“central VIES”) for the purposes referred to in

text: Article 1

text: 25. In line with the wording of proposed

text: Article 24

text: m, letter (b), the Commission shall specify the responsibilities of Member States as controllers and the Commission as processor under the GDPR and the EUDPR by means of implementing acts. The EDPS recalls that the designation of the Member States as controllers needs to be taken into account when specifying the respective responsibilities of the Member States and the Commission in the context of those implementing acts. In particular, if the Commission is to act (only) as processor, operating under the (exclusive) control of the Member States, this should be duly reflected in those implementing acts, having due regard to the requirements of

text: Article 28

text: GDPR and

text: Article 29

text: EUDPR .

text: 26. The EDPS highlights that the safeguards laid down under Chapter XVof

text: Regulation (EU) No 904/2010

text: (Conditions governing the exchange of information) should remain applicable to the processing of personal data laid down in the Proposal for a Council Regulation, including the safeguards provided in

text: Article 55 of Regulation (EU) No 904/2010

text: 27. The EDPS expects to be consulted by the Commission on the implementing acts that would further detail the format of the information and the responsibilities, conditions and safeguards for the processing of personal data pursuant to the Proposal for a Council Regulation (‘the basic act’). The EDPS also recommends, in this respect, that these implementing acts should enter into force and be applicable at the same time of entry into force and applicability of the basic act.

text: 4. Conclusions

text: 28. In light of the above, the EDPS makes the following recommendations: = • with regard to the Proposal for a Council Directive: (1) to add a recital recalling that the proposal ensures full respect for the fundamental rights to privacy and to the protection of personal data, as well as the applicability of GDPR and the EUDPR to the processing of personal data in the context of the proposal; (2) to explicitly specify in the enacting terms of the Proposal that the information collected may only be processed for the purpose of fighting VAT fraud by the competent tax administration; • with regard to the Proposal for a Council Regulation: (3) to delete in recital 24 the words “seeks to” in order to indicate clearly that this Regulation ‘ensures’ full respect for the right of protection of personal data laid down in Article 8 of the Charter and to explicitly recall the applicability of GDPR and the EUDPR to the processing of personal data in the context of the proposal. Brussels, 3 March 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 10


text: COM(2023) 905 final.

text: OJ L 295, 21.11.2018, p. 39. 3

text: Directive (EU) 2015/2302

text: of the European Parliament and of the Council of 25 November 2015 on package travel and linked travel arrangements, amending

text: Regulation (EC) No 2006/2004

text: and Directive

text: of the European Parliament and of the Council and repealing

text: Council Directive 90/314/EEC

text: , OJ L 326, 11.12.2015, p. 1-33. 4 COM(2023) 905 final, p. 7. COM(2023) 905 final, p. 13-15.

text: Article 1 of the Proposal, amending Article 3 of the PTD, definition (2). 7 Article 1 of the Proposal, amending Article 3 of the PTD, definition (5). 8 COM (2023) 905 final, recital 8, referring to the traveller’s name, payment details, email address or any other of the traveller’s personal data. 9 Judgment of 9 November 2010, Volker und Markus Schecke and Eifert (

text: and

text: , ECR 2010 p. I-11063) ECLI:EU:C:2010:662, paragraphs 52 and 53. 10 10 COM(2023) 905 final, p. 16.

identifier: EDPS yttrande 07/2024

amnesord:
Transport
EU Passengers Name Record

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 7/2024 on the Proposal for a Directive amending Directive (EU) 2015/2302 to make the protection of travellers more effective and to simplify and clarify certain aspects of the Directive

serie: yttranden

text: 24 January 2024

type: rubrik

text: Opinion 7/2024

text: Directive (EU) 2015/2302

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’. This Opinion relates to the Proposal for a Directive of the European Parliament and of the Council amending

text: Directive (EU) 2015/2302

text: to make the protection of travellers more effective and to simplify and clarify certain aspects of the Directive . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: Directive (EU) 2015/2302

text: to make the protection of travellers more effective and to simplify and clarify certain aspects of the Directive (‘the Proposal’).

text: The aim of the Proposal is to enhance the level of protection of consumers having regard to package travel services and to linked travel arrangements. The Proposal would provide in particular: specifications on traveller’s right to terminate the travel contract due to unavoidable and extraordinary circumstances; on payments; on the content of the package travel contract; on warning concerning the travel destination; on refund of the traveller; on vouchers; and on insolvency protection to the benefit of consumers.

text: The EDPS notes that the Proposal would update the information to be provided to travellers concerning their (consumer) rights. The EDPS recalls that the duty to provide such information is without prejudice to the obligation of the controller to provide information to the data subject pursuant to the GDPR. The EDPS therefore recommends inserting, in the forms included in the Annexes, a reference to the data protection notice to be provided to travellers.

text: Contents

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 29 November 2023, the European Commission issued a Proposal for a Directive of the European Parliament and of the Council amending

text: Directive (EU) 2015/2302

text: to make the protection of travellers more effective and to simplify and clarify certain aspects of the Directive(‘the Proposal’). The Proposal is accompanied by two annexes related to standard information forms for package travel contracts (Annex I, Part A, B, C) and to standard information form in case of trader facilitating a linked travel arrangement (Annex II, Part A and B).

text: 2. The Proposal takes into account the stakeholder consultations, which highlighted the need to improve the protection of travellers’ advance payments and their right to a swift refund of payments already made in the event of cancellations, including in times of a major crisis; to strengthen the protection of travellers against the organiser's insolvency, including in the event of a major crisis; and to increase legal certainty and enforceability of

text: Directive (EU) 2015/2302

text: (‘Package Travel Directive’, hence ‘PTD’) by clarifying and/or simplifying certain provisions of the PTD that might be interpreted differently or which stakeholders find difficult to apply in practice . 3. The Proposal aims at strengthening consumer protection in relation to package travel services in particular by clarifying the definition of ‘package’ and of ‘linked travel arrangement’. The Proposal also contains specifications on traveller’s right to terminate the travel contract due to unavoidable and extraordinary circumstances; on payments; on the content of the package travel contract; on warning concerning the travel destination; on refund of the traveller; on vouchers; on insolvency protection; on rights of redress and refunds from service providers to organisers . 4

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 16 November 2023, pursuant to Article 42(1) of EUDPR. In this regard, the EDPS recommends adding in a separate recital, as per standard practice, that ‘the European Data Protection Supervisor was consulted in accordance with

text: Article 42 of Regulation (EU) 2018/1725

text: of the European Parliament and of the Council and delivered an opinion on ... [EDPS Opinion date]’.

text: 2. General remarks

text: 5. The EDPS recognises the importance of enhancing consumer’s rights having regard to 6 7 package travel services and linked travel arrangements .

text: 6. The EDPS observes that the Proposal entails the processing of personal data, notably of the traveller’s contact details (in particular her or his name, payment details and email address) . The EDPS further recalls that also the official title of a legal person (the trader) can constitute personal data, in particular when it identifies one or more natural persons .

text: 3. Standard information forms

text: 7. The EDPS notes that the Proposal would replace Annex I to the PTD in order to provide travellers with clearer information on their rights. Annex II to the PTD would be replaced to take into account the new definition of linked travel arrangement .

text: 8. The EDPS recalls that the specifications of the information to be provided to travellers concerning their (consumer) rights are without prejudice to the obligation of the controller to provide information to the data subject pursuant to the GDPR. The EDPS therefore recommends inserting in the forms a reference to the data protection notice to be provided to travellers in accordance with the GDPR. 5

text: 4. Conclusions

text: 9. In light of the above, the EDPS makes the following recommendations: (1) to insert a recital specifying that ‘the European Data Protection Supervisor was consulted in accordance with

text: Article 42 of Regulation (EU) 2018/1725

text: of the European Parliament and of the Council and delivered an opinion on ... [EDPS Opinion date]’; (2) to insert in the forms provided under Annex I and II of the Proposal a reference to the data protection notice to be provided to travellers in accordance with the GDPR. Brussels, 24 January 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 6

type: vagledning

utgivare: edps


text: OJ L 295, 21.11.2018, p. 39. 2 COM(2025) 73 final. 3 COM(2025) 76 final. 4 Article 1 of the Signing Proposal. Article 2 of the Signing Proposal. 6 Article 1 of the Conclusion Proposal. 7 Recital 5 of the Signing Proposal and Recital 2 of the Conclusion Proposal 8 Explanatory memorandum of each Proposal, page 1. 4

text: Appendix 6. 10 Council Decision of 12 February 2008 concerning the conclusion of the Agreement in the form of an Exchange of Letters on the provisional application of the protocol setting out the fishing opportunities and financial contribution provided for in the Fisheries Partnership Agreement between the European Community and the Republic of Côte d’Ivoire on fishing in Côte d’Ivoire’s fishing zones for the period from 1 July 2007 to 30 June 2013 OJ L 48, 22.2.2008, p. 37–63 5

text: European Data Protection Board (EDPB) Guidelines 2/2020 on

text: articles 46 (2)

text: (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, issued on 15 December 2020. The same guidance also clarifies the safeguards required to be put in place by provisions to be inserted into administrative arrangements between public bodies, subject to authorisation from the competent supervisory authority. 12 Chapter VIII ‘Infringements’ 6

identifier: EDPS yttrande 07/2025

title: Opinion 7/2025 on the signing, provisional application and conclusion of the Protocol (2025-2029) on the implementation of the Fisheries Partnership Agreement between the Republic of Côte d’Ivoire and the European Community

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to (i) the Proposal for a Council Decision on the signing, on behalf of the Union, and provisional application of the Protocol (2025-2029) on the implementation of the Fisheries Partnership Agreement between the Republic of Côte d’Ivoire and the European Community and (ii) the Proposal for a Council Decision on the conclusion, on behalf of the Union, of the Protocol (2025- 2029) on the implementation of the Fisheries Partnership Agreement between the Republic of Côte d’Ivoire and the European Community. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposals that are relevant from a data protection perspective.

text: Executive Summary

text: The EDPS is consulted on the Commission proposals to sign, provisionally apply and conclude the new Protocol on the implementation of the Fisheries Partnership Agreement between the Republic of Côte d’Ivoire and the European Community.

text: The EDPS welcomes the inclusion of an Article dedicated to data protection, which is supplemented by an appendix to the Annex to the Protocol, expanding the data protection provisions and detailing the conditions and safeguards relating to the processing of personal data.

text: For the purpose of transferring data, the EDPS invites nevertheless the Commission to specify what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies.

text: The EDPS also recommends adding a provision that would refer to the specific safeguards to be provided in case of processing of personal data relating to criminal convictions and offences.

text: Having regard to

text: Regulation (EU) 2018/1725

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 5 March 2025, the European Commission issued:  a Proposal for a Council Decision on the signing, on behalf of the Union, and provisional application of the Protocol (2025-2029) on the implementation of the Fisheries Partnership Agreement between the Republic of Côte d’Ivoire and the European Community (‘the Signing Proposal’) ; and  a Proposal for a Council Decision on the conclusion, on behalf of the Union, of the Protocol (2025-2029) on the implementation of the Fisheries Partnership Agreement between the Republic of Côte d’Ivoire and the European Community (‘the Conclusion Proposal’) .

text: 2. The objective of the Signing Proposal is (i) to authorize the signing, on behalf of the Union, of the new Protocol on the implementation of the Fisheries Partnership Agreement between the Republic of Côte d’Ivoire and the European Community (‘the Protocol’) and (ii) to provide for the provisional application of the Protocol .

text: 3. The objective of the Conclusion Proposal is to approve the Protocol .

text: 4. The purposes of the new Protocol are to allow European Union vessels to fish in Côte d’Ivoire’s fishing zone and to enable the Union and the Republic of Côte d’Ivoire to work together more closely to develop a sustainable fisheries policy, so as to promote the responsible exploitation of fishery resources in Côte d’Ivoire’s fishing zone and in the Atlantic Ocean. This cooperation also aims to help achieve decent working conditions in the fisheries sector . These fishing opportunities are granted to Union vessels in accordance with scientific advice and the resolutions and recommendations of the International Commission for the Conservation of Atlantic Tunas (ICCAT), within the limits of the available surplus .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 5 March 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 8 of the Signing Proposal and in Recital 6 of the Conclusion Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 6. The EDPS welcomes the inclusion in the Protocol of a specific article on data protection:

text: Article 15

text: provides that the data exchanged under the Agreement shall be processed by the competent authorities solely for the purpose of implementing the Agreement, and in particular for management purposes and for fisheries monitoring, control and surveillance. It also specifies that personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject.

text: 7. Moreover,

text: Article 15

text: is supplemented by an appendix to the Annex to the Protocol, which develops the provisions on the processing of personal data. The EDPS notes with satisfaction that these provisions lay down the definitions of ‘personal data’ and ‘processing’, the categories of personal data to be processed, the designation of authorities responsible for the processing of data, the principles relating to processing of personal data including the retention periods, the modalities of onward transfers, the rights of the persons concerned, the right to redress and the designation of independent supervisory authorities.

text: 3. International transfers of personal data

text: 8. The EDPS recalls that in absence of an adequacy decision, transfers of personal data to a third country may be based on a legally binding and enforceable instrument between public authorities or bodies. In such a case, such instrument should provide appropriate safeguards and ensure that enforceable data subject rights and effective legal remedies for data subjects are available.

text: 9. The EDPS notes that Article 15(4) of the Protocol foresees that further safeguards and legal remedies in relation to personal data and data subjects’ rights may be established by the Joint Committee provided for in Article 9 of the Agreement between the European Community and the Republic of Côte d’Ivoire. In this respect, the EDPS recommends the Joint Committee to specify in par. 2(g) of Appendix 6 to the Annex to the Protocol what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies .

text: 4. Personal data relating to criminal convictions and offences

text: 10. The EDPS notes that the annex to the Protocol entitled ‘Conditions governing fishing activities by Union Vessels in Côte d’Ivoire’s fishing zone’ includes a chapter on infringements committed by Union vessels in Ivorian waters. The EDPS recalls that in case data processed to prevent and fight against illegal fishing would constitute personal data relating to criminal convictions and offences, appropriate safeguards for the rights and freedoms of data subjects should be provided, in accordance with

text: Article 10

text: GDPR and/or

text: Article 11

text: EUDPR. The EDPS recommends the Joint Committee to also add in Appendix 6 to the Annex a provision that would mention these specific safeguards.

text: 5. Conclusions

text: 11. In light of the above, the EDPS makes the following recommendations: (1) to make use of the Joint Committee to specify in par. 2(g) of Appendix 6 to the Annex what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, (2) to make also use of the Joint Committee to add in Appendix 6 to the Annex a provision that would specify the safeguards to be provided in the context of the processing of data relating to criminal convictions and offences. Brussels, 16 April 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI


text: COM(2025) 797 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2025) 797 final. 4

text: Regulation (EU) 2021/1232

text: of the European Parliament and of the Council of 14 July 2021 on a temporary derogation from certain provisions of Directive

text: as regards the use of technologies by providers of number-independent interpersonal communications services for the processing of personal and other data for the purpose of combating online child sexual abuse, OJ L 274, 30.7.2021, pp. 41–51, ELI: http://data.europa.eu/eli/reg/2021/1232/oj. COM(2025) 797 final, p. 1. 6

text: Regulation (EU) 2024/1307

text: of the European Parliament and of the Council of 29 April 2024 amending

text: Regulation (EU) 2021/1232

text: on a temporary derogation from certain provisions of Directive

text: as regards the use of technologies by providers of number-independent interpersonal communications services for the processing of personal and other data for the purpose of combating online child sexual abuse, OJ L, 2024/1307, 14.5.2024, ELI: http://data.europa.eu/eli/reg/2024/1307/oj. 7 Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse of 11 May 2022, COM(2022) 209 final. 4

text: COM(2025) 797 final, p. 1. 9 Idem. 10 See also EDPB-EDPS Joint Opinion 4/2022, para. 10. 11 EDPS Opinion 7/2020 on the Proposal for temporary derogations from Directive

text: for the purpose of combatting child sexual abuse online, issued on 10 November 2020. 12 From the executive summary: ‘In particular, in the interest of legal certainty, the EDPS considers that it is necessary to clarify whether the Proposal itself is intended to provide a legal basis for the processing within the meaning of the GDPR, or not. If not, the EDPS recommends clarifying explicitly in the Proposal which legal basis under the GDPR would be applicable in this particular case. In this regard, the EDPS stresses that guidance by data protection authorities cannot substitute compliance with the requirement of legality. It is insufficient to provide that the temporary derogation is “without prejudice” to the GDPR and to mandate prior consultation of data protection authorities. The co-legislature must take its responsibility and ensure that the proposed derogation complies with the requirements of

text: Article 15(1)

text: , as interpreted by the CJEU.’ 13 See p. 10: ‘[T]he EDPS considers that the general, indiscriminate and automated analysis of all text-based communications transmitted through number-independent interpersonal communications services with a view of identifying new potential infringements does not respect the principle of necessity and proportionality. Even if the technology used is limited to the use of “relevant key indicators”, the EDPS considers the deployment of such general and indiscriminate analysis is excessive.’ 14 EDPS Opinion 8/2024 on the Proposal for a Regulation amending

text: Regulation (EU) 2021/1232

text: on a temporary derogation from certain ePrivacy provisions for combating CSAM, issued on 24 January 2024. 15 The EDPS was particularly concerned by the relatively high error rates of current detection technologies, especially those for detecting new child sexual abuse materials or child solicitation (‘grooming’). The EDPS also drew attention to the significant risk that technologies to detect CSAM may flag consensually produced and shared imagery. 5

text: EDPB-EDPS Joint Opinion 4/2022, adopted on 28 July 2022. 17 The event agenda, briefing note, video recording and summary report can be accessed here. 18 REPORT on the proposal for a regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse, issued on 16 November 2023. 19 EDPB Statement 1/2024 on legislative developments regarding the Proposal for a Regulation laying down rules to prevent and combat child sexual abuse, adopted on 13 February 2024. 20 See Council doc. 15318/25 of 13 November 2025. 21 Recital 10 of the Interim Regulation explicitly states that “[t]his Regulation does not provide for a legal ground for the processing of personal data by providers for the sole purpose of detecting online child sexual abuse on their services and reporting it and removing online child sexual abuse material from their services”. 22 COM(2025) 740 final from 27.11.2025, point 2.1.2., p. 4. 6

text: Ibid. 24 Meta v. Bundeskartellamt Judgment of the Court of Justice of 4 July 2023,

text: Case C-252/21

text: , , ECLI:EU:C:2023:537, para. 137. 25 Ibid, paras. 124 and 132. 26 EDPS Opinion 7/2020 on the Proposal for temporary derogations from Directive

text: for the purpose of combatting child sexual abuse online, issued on 10 November 2020, para. 10. 7

text: In its current state, according to its Recital 10, the Interim Regulation does not provide for a legal ground for the processing of personal data by providers for the sole purpose of detecting online child sexual abuse on their services, only for a derogation from certain provisions of Directive

text: . 28 Judgment of the Court of Justice of 6 October 2020, La Quadrature du Net, Joined Cases

text: and

text: , ECLI:EU:C:2020:791, para 132. 29 Idem. 30 EDPS Opinion 8/2024 on the Proposal for a Regulation amending

text: Regulation (EU) 2021/1232

text: on a temporary derogation from certain ePrivacy provisions for combating CSAM, issued on 24 January 2024, paras. 11-15. 8

text: Ibid. 32 COM(2025) 740 final, point 3, p. 32. 33 Ibid. 34 EDPB-EDPS Joint Opinion 4/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse, para. 100. 35 See in the same vein also the EDPB-EDPS Joint Opinion 4/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse, para. 70. 9

text: See also EDPB-EDPS Joint Opinion 4/2022, adopted on 28 July 2022, para 74.

identifier: EDPS yttrande 07/2026

title: EDPS Opinion 7/2026 on the Proposal for a Regulation extending the application of Regulation (EU) 2021/1232

text: Opinion 7/2026

text: on the Proposal for a Regulation extending the application of

text: Regulation (EU) 2021/1232

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council amending

text: Regulation (EU) 2021/1232

text: as regards the extension of its period of application . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: Regulation (EU) 2021/1232

text: as regards the extension of its period of application.

text: The objective of the Proposal is to ensure that child sexual abuse online can be effectively and lawfully combated on the basis of

text: Regulation (EU) 2021/1232

text: (the Interim Regulation) without interruptions until a longer-term legal framework, to be created by the Proposal for a Regulation laying down rules to prevent and combat child sexual abuse, is agreed. The inter-institutional negotiations on the proposed long-term Regulation have not concluded and, despite the previous extension of the application period of the temporary regime by

text: Regulation (EU) 2024/1307

text: , it is uncertain that they will conclude in time for the long-term Regulation to enter into force and to apply before the Interim Regulation is set to expire. Against this background, the Proposal aims to further extend the period of application of the Interim Regulation until 3 April 2028.

text: The EDPS recognises that child sexual abuse is a particularly serious and heinous crime and that the objective of enabling effective action to combat it amounts to an objective of general interest recognised by the Union. The EDPS recalls his previous Opinions on the Interim Regulation as well as the EDPS-EDPB Joint Opinion on the matter and provides additional recommendations on how to ensure greater legal certainty, in particular on how to ensure lawfulness of processing within the meaning of Regulation 2016/679.

text: The EDPS considers that the Proposal presents the right time and opportunity for the co-legislators to address some of the key shortcomings of the Interim Regulation, namely the lack of a clear legal basis for the processing of personal data and the need of effective safeguards against general and indiscriminate scanning, in line with the principles of necessity and proportionality.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 19 December 2025, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council amending

text: Regulation (EU) 2021/1232

text: as regards the extension of its period of application (‘the Proposal’).

text: Regulation (EU) 2021/1232

text: (“Interim Regulation”) lays down temporary rules derogating from certain confidentiality obligations laid down in Directive

text: (‘the ePrivacy Directive’), with the sole objective of enabling providers of certain number-independent interpersonal communications services to use specific technologies for the processing of personal and other data to the extent strictly necessary to detect online child sexual abuse on their services and report it and to remove online child sexual abuse material from their services .

text: 3. As explained in its Recital 10, the Interim Regulation is intended to provide a temporary solution pending the adoption of a longer-term legal framework to tackle child sexual abuse at Union level. To this end, it contains a sunset clause in

text: Article 10

text: providing for the end of its application by 3 August 2024. The period of application has already been extended once by

text: Regulation (EU) 2024/1307

text: to 3 April 2026.

text: 4. The objective of the Proposal is to ensure that child sexual abuse online can be effectively and lawfully combated without interruptions until a long-term regime, to be created by the Proposal for a Regulation laying down rules to prevent and combat child sexual abuse , is agreed . The inter-institutional negotiations on the proposed long-term Regulation have not concluded and, despite the extension of the application period of the temporary regime by

text: Regulation (EU) 2024/1307

text: , it is uncertain that they will conclude in time for the longterm Regulation to enter into force and to apply before the Interim Regulation is set to expire . Therefore, the Proposal aims to further extend the period of application of the Interim Regulation until 3 April 2028.

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 19 December 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 6 of the Proposal.

text: 2. General remarks

text: 6. Child sexual abuse is a particularly serious and heinous crime and the objective of enabling effective action to combat it amounts to an objective of general interest recognised by the Union and seeks to protect the rights and freedoms of victims . At the same time, any limitations of the rights guaranteed by the Charter, such as the ones that are envisaged by the Interim Regulation, must comply with the requirements set out in Article 52(1) of the Charter.

text: 7. The EDPS issued an Opinion on the Proposal for the Interim Regulation in November 2020 , in which the EDPS addressed, among many others, the need to clarify the legal basis for the processing within the meaning of the GDPR . He also expressed his concerns regarding the necessity and proportionality of the proposal, particularly as regards the failure to effectively safeguard against general and indiscriminate analysis of all text-based communications .

text: 8. The EDPS further issued an Opinion on the Proposal for

text: Regulation (EU) 2024/1307

text: (the first extension to the sunset clause) in January 2024 , in which he recalled the EDPS views expressed in his 2020 Opinion and addressed some aspects in greater detail than before .

text: 9. The EDPS has also issued, together with the European Data Protection Board (EDPB), a Joint Opinion on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse .

text: 10. On 23 October 2023, the EDPS organised a seminar dedicated to the ongoing legislative works on the Proposal for a Regulation , where different stakeholders expressed a wide range of concerns regarding the effectiveness and the risks of the proposed long-term Regulation.

text: 11. On 22 November 2023, the European Parliament issued its Report on the proposed longterm Regulation .

text: 12. In February 2024, the EDPB issued a Statement on legislative developments regarding the Proposal for a Regulation laying down rules to prevent and combat child sexual abuse

text: 13. In November 2025, the Council adopted its general approach for the trilogue negotiations, which includes the deletion of the sunset clause of the Interim Regulation, thus making it permanent . The EDPS furthermore notes that the Council’s general approach does not envisage any substantial amendments to or strengthening of the safeguards in the Interim Regulation.

text: 14. In light of the above, the EDPS considers it appropriate to address again two of the main shortcomings of the Interim Regulation that are particularly important from a data protection perspective, namely the lack of a clear legal basis for the processing of personal data and the need for effective safeguards against general and indiscriminate scanning, in line with the principles of necessity and proportionality.

text: 3. Legal basis under the GDPR

text: 15. In both his 2020 and 2024 Opinions, the EDPS recommended clarifying which legal basis of the GDPR would be applicable for the voluntary processing of content or traffic data by providers of publicly available interpersonal communications services for the purpose of detecting child sexual abuse online. The Interim Regulation does not contain such clarification , resulting in divergent legal practices among providers, as evidenced by the latest Commission report on the implementation of

text: Regulation (EU) 2021/1232

text: 16. The EDPS underlines that identifying an appropriate legal basis under the GDPR is not merely a formality, but an important guarantee to ensure the lawfulness of the processing of personal data. Legal certainty in this respect would benefit all parties involved in or otherwise affected by the voluntary scanning measures, including the victims, users and providers of interpersonal communications services.

text: 17. The Commission implementation report reveals that in practice providers rely on at least three different legal grounds:

text: Article 6(1)

text: (d) GDPR ‘processing is necessary in order to protect the vital interests of the data subject or of another natural person’;

text: Article 6(1)

text: (e) GDPR ‘processing is necessary for the performance of a task carried out in the public interest [...]’; and

text: Article 6(1)

text: (f) GDPR ‘processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party [...]’ .

text: 18. Regarding

text: Article 6(1)

text: (d) GDPR, the Court of Justice of the EU (CJEU) recently made it clear that it should be given a strict interpretation, especially in the context of the services provided by operators of online social networks, whose activities are essentially economic and commercial in nature, and that operators ‘cannot rely on the protection of an interest which is essential for the life of its users or of another person in order to justify, absolutely and in a purely abstract and preventive manner, the lawfulness of data processing’ .

text: 19. In the same judgment, the CJEU found that the objective of collecting and sharing personal data with law enforcement authorities in order to prevent, detect and prosecute criminal offences, in principle is not an objective that is capable of constituting a legitimate interest, within the meaning of

text: Article 6(1)

text: (f) GDPR, for a private business operator whose activity is essentially economic and commercial in nature. Consequently, such an operator would generally be unable to rely on such a legitimate interest, which is unrelated to its economic and commercial activity .

text: 20. The EDPS recalls that the legal basis for the processing cannot be found in

text: Article 6(1)

text: c GDPR (processing necessary for compliance with a legal obligation to which the controller is subject) as the Proposal concerns the voluntary processing of content or traffic data for the purpose of detecting child sexual abuse online and would not oblige providers of number-independent interpersonal communications services to carry out any processing .

text: 21. In light of these considerations, the EDPS considers that the most suitable legal basis under the GDPR for the voluntary processing by private business operators of content or traffic data for the purpose of detecting of child sexual abuse online would be

text: Article 6(1)

text: (e) GDPR. As already explained in this Opinion, combatting child sexual abuse constitutes ‘an objective of general interest recognised by the Union’ and therefore the voluntary processing of content or traffic data by providers of publicly available interpersonal communications services for the purpose of detecting child sexual abuse online could potentially be qualified as necessary for the performance of a task carried out in the public interest. Nevertheless, in order to serve as a basis for the processing in application of

text: Article 6(1)

text: (e) of the GDPR, the Interim Regulation must satisfy the requirements of

text: Article 6(3)

text: GDPR and effectively bestow a task in the public interest. For example, the Interim Regulation could provide for a task to appropriately mitigate risks of child sexual abuse through their services, without, however, necessarily prescribing any specific measure to achieve this mitigation.

text: 22. Therefore, to satisfy the requirements of legal certainty, the EDPS recommends the colegislator to amend the Proposal with the aim of providing a legal basis for processing of content or traffic data by providers of publicly available interpersonal communications services for the purpose of voluntary detection of child sexual abuse online, in line with

text: Article 6(1)

text: (e) GDPR. The EDPS also recommends adapting the text of the Interim Regulation and in particular Recital 10 thereof, accordingly .

text: 4. Necessity and proportionality of voluntary detection measures

text: 23. The EDPS reminds that, to satisfy the requirement of proportionality, the legislation must lay down clear and precise rules governing the scope and application of the measures in question and imposing minimum safeguards, so that the persons whose personal data is affected have sufficient guarantees that data will be effectively protected against the risk of abuse . That legislation must be legally binding and, in particular, must indicate in what circumstances and under which conditions a measure providing for the processing of such data may be adopted, thereby ensuring that the interference is limited to what is strictly necessary . As clarified by the CJEU, the need for such safeguards is all the greater where personal data is subjected to automated processing and where the protection of the particular category of personal data that is sensitive data is at stake.

text: 24. One of the main concerns of the EDPS in his 2020 and 2024 Opinions was related to the necessity and proportionality of the voluntary detection measures. In fact, currently the providers, including those whose services are very extensively used by the European users, have a very broad discretion whether and how to monitor the traffic on their networks for CSAM, using a variety of detection technologies and processes. In this regard, the EDPS has already pointed out in the past that the Interim Regulation, while generally referring to strict necessity and proportionality, in reality does not provide for specific and effective safeguards against general and indiscriminate monitoring.

text: 25. In his 2024 Opinion , the EDPS had provided examples how general and indiscriminate monitoring could be prevented, e.g. by requiring the providers to limit the deployment of detection technologies to a specific subset of communications, and by providing the criteria for selection of such subsets. These recommendations remain fully valid.

text: 26. Additionally, the EDPS observed that the Interim Regulation refers to ‘content data and related traffic data’ in very general terms and does not specify which data categories may be processed for which purpose . This is of high practical relevance in the effort to prevent general and indiscriminate monitoring, as providers could be required to use less intrusive technologies, e.g. based on certain data categories of traffic data, to preselect data with a higher likelihood of containing incriminatory content data, before detection technologies are applied to process content data. Measures to further reduce the amount of monitored communications, is one of several potential safeguards against general and indiscriminate scanning, that have neither been explored nor explicitly mandated in the Interim Regulation. The EDPS recommends using this opportunity to provide for such safeguards.

text: 27. The EDPS notes with serious concern that the Commission report on the implementation of the Interim Regulation from November 2025 admits that the available data are insufficient to provide a definitive answer to the question whether the Regulation achieves the balance sought between, on the one hand, achieving the general interest objective of effectively combating the extremely serious crimes at issue and the need to protect the fundamental rights of children, and, on the other hand, safeguarding the fundamental rights of the users of the services covered . Moreover, there is no information by the providers on whether the technologies were deployed in line with the state of the art and in the least privacy-intrusive way, or on whether a prior data protection impact assessment, as referred to in

text: Article 35

text: GDPR, and a prior consultation procedure, as referred to in

text: Article 36

text: GDPR, had been conducted .

text: 28. The EDPS stresses the importance of the requirements of the Interim Regulation to be strictly observed by the providers. Any mere extension without steps and measures to ensure the effectiveness of existing and new safeguards remains highly problematic.

text: 29. Should the co-legislators follow the path of the Council's general approach for a permanent Regulation regarding combatting the dissemination of CSAM online, including the removal of the sunset clause from the Interim Regulation, it would be of paramount importance that all necessary safeguards, including safeguards against prohibiting or weakening encryption, are provided for and fully implemented by providers. In this regard, the EDPS further recalls that client-side scanning contains a risk of substantial degradation of confidentiality and the need to ensure both legal and technical protection of information stored on the terminal equipment of end-users.

text: 30. Finally, the EDPS remains of the opinion that the general, indiscriminate and automated analysis of all text-based communications transmitted through number-independent interpersonal communications services with a view of identifying solicitation of children (‘grooming’) does not respect the principle of necessity and proportionality. Even if the technology is limited to the use of ‘relevant key indicators’, the EDPS considers the deployment of such probabilistic analysis as excessive . He shares similar concerns also about the measures to identify unknown CSAM because of potential granting of access to content of communications on a generalised basis, their probabilistic nature and the error rates associated with such technologies .

text: 5. Conclusions

text: 31. In light of the above, the EDPS makes the following recommendations: (1) to amend the Interim Regulation so that it would provide for a legal basis for the processing of content or traffic data by providers of publicly available interpersonal communications services for the purpose of voluntary detection of child sexual abuse online, in line with

text: Article 6(1)

text: (e) and

text: Article 6(3)

text: GDPR, taking into account the requirements of Article 52 of the Charter of Fundamental Right of the European Union; (2) to provide for specific and effective safeguards, in particular against general and indiscriminate monitoring, taking into account the EDPS recommendations in his 2020 and 2024 Opinion on the Interim Regulation, as well as the EDPB-EDPS Joint Opinion on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse; (4) to take fully into account the concerns and the additional risk stemming from measures to detect CSAM in interpersonal communications, identified during the discussions on the Proposal for a long-term CSAM Regulation. Brussels, 16 February 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 10