text: OJ L 295, 21.11.2018, p. 39. 4

text: Regulation (EC) No 767/2008

text: of the European Parliament and of the Council of 9 July 2008 concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas, OJ L 218, 13.8.2008, p. 60–81.

text: Regulation (EC) No 810/2009

text: of the European Parliament and of the Council of 13 July 2009 establishing a Community Code on Visas, OJ L 243, 15.9.2009, p. 1–58.

text: Regulation (EU) 2017/2226

text: of the European Parliament and of the Council of 30 November 2017 establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third-country nationals crossing the external borders of the Member States and determining the conditions for access to the EES for law enforcement purposes, and amending the Convention implementing the Schengen Agreement and Regulations

text: (EC) No 767/2008

text: and

text: (EU) No 1077/2011

text: , OJ L 327, 9.12.2017, p. 20–82.

text: Council Regulation (EC) No 1683/95 of 29 May 1995

text: laying down a uniform format for visas, OJ L 164, 14.7.1995, p. 1–4.

text: Council Regulation (EC) No 333/2002 of 18 February 2002

text: on a uniform format for forms for affixing the visa issued by Member States to persons holding travel documents not recognised by the Member State drawing up the form, OJ L 53, 23.2.2002, p. 4–6.

text: Council Regulation (EC) No 693/2003 of 14 April 2003

text: establishing a specific Facilitated Transit Document (FTD), a Facilitated Rail Transit Document (FRTD) and amending the Common Consular Instructions and the Common Manual, OJ L 99, 17.4.2003, p. 8–14.

text: Council Regulation (EC) No 694/2003 of 14 April 2003

text: on uniform formats for Facilitated Transit Documents (FTD) and Facilitated Rail Transit Documents (FRTD) provided for in

text: Regulation (EC) No 693/2003

text: , OJ L 99, 17.4.2003, p. 15– 21. Convention implementing the Schengen Agreement of 14 June 1985 between the Governments of the States of the Benelux Economic Union, the Federal Republic of Germany and the French Republic on the gradual abolition of checks at their common borders, OJ L 239, 22.9.2000, p. 19–62. COM(2022) 658 final, p.7 Presidency Council of the European Union, e-Visa: Improving the current visa process with online visa application, 12546/17, October 2017. Presidency Council of the European Union, e-Visa: Improving the current visa process with digital visa, 11816/17, October 2017. Communication from the Commission to the European Parliament and the Council, Adapting the common visa policy to new challenges, COM(2018) 251 final COM(2020) 609 final, p.13. EDPS Opinion 09/2018 on the Proposal for a new Regulation on the Visa Information System, issued on 12 December 2018, paragraphs 13-14 COM (2022) 658 final, p.8 and p.12. Article 1 (6) of the Proposal. COM (2022) 658 final, p. 11. cfr.

text: Article 22

text: o par 3 (f ) of the VIS Regulation as modified by the Proposal in

text: Article 2(17)

text: . cfr.

text: Article 22

text: r par 3 (f) of the VIS Regulation as modified by the Proposal in

text: Article 2(18)

text: . See Judgment of the Court (Second Chamber) of 19 October 2016, Patrick Breyer v Bundesrepublik

text: - Breyer: “ (...) dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person”. https://curia.europa.eu/juris/document/document.jsf;jsessionid=0773C875468BBE9FAC3A758976BF291B?text=&doci d=184668&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=5272015 Article 52(1) of the Charter states that “[a]ny limitation on the exercise of the rights and freedoms recognised by this Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others”.

text: Regulation (EU) 2019/817

text: of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of borders and visa and amending Regulations

text: (EC) No 767/2008

text: (EU) 2016/399

text: (EU) 2017/2226

text: (EU) 2018/1240

text: (EU) 2018/1726

text: and

text: (EU) 2018/1861

text: of the European Parliament and of the Council and Council Decisions

text: and 2008/633/JHA, OJ L 135, 22.5.2019, p. 27–84.

text: Regulation (EU) 2019/818

text: of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of police and judicial cooperation, asylum and migration and amending Regulations

text: (EU) 2018/1726

text: (EU) 2018/1862

text: and

text: (EU) 2019/816

text: , OJ L 135, 22.5.2019, p. 85–135. COM (2022) 658 final, Recital 26. COM (2022) 658 final, p.15.

text: Article 7

text: (c)(5) of the new Chapter Ia introduced by Article 1(3) of the Proposal. Article 1(9) of the Proposal.

text: Article 7

text: c(11) and (12) of the VIS Regulation as modified by the Proposal in

text: Article 2(3)

text: . EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: , issued on 7 November 2019 and EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR, issued on 7 September 2020.

text: Article 7

text: e of the VIS Regulation as amended by Article 2(3) of the Proposal. Ibidem. Article 37(2) of the VIS Regulation

text: Article 7

text: (b)(6) introduced by Article 1(3) of the Proposal.

identifier: EDPS yttrande 13/2022

title: Proposal for a Regulation on the digitalisation of the visa procedure

text: 21 June 2022 Opinion 13/2022

text: on the Proposal for a Regulation on the digitalisation of the visa procedure

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to a Proposal for a Regulation of the European Parliament and of the Council amending Regulations

text: (EC) No 767/2008

text: (EC) No 810/2009

text: and

text: (EU) 2017/2226

text: of the European Parliament and of the Council, Council Regulations

text: (EC) No 1683/95

text: (EC) No 333/2002

text: (EC) No 693/2003

text: and

text: (EC) No 694/2003

text: and Convention implementing the Schengen Agreement, as regards the digitalisation of the visa procedure. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the draft Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 27 April 2022, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on the digitalisation of the visa procedure. The Proposal aims at introducing the possibility to submit visa applications online through the European digital visa application platform, and replacing the visa sticker with a digital visa. By doing so, the visa application procedures within the Schengen area should be simplified and harmonised, and security risks posed by the physical visa stickers would be reduced.

text: The EDPS recognises that the digitalisation of the visa processing has the potential to address a number of challenges faced by visa applicants and consulates. However, the mandatory nature of the new procedure may also create additional obstacles to visa applicants, for instance, due to IT illiteracy or lack of adequate equipment. The EDPS recommends including in the Proposal an explicit provision that would exempt individuals with accessibility issues from using the European digital visa application platform.

text: The EDPS takes note that the Proposal adds, among the personal data to be included in the visa application, the IP addresses from which application forms are submitted. In this regard, the EDPS recalls the principle of data minimisation, which should lead the Commission to assess whether the collection of IP addresses is needed for the purposes of the Proposal.

text: The EDPS also recalls the importance of providing to the data subjects information about the processing of their personal data, to ensure fair processing. Consequently, since the personal data for VIS shall be first collected in the European online visa platform, the EDPS is of the opinion that information about the processing of personal data in the context of VIS, in line with Article 37(1) of the VIS Regulation, should also be provided by the platform. Besides, in view of the operationalisation of interoperability and the consequent processing of personal data for multiple purposes, the right to information should not be limited to providing information about the purposes for which the data will be processed within the VIS. It should also provide information about the processing that takes place in all the other JHA large-scale database systems and interoperability components falling within the scope of the interoperability framework.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 27 April 2022 the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council amending Regulations

text: (EC) No 767/2008

text: , (EC) No 2 3 810/2009 and

text: (EU) 2017/2226

text: of the European Parliament and of the Council , Council 4 5 6 7 Regulations

text: (EC) No 1683/95

text: (EC) No 333/2002

text: (EC) No 693/2003

text: and

text: (EC) No 694/2003

text: and Convention implementing the Schengen Agreement , as regards the digitalisation of the visa procedure (‘the Proposal’).

text: 2. The Proposal aims to streamline and harmonise the procedures in the context of the common visa policy and align travel, entry requirements and border checks within the Schengen area through digitalisation and the interoperability framework at the borders. To this end, the Proposal would replace the paper visa sticker with a digital visa and introduce a mandatory online European digital visa application form.

text: 3. The Estonian Council Presidency began the discussion on the introduction of an online visa 10 11 application and a digital visa back in 2017. In 2018, the European Commission took up the debate on the digitalisation of the visa processing and announced in its Communication on visa policy the launch of feasibilities studies and pilot projects that would have laid down the ground for future proposals . The New Pact on Migration and Asylum set the objective of making the visa procedure fully digitalised by 2025, with a digital visa and the ability to submit visa applications online .

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 28 April 2022, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 47 of the Proposal.

text: 2. General remarks

text: 5. The proposal aims at digitalising two steps of the visa procedure: the visa application process and the issuing of the visa. The EDPS observes that, between the two, the former has the greatest impact from a data protection point of view due to the introduction of an EU digital visa application platform. Therefore, this Opinion will focus on this aspect of the Proposal.

text: 6. The EDPS recognises that the digitalisation of the visa processing has the potential to address a number of challenges faced by visa applicants and consulates. However, while technological developments bring new opportunities, they may also create additional obstacles to visa applicants, for instance, due to IT illiteracy or lack of adequate equipment. They also raise broader questions about data protection and privacy rights especially taking into account the use of large-scale database systems and artificial intelligence, in the broader context of migration and border management.

text: 7. The EDPS has underlined in several occasions, including in the context of the EU visa policy that biometric data, such as fingerprints and facial images are considered as one of the special categories of personal data and are subject to special protection. Their collection must take place in a controlled environment. This is even more imperative when it concerns personal data of children from the age of six, as foreseen by the reviewed

text: Regulation (EC) No 810/2009

text: (VIS Regulation), recently entered into force. Thus, the EDPS welcomes the fact that applicants will need to present themselves in front of the consulate or visa application centre to provide fingerprints and facial images, including when travelling with children. Nevertheless, the EDPS wishes to observe that, the observation attributed to the EDPS and reported in the Explanatory Memorandum have been taken out of context and do not constitute the official position of the EDPS, which is expressed in this Opinion.

text: 8. The EDPS also welcomes the fact that the system will pre-check and will notify the applicant if information is missing and that it will provide the applicant with the possibility of correcting the application.

text: 9. Finally, the EDPS notes positively the reference to the free and explicit consent of the applicants to the storage of their data in a secure account service of the European digital visa application platform.

text: 10. Against this background, the EDPS will focus in this opinion on the following issues: a. the necessity and proportionality of the envisaged measures, in particular with regard to: the mandatory use of the EU digital visa application platform and the categories of data processed therein; b. the integrity and confidentiality of the personal data processed, including: the access and use to data for each authority concerned, the accuracy of the personal data processed, the attribution of the roles and responsibilities, as well as security considerations; and c. the rights of the data subjects with regard to the right to information. 5

text: 3. Mandatory use of the EU digital visa application platform

text: 11. The Proposal would amend

text: Article 9 of Regulation (EC) No 810/2009

text: (The Visa Code) to introduce the obligation to apply for short-stay visa through an EU digital visa application platform. Derogations are foreseen, among others, for humanitarian reasons . According to the Explanatory Memorandum and Recital 14 of the Proposal, such a derogation could also apply to people with lower IT literacy who would require technical assistance. Indeed, although the online application aims to make the visa processing more efficient, certain categories of applicants may find it more challenging, for instance because they do not have the necessary equipment or adequate digital literacy. As a consequence, these categories of applicants would be more likely to rely on external service providers to submit their applications and thus being more susceptible to expose their personal data to third-parties. However, the EDPS notes that such exception is not clearly mentioned in the Recital, which envisages it as a possibility only. The said Recital indicates that special provisions which should apply in individual cases because of humanitarian reasons could cover digital accessibility issues (emphasis added). Furthermore, such an exception is not reflected in the operative part of the Proposal. In a context of persisting digital divides, the EDPS considers important to include in the operative part of the Proposal an explicit provision that would exempt individuals with accessibility issues from using the EU digital visa platform. Recital 14 should be amended accordingly.

text: 4. Categories of data processed

text: 12. The Proposal would amend

text: Regulation (EC) No 767/2008

text: by introducing a new Chapter Ia on the European digital visa application platform. Under this Chapter,

text: Article 7

text: (b)(5) would add the IP address from which the application form is submitted among the data of the application. Such data will then be stored in VIS. and it will become possible for designated 18 19 authorities of the Member States as well as Europol to access this information. The EDPS wishes to recall that IP addresses may constitute personal data and, as such, their processing should be subject to an in-depth assessment of the necessity of such processing for the purposes foreseen in the Proposal. Such an assessment is a pre-requisite for any limitation to fundamental rights, including data protection, according to Article 52 of the EU Charter of Fundamental Rights . The EDPS regrets that the impact assessment accompanying the Proposal does not provide for any assessment related to the need to process IP addresses for the purposes of the digital visa. The impact assessment accompanying the Proposal also fails to address the question of access to such data by Europol. In the absence of such an assessment, the EDPS is not in a position to determine whether the processing of IP addresses is necessary to achieve the objectives of the Proposal and whether it would be compliant with the principles of purpose limitation and data minimisation. Therefore, the EDPS considers that the IP address from which the application form was submitted should not be added as part of the data of the visa application. Unless clear evidence is provided for the necessity and proportionality of the processing for the purposes of the Proposal, the EDPS considers that IP addresses should not be processed for the purposes set out in the VIS Regulation nor in any other large-scale database systems or components falling within the scope of the interoperability framework . 6

text: 5. Access and use of data

text: 13. The EDPS welcomes the fact that external providers within the meaning of the Proposal would not have access to VIS. However, he points out that, contrary to Recital 26 of the Proposal, the Explanatory Memorandum states that external service providers would have read-only access to VIS data, via a gateway to be set up.

text: 14. The EDPS recalls in this context that, pursuant to Article 6 (2) of the VIS Regulation access to the VIS for consulting the data shall be reserved exclusively for the duly authorised staff of: a. the national authorities of each Member State and of the Union bodies which are competent for the purposes of

text: Articles 15

text: to 22,

text: Articles 22

text: g to 22m and

text: Article 45

text: e of this Regulation; b. the ETIAS Central Unit and the ETIAS National Units, designated pursuant to Articles

text: and

text: of Regulation (EU) 2018/1240, for the purposes of

text: Articles 18

text: c and 18d of this Regulation and for the purposes of

text: Regulation (EU) 2018/1240

text: ; and c. the national authorities of each Member State and of the Union bodies which are competent for the purposes of Articles

text: and

text: of Regulation (EU) 2019/817. Since the EU application platform will be able to carry out checks against the read-only copy of VIS , the EDPS asks the Commission to ensure that external service providers will not have access to VIS data via the European digital visa application platform.

text: 6. Data quality

text: 15. The EDPS notes that the Proposal provides for the obligation for consulates and external service providers to perform quality checks of the uploaded supporting documents. At the same time, it does not establish a specific procedure to verify the quality of the personal data inserted in the application form via the platform, which may affect the accuracy of the data submitted. Having a uniform approach to quality check is important not only to ensure an equal level of data quality across the Member States, but also to ensure that applicants have the same treatment when addressing different competent consulates. Thus, the EDPS invites the Commission to clarify in the Proposal that procedures and requirements to ensure data quality checks on the data inserted in the application form should be foreseen and that such requirements should be spelled out by means of implementing acts.

text: 7. Roles and responsibilities

text: 16. The architecture of the European digital visa application platform would be a hybrid solution according to which all application files would be stored centrally in the Application Management System only until they are marked by the competent authority as admissible. At that point, they would be transferred to the relevant Member State and deleted from the temporary storage . From a data protection perspective, the envisaged solution brings certain reassurances in terms of data minimisation and security. However, it makes the 7 identification of the roles and responsibilities of the different actors involved potentially more complex. The clear attribution of the different roles and responsibilities is crucial to determine who will be responsible for compliance with different data protection rules and how data subjects can exercise their rights in practice. Therefore, the EDPS recommends clarifying in the Proposal the roles and responsibilities of the different actors involved in the processing of personal data via the European digital visa application platform, e.g. eu-LISA, the Member States authorities and, where relevant, the external service providers, in particular with regard to the notions of controller and processor .

text: 8. Security considerations - External service providers gateway

text: 17. The Proposal would amend

text: Article 44 of Regulation (EC) No 810/2009

text: , which addresses the question of encryption and secure transfer of data between Member States and external service providers. In particular, according to the Proposal, the encryption procedure provided for in

text: shall not apply to the access that external service providers may have to the European digital visa application platform via the external service provider gateway referred to in

text: Article 7

text: e of

text: Regulation (EC) No 767/2008

text: . However,

text: Article 7

text: e only prescribes that when setting up the authentication scheme, information security management and the principles of data protection by design and by default shall be taken into account . While the EDPS welcomes the explicit reference to data protection by design and by default, he wishes to remind that encryption and authentication are different security mechanisms, that operate at different levels. Their use should be cumulative to ensure adequate safety measures for the systems. Replacing security mechanisms, which were designed for different purposes, is a practice to be discouraged from an information security management standpoint. Therefore, the EDPS recommends removing the derogation to Paragraph 1 of

text: , unless clear evidence is provided for its necessity and proportionality.

text: 18. Furthermore, the EDPS is of the opinion that the Proposal does not sufficiently describe how the external service provider gateway would allow external providers to access the applicants’ data, as provided for in

text: Article 7

text: e of

text: Regulation (EC) No 767/2008

text: (External service provider gateway) . The service provider should only be able to access a visa application after applicants have provided their authorisation, and the Proposal should describe in which way that authorisation would be granted. Such access should be limited to the tasks of the external service provider as defined in

text: Article 7

text: e of the Proposal. Furthermore, applications should cease to be accessible once they are made available to the consulates for further processing, as described in Article 2(3) of the Proposal amending the VIS Regulation in

text: Article 7

text: e (1) (e).

text: 19. More generally, the Commission should consider the risk of malicious usage, or exploitation, of the external service provider gateway, as the tool is likely to be accessible to a wide range of different actors, many of which in third countries. Security mechanisms such as the detection of irregular usage of the gateway (for instance, a large number of accesses to different applications on a short interval) or the encryption of the data in the 8 temporary storage are possible safety measures that could be applied to ensure the integrity and confidentiality of the data.

text: 9. Security considerations - The secure account service

text: 20. Amendments to

text: Article 7

text: b(3) of the VIS Regulation in accordance with Article 2(3) of the Proposal would introduce a secure account service, which would provide the possibility for applicants to keep the data provided for subsequent applications, and to submit the application in several steps. The Article refers to the fact that the Commission shall adopt delegated acts in accordance with

text: Article 48

text: a of the VIS Regulation in order to define the requirements of the secure account service, including the retention period for data stored therein and for uncompleted applications or applications which do not pass the competence and admissibility check. The EDPS considers that the secure account service provides access to data that could reveal highly sensitive information about the individuals and stresses the importance of ensuring the confidentiality of the applicant’s personal data. Therefore, any further acts to define the requirements of the secure accounts should address the need to have robust authentication mechanisms, such as multi-factor authentication, to prevent the risk of unauthorised access with stolen credentials.

text: 10. The rights of the data subjects

text: 21. The new

text: Article 7

text: a of the VIS Regulation would be dedicated to the 'General public information on the EU-application platform’. The EDPS recognises the importance of giving general information to the public as referred to in

text: Article 47 of Regulation (EC) No 810/2009

text: . The right to information constitutes an indispensable safeguard for the rights of the individual, including data protection. Therefore, it is equally important to provide to the data subjects information about the processing of their personal data, to ensure fair processing. In particular, with regard to the processing of applicants’ personal data, the EDPS recalls that according to Article 37 of the VIS Regulation, data subjects should be informed about the processing of their personal data in VIS in writing, when the data from the application form, the photograph and the fingerprints data are collected . Since the personal data that will be processed in VIS will be first collected in the envisaged platform, the EDPS is of the opinion that the EU application platform should also provide information about the processing of personal data in the context of VIS.

text: 22. In addition, in view of the operationalisation of the interoperability framework and the consequent processing of personal data for multiple purposes, the EDPS underlines that the right to information should not be limited to providing information about the purposes for which the data will be processed within the VIS. It should also include information about the processing in the other interoperability components and large-scale data base systems part of the network. 9

text: 11. Other specific comments

text: 23. The proposal foresees the possibility to delegate to the Commission the adoption of an implementing act that would define the content of a simplified application forms for confirmation of valid visas in a new travel document and for extension of visas . The EDPS wishes to recall that such form should not go beyond what is explicitly set out in the Proposal and should select the most essential elements, in line with the principle of data minimisation.

text: 12. Conclusions

text: 24. In light of the above, the EDPS makes the following recommendations: (1) to clarify Recital 14 in order to ensure that persons with digital accessibility issues should be entitled to lodge their applications in person, and to reflect this rule in the operative part of the Proposal; (3) to define a common procedure to ensure that data quality checks on the personal data inserted in the application form via the European digital visa application platform are homogeneous and auditable among different stakeholders; (4) to clarify the roles and responsibilities among eu-LISA, the Member States authorities and, if relevant, the external service providers involved in the processing of personal data via the European digital visa application platform; (5) to remove the derogation to

text: Article 44(1) of Regulation (EC) 810/2009

text: , as mentioned in

text: Article 1(29)

text: of the Proposal, in order to ensure the encryption of personal data accessed by external service providers through the EU application platform, via the external service provider gateway and, more generally, to provide for security mechanisms for the use of this gateway; (6) to determine robust authentication mechanisms as part of the secure account service; (7) to include in the European digital visa application platform information about the processing of personal data for the purposes of VIS and additional purposes derived from the operationalisation of the interoperability framework. Brussels, 21 June 2022 [e-signed] Wojciech Rafał WIEWIÓROWSKI 10 11 12


text: COM(2024) 23 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2024) 23 final, p. 2. 4

text: Regulation (EU) 2019/452

text: of the European Parliament and of the Council of 19 March 2019 establishing a framework for the screening of foreign direct investments into the Union, OJ L 79I , 21.3.2019, p. 1–14. COM(2024) 23 final, p. 1. 6 Formal Comments of the EDPS on the Proposal for a Regulation establishing a framework for screening of foreign direct investments into the European Union, issued on 12 April 2018. 7

text: Regulation (EU) 2019/452

text: of the European Parliament and of the Council of 19 March 2019 establishing a framework for the screening of foreign direct investments into the Union, OJ L 79I , 21.3.2019, p. 1–14. 4

text: A ‘foreign investor’ according to

text: Article 2(6)

text: (a) of the Proposal may be a natural person. 9 Judgment of of the Court (Grand Chamber) of 9 November 2010, Volker und Markus Schecke and Eifert,

text: and

text: , ECLI:EU:C:2010:662, paragraphs 52 and 53. 10

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1–88. 11 On the Commission role and tasks in the context of the Union cooperation mechanism, see Article 5(5) and 5(7) of the draft Proposal. 12

text: Article 17

text: and Recital 42 of the Proposal. 13 Article 10(2) of the Proposal and Recital 50. 5

text: Article 5(1)

text: (b) GDPR. 15

text: Article 4(1)

text: (b) EUDPR. 16 Article 17(2) of the Proposal. 17

text: Article 5(1)

text: (c) GDPR,

text: Article 4(1)

text: (e) EUDPR. 18 Judgment of the Court (Grand Chamber) of 8 April 2014, Digital Rights Ireland and Seitlinger and others,

text: and

text: , ECLI:EU:C:2014:238, paragraph 64. 6

text: See definition in Article 2(17) of the Proposal. 20 In this regard, the EDPS notes that the Commission Staff Working Document accompanying the Proposal indicates that a joint controllership arrangement between the Commission and Member States has been concluded: “As the exchange of FDI information in the cooperation mechanism regularly involves processing personal data (for example, names and addresses of natural persons involved in a transaction), the Member States and the Commission concluded a joint controllership arrangement, in line with data protection rules (particularly the GDPR (

text: Article 26

text: ), the EDPR (

text: Article 28

text: ), the FDI Screening Regulation (

text: Article 14

text: ) and the underlying Commission Decision. The joint controllership agreement is between Member States and the Commission on the processing of these personal data. It sets out the respective roles, responsibilities and practical arrangements. The joint controllership agreement entered into force on 28 April 2022, and it was the first arrangement of this kind adopted by Member States and the Commission.” (SWD(2024) 23 final, pages 15 and 16). 21

text: Article 13(3)

text: (d) of the Proposal. 22 Annex II, point 3, letter b, of the Proposal. 7

identifier: EDPS yttrande 13/2024

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 13/2024 on the Proposal for a Regulation on the screening of foreign investments in the Union and repealing Regulation (EU) 2019/452

serie: yttranden

text: 15 March 2024

type: rubrik

text: Opinion 13/2024

text: Regulation (EU) 2019/452

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on the screening of foreign investments in the Union and repealing

text: Regulation (EU) 2019/452

text: of the European Parliament and of the Council . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: Regulation (EU) 2019/452

text: The aim of the Proposal is to enhance the EU’s security and public order in the context of foreign direct investments and investments made by foreign investors through an undertaking established in the EU. In particular, the Proposal aims to provide legal certainty for national screening mechanisms on grounds of security and public order, to increase consistency between the national screening mechanisms and to improve the efficiency and effectiveness of the cooperation mechanism between Member States and the Commission on foreign investments.

text: The EDPS welcomes the attention paid to the data protection aspects of the Proposal. In particular, the EDPS welcomes that the Proposal clearly sets out the categories of personal data concerned and the purposes for which they may be processed. The EDPS also welcomes that the Proposal mentions the protection of personal data as a factor to be assessed when screening the foreign investment.

text: As regards the processing of personal data in the context of the cooperation mechanism, the EDPS recommends specifying the roles of the Commission and of the Member States as joint controllers in the enacting terms of the Proposal. In addition, the EDPS recommends specifying the maximum storage periods for personal data processed for the screening of foreign investments by Member States, as well as for personal data processed for ensuring the effectiveness of the cooperation mechanism. Alternatively, the maximum storage periods could also be specified by way of an implementing act.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 24 January 2024, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on the screening of foreign investments in the Union and repealing

text: Regulation (EU) 2019/452

text: of the European Parliament and of the Council (‘the Proposal’). The Proposal is accompanied by two annexes: Annex I provides a list of projects and programs of Union interest; Annex II lists the technologies, assets, facilities, equipment, networks, systems, services and economic activities of particular importance for the security or public order interests of the Union.

text: 2. The objective of the Proposal is to ensure that all Member States have a screening mechanism that allows the assessment of transactions before they are completed, and to address key shortcomings in the effectiveness and efficiency of the cooperation mechanism between all national authorities and the Commission . The Explanatory Memorandum notes that despite

text: Regulation (EU) 2019/452

text: (‘the FDI Screening Regulation’) , and the increasing adoption of screening mechanisms at Member State level, ‘a significant share of Foreign Direct Investments (‘FDIs’) in the EU still goes to Member States that do not have a screening mechanism and this leaves vulnerabilities because potentially critical FDIs remain undetected.’

text: 3. The Proposal would establish a cooperation mechanism to enable Member States and the Commission to exchange information on foreign investments, assess their potential impact on security or public order, and identify potential concerns that shall be addressed by the Member State that is screening the foreign investment.

text: 4. The EDPS recalls that he previously issued formal comments on the Proposal that led to the FDI Screening Regulation currently in force.

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 24 January 2024, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in the preamble of the Proposal. In addition, the EDPS positively notes that he was already previously informally consulted pursuant to Recital 60 of EUDPR.

text: 2. General remarks

text: 6. The screening of foreign investments by the Member States and the exchange of FDI information under the Union cooperation mechanism provided by the Proposal would regularly involve processing of personal data. A clear example are the notifications that would be required under the Proposal, which may include the names and addresses of natural persons involved in a transaction . In this respect, the EDPS recalls that the official title of a legal person can also constitute personal data, in particular when it identifies one or more natural persons . Moreover, the description of the ownership structure of a legal person (be it the foreign investor or the European target), which the Member States should make available to the Commission and the Member States in the context of notification and own initiative procedures under Chapter 3 of the Proposal, may contain personal data.

text: 7. The EDPS welcomes the clarification in the Proposal that the EUDPR and the GDPR apply to the processing of personal data by the Commission and the Member States respectively, and that processing of personal data under the Proposal should comply with these Regulations .

text: 3. Information requirements

text: 8. The EDPS notes that the Commission would be required to adopt implementing acts to set out the forms to be used by Member States to provide the type of information required under the notification of foreign investments referred to in

text: Article 5

text: and the request for information referred to in Article 9(5) of the Proposal . Since such forms would include fields containing personal data (such as names and contact details of investors), the EDPS reminds the Commission of its obligation pursuant to

text: Article 42(1)

text: EUDPR to consult the EDPS when preparing implementing acts that would affect the protection of individuals’ rights and freedoms with regard to the processing of personal data.

text: 4. International cooperation with responsible authorities of third countries

text: 9. The EDPS observes that Article 15 of the Proposal would allow Member States and the Commission to cooperate with the responsible authorities of third countries on issues relating to the screening of investments on grounds of security and public order. The EDPS recalls that any transfer of personal data that would take place in the context of such cooperation would need to comply with the GDPR and the EUDPR, as applicable, including the rules on transfers of personal data to third countries.

text: 5. Purpose limitation

text: 10. The EDPS positively notes that Article 17(2) of the Proposal specifies that processing of personal data pursuant to the Proposal must be carried out ‘only when necessary for the screening of foreign investments by Member States and for ensuring the effectiveness of the cooperation provided for in this Regulation’. The EDPS welcomes this specification, which is in accordance with the purpose limitation principle laid down in the GDPR and in the EUDPR .

text: 6. Storage periods

text: 11. The EDPS notes that the Proposal specifies that personal data related to the implementation of the Proposal must be kept only for the time necessary to fulfil the purposes for which they were collected . However, the EDPS considers that fixed storage periods should be defined, following the expiry of which personal data should be deleted by the Member States and the Commission, as applicable .

text: 12. Storage periods should be defined in a manner which is proportionate to the purposes pursued. As a result, it may be appropriate to define different storage periods for (a) personal data processed for the screening of foreign investments by Member States, and (b) for personal data processed for ensuring the effectiveness of the cooperation mechanism provided for in the Proposal.

text: 13. The EDPS recalls that, in accordance with the case law of the Court of Justice of the European Union , the determination of a storage duration must be based on objective criteria and be as short as possible. The EDPS recommends including maximum storage periods in the enacting terms of the Proposal, and to include the justification for those storage periods in a recital of the Proposal. Alternatively, the maximum storage periods could be further specified by way of an implementing act.

text: 7. Joint controllership for the cooperation mechanism

text: 14. Having regard to the cooperation mechanism , the EDPS recommends specifying, in the enacting terms of the Proposal, the roles of the Commission and of Member States’ competent authorities as joint controllers having regard to the processing of personal data in the context of the cooperation mechanism. While detailed arrangements to ensure compliance with data protection requirements may be further defined by way of a joint controller arrangement , the EDPS points out that the roles of the Commission and of the Member States should be clearly specified in the Proposal as such.

text: 8. Protection of personal data, security and public order

text: 15. The EDPS welcomes that potential effects on the protection of personal data are included among the factors that the Member States or the Commission must consider when determining whether a foreign investment is likely to affect security or public order under the Proposal , notably, the impact on “the protection of sensitive information, including personal data, in particular with regard to the ability of the foreign investor to access, control, and otherwise process such personal data”. This represents an important acknowledgement of the role of personal data as a critical asset in the geopolitical context, where control of sensitive data by foreign investors could negatively impact security and public order. The EDPS invites the co-legislators to keep this provision in the final text of the Regulation.

text: 16. The EDPS welcomes that artificial intelligence technologies (including data analytics technologies) are included in Annex II of the Proposal , containing a list of technologies, assets, facilities, equipment, networks, systems, services and economic activities of particular importance for the security or public order interests of the Union.

text: 17. The EDPS also appreciates that Article 19(2) of the Proposal would empower the Commission to amend Annex II via a delegated act considering, among others, the emergence of vulnerabilities in relation to access to or other forms of processing of sensitive information, including personal data, to the extent they are likely to negatively affect the security or public order interests of the Union .

text: 9. Conclusions

text: 18. In light of the above, the EDPS makes the following recommendations: (1) to clearly specify, in the enacting terms of the Proposal, the roles of the Commission and of the Member States as joint controllers having regard to the processing of personal data in the context of the cooperation mechanism; (2) to specify maximum storage periods for personal data processed for the screening of foreign investments by Member States, as well as for personal data processed for ensuring the effectiveness of the cooperation mechanism, and to include the justification for these maximum storage periods in a recital of the Proposal. Alternatively, such storage periods could be specified by way of an implementing act. Brussels, 15 March 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI

type: vagledning

utgivare: edps


text: OJ L 295, 21.11.2018, p. 39. 2 COM(2025) 232 final. 3 COM(2025) 233 final. 4 Article 1 of the Signing Proposal. Article 1 of the Conclusion Proposal. 6 Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, OJ L 149, 30/04/2021, p. 10–2539. 4

text: Explanatory Memorandum of the Signing Proposal, p. 1; Recital 3 of the Signing Proposal; Recital 2 of the Conclusion Proposal; Article 1 of the Annex to the Signing Proposal. 8 See, for example: Agreement between the European Community and the Government of the United States of America regarding the application of their competition laws (OJ L 95, 27.4.95, pp. 47-52 as corrected by OJ L 131, 15.6.95, pp. 38- 39); Agreement between the European Communities and the Government of Canada regarding the application of their competition laws (OJ L 175, 10.07.1999); Agreement between the European Community and the Government of Japan concerning cooperation on anticompetitive activities (OJ L 183 , 22/07/2003, pp. 12-17); Agreement between the European Community and the Government of the Republic of Korea concerning cooperation on anticompetitive activities (OJ L 202, 04.08.2009, pp. 36-41); Agreement between the European Union and the Swiss Confederation concerning cooperation on the application of their competition laws (OJ L 347, 3.12.2014, pp. 3-9). 9 Formal comments of the EDPS on the Recommendation for a Council Decision authorising the opening of negotiations on an agreement between the European Union and United Kingdom of Great Britain and Northern Ireland on cooperation and exchange of information in competition matters, 5 July 2021. 10 Article 6(1) of the Annex to the Signing Proposal. 11 “Personal data may be shared under this Agreement only if the transmitting and receiving competition authorities were or are investigating, or intend to investigate, the subject-matter for which the personal data were initially obtained.” 12

text: Article 5(1)

text: (b) GDPR and

text: Article 4(1)

text: (b) EUDPR. 5

text: Towards a Digital Clearinghouse 2.0 EDPS Concept Note ‘ ’, 15 January 2025, paragraphs 59 and 61.

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016. Chapter V of the GDPR provides for the following grounds for transfer: transfers on the basis of an adequacy decision (

text: Article 45

text: ), transfers subject to appropriate safeguards (

text: Article 46

text: ), binding corporate rules (

text: Article 47

text: ) and derogations for specific situations (

text: Article 49

text: ). Chapter V of the EUDPR provides for the following grounds for transfer: transfers on the basis of an adequacy decision issued under the GDPR (

text: Article 47

text: Article 48

text: ), and derogations for specific situations (

text: Article 50

text: ). Commission Implementing Decision

text: (EU) 2021/1772

text: of 28 June 2021 pursuant to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom (notified under document C(2021)4800), C/2021/4800, OJ L 360, 11.10.2021, p. 1–68 (the ‘UK GDPR adequacy decision’). As laid down in Article 4 of the Commission Implementing Decision, the Decision “shall expire on 27 June 2025, unless extended in accordance with the procedure referred to in

text: Article 93(2) of Regulation (EU) 2016/679

text: .” On 18 March 2025, the European Commission issued a draft implementing decision amending the UK GDPR adequacy decision to extend its validity until 27 December 2025. On 5 May 2025, the European Data Protection Board issued Opinion 06/2025 regarding the extension of the European Commission Implementing Decisions under the GDPR and the LED on the adequate protection of personal data in the United Kingdom, under

text: Article 70(1)

text: (s) of the GDPR. On 24 June 2025, the Commission issued the final implementing decision extending the UK GDPR adequacy decision: Commission Implementing Decision of 24.6.2025 amending Implementing Decision

text: (EU) 2021/1772

text: of 28 June 2021 pursuant to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom, C(2025) 3928 final.

text: Formal comments of the EDPS on the Recommendation for a Council Decision authorising the opening of negotiations on an agreement between the European Union and United Kingdom of Great Britain and Northern Ireland on cooperation and exchange of information in competition matters, 5 July 2021, p. 3. 7

identifier: EDPS yttrande 13/2025

title: Opinion 13/2025 on Proposals for Council Decisions on the signing and conclusion of the Agreement between the European Union and the United Kingdom of Great Britain and Northern Ireland regarding cooperation on the application of their competition laws

text: on the Proposals for Council Decisions on the signing and conclusion of the Agreement between the European Union and the United Kingdom of Great Britain and Northern Ireland regarding cooperation on the application of their competition laws

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to (i) the Proposal for a Council Decision on the signing, on behalf of the European Union, of the Agreement between the European Union and the United Kingdom of Great Britain and Northern Ireland regarding cooperation on the application of their competition laws and (ii) the Proposal for a Council Decision on the conclusion, on behalf of the European Union, of the Agreement between the European Union and the United Kingdom of Great Britain and Northern Ireland regarding cooperation on the application of their competition laws. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposals that are relevant from a data protection perspective.

text: Executive Summary

text: The EDPS is consulted by the Commission on its Proposals for Council Decisions on the signing and conclusion, on behalf of the European Union, of the Agreement between the European Union and the United Kingdom of Great Britain and Northern Ireland regarding cooperation on the application of their competition laws.

text: The objective of the agreement - which the EDPS welcomes - is to promote and provide a framework for cooperation and coordination in competition matters between the competition authorities of the EU and its Member States, of the one part, and of the UK, of the other part, with a view to the more effective enforcement of the competition laws of the EU and of the UK.

text: The EDPS welcomes that the agreement states that competition authorities in the EU may only share information with the UK competition authority to the extent that the sharing of that information is lawful under applicable EU data protection law.

text: The EDPS notes that information obtained by EU competition authorities from the UK competition authority may potentially be relevant for the opening of investigations by authorities competent for other fields within their respective mandates. Information sharing across regulatory silos is particularly important to foster cross-regulatory cooperation and consistency of enforcement actions in the EU.

text: The transfer of personal data from EU competition authorities to the UK competition authority does not require specific authorisations nor safeguards under Chapter V of Regulation 2016/679 and Chapter V of Regulation 2018/1725, by virtue of

text: Commission Decision (EU) 2021/1772

text: . Therefore, the EDPS recommends including a reference to Commission Implementing Decision

text: (EU) 2021/1772

text: Contents

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 19 May 2025, the European Commission issued:  a Proposal for a Council Decision on the signing, on behalf of the European Union, of the Agreement between the European Union and the United Kingdom of Great Britain and Northern Ireland regarding cooperation on the application of their competition laws (‘the Signing Proposal’) ; and  a Proposal for a Council Decision on the conclusion, on behalf of the European Union, of the Agreement between the European Union and the United Kingdom of Great Britain and Northern Ireland regarding cooperation on the application of their competition laws (‘the Conclusion Proposal’) .

text: 2. The objective of the Signing Proposal is to authorise the signing, on behalf of the Union, of the Agreement between the European Union and the United Kingdom of Great Britain and Northern Ireland regarding cooperation on the application of their competition laws (‘the Agreement’) .

text: 3. The objective of the Conclusion Proposal is to approve the Agreement , which is presented as an Annex of both the Signing and Conclusion Proposals.

text: 4. The purpose of the new Agreement is to give effect and supplement the rules on cooperation and coordination in the field of competition law and enforcement contained in the Trade and Cooperation Agreement between the EU and the United Kingdom of Great Britain and Northern Ireland (‘TCA’), in particular Article 361(4) of the TCA. It does so by promoting and providing a framework for cooperation and coordination in competition matters between the competition authorities of the EU and its Member States, of the one part, and of the UK, of the other part, with a view to the more effective enforcement of the competition laws of the EU and of the UK . The EU has entered into several other international agreements with other third countries pursuing similar objectives .

text: 5. The EDPS welcomes the objective of the Agreement, namely to promote and provide a framework for cooperation and coordination in competition matters between the competition authorities of the EU and its Member States, of the one part, and of the UK, of the other part, with a view to the more effective enforcement of the competition laws of the EU and of the UK.

text: 6. The EDPS was previously consulted and issued formal comments on the Recommendation for a Council Decision authorising the opening of negotiations on an agreement between the European Union and United Kingdom of Great Britain and Northern Ireland on cooperation and exchange of information in competition matters . On 8 June 2023, the Council authorised the Commission to open negotiations towards an agreement with the UK on cooperation and exchange of information in competition matters. The negotiations were concluded at technical level in October 2024.

text: 7. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 20 May 2025, pursuant to Article 42(1) of the EUDPR. The EDPS welcomes the reference to this consultation in Recital 6 of the Signing Proposal and in Recital 5 of the Conclusion Proposal.

text: 2. Sharing and use of information

text: 8. The EDPS welcomes the inclusion in the Agreement of a reference to the fact that competition authorities in the EU may only share information with the UK competition authority, to the extent that the sharing of that information is lawful under applicable law, including that on confidentiality and data protection .

text: 9. The EDPS recommends clarifying the meaning of the restriction on the sharing of personal data under Article 6(6) of the Agreement . In particular, by referring to the “subject-matter” in the wording of the provision, the Agreement may unduly limit the extent to which competition authorities in the EU and the UK can share personal data in the course of their investigations. Therefore, the EDPS recommends referring instead to the “purpose” for which the personal data were initially obtained, which would also be more aligned with the principle of purpose limitation .

text: 10. The EDPS takes note of the information sharing limitation under Article 6(4) of the Agreement. The provision would limit the possibilities of competition authorities in the EU to share information obtained from the competition authority of the UK with other authorities in their Member State, without the prior written approval of competition authority of the UK. The EDPS notes that EU or Member State law may provide (currently or in the future) requirements for the exchange of case-related information between competition authorities and authorities competent in other fields (such as data protection supervisory authorities) . Information obtained by EU competition authorities from the UK competition may potentially be relevant for the opening of investigations by authorities competent for other fields within their respective mandates, as well as to ensure consistency of enforcement actions across regulatory silos.

text: 3. International transfers of personal data

text: 11. Any transfer of information containing personal data from the European Commission (in its capacity of competition authority of the EU) and competition authorities of EU Member States to the competition authority of the UK encompasses an international transfer of personal data in the meaning of Chapter V of

text: Regulation (EU) 2016/679

text: (hereinafter ‘the GDPR’) and Chapter V of the EUDPR. Therefore, such transfer needs to rely on one of the grounds for transfers provided by Chapter V of the GDPR (in case personal data is transferred by competition authorities of EU Member States) or Chapter V of the EUDPR (in case personal data is transferred by the European Commission).

text: 12. On 28 June 2021, the Commission adopted a decision recognizing that the United Kingdom ensures an adequate level of protection for personal data transferred within the scope of the GDPR from the European Union to the United Kingdom (the ‘adequacy decision’). 6

text: 13. As previously highlighted by the EDPS , the Agreement would not as such provide for a ground for transfers of personal data within the meaning of the GDPR and the EUDPR for the purpose of administrative cooperation in competition matters. Instead, such a ground for transfers would be provided by the adequacy decision mentioned above.

text: 14. The EDPS welcomes that the preamble of the Agreement and the Explanatory Memoranda of both Signing and Conclusion Decisions refer to the adequacy decision. The transfer of personal data by competition authorities in the EU to the competition authority of the UK would be covered by the adequacy decision. Therefore, the EDPS recommends including a reference to the adequacy decision in a recital of both the Signing and the Conclusion Proposals as allowing the lawful transfer of personal data from competition authorities in the EU to the competition authority of the UK.

text: 4. Conclusions

text: 15. In light of the above, the EDPS makes the following recommendations: (2) including a reference to Commission Implementing Decision

text: (EU) 2021/1772

text: in a recital of both the Signing and the Conclusion Proposals. Brussels, 15 July 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI


text: COM(2025) 747 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2025) 747 final. 4 COM(2025) 747 final, p. 3. Ibid. 6 Ibid. 7 EDPS Opinion on the Proposal for a Regulation amending

text: Regulation (EC) No 273/2004

text: on drug precursors and the Proposal for a Regulation amending

text: Council Regulation (EC) No 111/2005

text: laying down rules for the monitoring of trade between the Community and third countries in drug precursors, issued 18 January 2013. 8 Recital 6 of the Proposal. 4

text: Recital 5 of the Proposal. 10 Ibid. See also the United Nations Convention against Illicit Traffic in Narcotic Drugs and Psychotropic Substances adopted in Vienna on 19 December 1988, and the Council Decision of 22 October 1990 concerning the conclusion, on behalf of the European Economic Community, of the United Nations Convention against Illicit Traffic in Narcotic Drugs and Psychotropic Substances (OJ L 326, 24.11.1990, p. 56, ELI: http://data.europa.eu/eli/dec/1990/611/oj). 11 Operators are defined in Article 2(26) of the Proposal as ‘any natural or legal person making available on the market, possessing or using drug precursors or any external trader of such precursors’. External traders are defined in

text: Article 2(27)

text: as any importer, exporter or intermediary of drug precursors. 12

text: Article 7(1)

text: (c) of the Proposal. 13

text: Article 8(2)

text: (c) of the Proposal. 14 Article

text: and Annex IV of the Proposal. 5

text: Article 35(1) of the Proposal. 16 Article 35(2) of the Proposal. 17 COM(2025) 747 final, p. 86 and following (Legislative Financial and Digital Statement, section 4.2 ‘Data flows’). 18 See Article 2(26) of the Proposal. 19 Annex IV(1)(a) of the Proposal. 20 Annex V (1)(a) of the Proposal. 21 Annex IV(1)(d) of the Proposal. 22 Annex V (1)(d) of the Proposal. 23 Annex IV(1)(m) of the Proposal. 6

text: Annex IV(3)(b) of the Proposal. 25 Annex IV(6) of the Proposal. 26 Annex V (4) of the Proposal. 27 This information may already constitute personal data when identifiers of a natural person are in the case file in the electronic system. 28 Article 35(5) of the Proposal. 29 The EDPS notes it has previously issued EDPS Formal comments on a Proposal for a Regulation of the European Parliament and of the Council establishing the European Union Single Window Environment for Customs and amending

text: Regulation (EU) No 952/2013

text: , issued 20 November 2020; and EDPS Formal comments on the Implementing and Delegated Acts establishing the EU Single Window Environment for Customs, issued 31 May 2024. 30 Article 23(6) of the Proposal. 31 COM(2025) 747 final, p. 81 and following (Legislative Financial and Digital Statement, section 4.1 ‘Requirements of digital relevance’). 7

text: Article 22(3)

text: GDPR. 33 ‘Operator’ is defined in Article 2(26) of the Proposal as any natural or legal person making available on the market, possessing or using drug precursors or any external trader of such precursors. Additionally, ‘external trader’ is defined in

text: Article 2(27)

text: as any importer, exporter, or intermediary of drug precursors. 34 Article 35(1) of the Proposal. 35 See also EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR, issued on 7 July 2021. 36 See also EDPS Guidance for co-legislators on key elements of legislative proposals, issued on 7 May 2025, para 28-35. 8

text: COM(2025) 747 final, p. 81 and following (Legislative Financial and Digital Statement, section 4.1 ‘Requirements of digital relevance’). 38 Ibid. 39 Article 35(5) of the Proposal. 40 Recital 25 of the Proposal. See also Article 25 of the Proposal, which requires the European Union Drugs Agency to establish a Drug Precursors Information Repository. 9

identifier: EDPS yttrande 13/2026

title: EDPS Opinion 13/2026 on the Proposal for a Regulation on monitoring and controlling drug precursors and repealing Regulations (EC) No 273/2004 and (EC) No 111/2005

text: Opinion 13/2026

text: (EC) No 273/2004

text: and

text: (EC) No 111/2005

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on monitoring and controlling drug precursors and repealing Regulations

text: (EC) No 273/2004

text: and

text: (EC) No 111/2005

text: .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: (EC) No 273/2004

text: and

text: (EC) No 111/2005

text: The objective of the Proposal is to address the challenge of preventing the use of drug precursors in the illicit manufacture of drugs, whilst simplifying rules and procedures for legitimate trade. It also aims to increase digitalisation and automate several obligations, aiming to significantly reduce the costs and administrative burden for operators and Member State national authorities.

text: Under the Proposal, the Commission must establish and maintain a centralised electronic system for the submission, storage, processing, decision-making, and exchange of information for the monitoring and control of drug precursors.

text: The EDPS welcomes that the Proposal includes a specific provision concerning the protection of personal data. To facilitate the effective exercise of data subject rights, the EDPS recommends clarifying the roles of the Commission and Member States as controller, joint controller, or processor in relation to the centralised electronic system. The Proposal would require the Commission to adopt an implementing act to establish implementing arrangements for the electronic system. The EDPS recommends that this implementing act also address the interconnection of various systems envisioned by the Proposal, particularly the interoperability of these systems, the exchange of data and relevant data protection safeguards.

text: The EDPS notes that the electronic system would enable competent authorities to make decisions regarding the issuance of a license to an operator, including the refusal, revocation or suspension of a license. The EDPS recommends stipulating that the possibilities of appeal under national law shall be explicitly mentioned in any decision to refuse, revoke or suspend a license, or an order to suspend or cease activities.

text: Finally,

text: Articles 23(3)

text: and (4) of the Proposal require customs authorities to conduct verification activities prior to releasing substances for a customs procedure or re-export. The Proposal envisions that these verifications would be conducted automatically. The EDPS recommends defining suitable measures to safeguard the rights and freedoms and legitimate interests of data subjects in cases of automated individual decision-making.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 3 December 2025, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on monitoring and controlling drug precursors and repealing Regulations

text: (EC) No 273/2004

text: and

text: (EC) No 111/2005

text: (‘the Proposal’).

text: 2. The objective of the Proposal is to address the challenge of preventing the use of drug precursors in the illicit manufacture of drugs, whilst simplifying rules and procedures for legitimate trade . The introduction of specific rules on designer precursors and innovative means for their inclusion aims to allow for quicker action to prevent their diversion .

text: 3. The Proposal would also increase digitalisation and automate several obligations, aiming to significantly reduce the costs and administrative burden for operators and Member State national authorities .

text: 4. The EDPS previously issued an Opinion on the Proposal for a Regulation amending

text: Regulation (EC) No 273/2004

text: on drug precursors, which governs the monitoring of intra-EU trade, and the Proposal for a Regulation amending

text: Council Regulation (EC) No 111/2005

text: laying down rules for the monitoring of trade between the Community and third countries in drug precursors, which governs the control of external trade . The current Proposal merges

text: Regulation (EC) No 273/2004

text: and

text: Regulation (EC) No 111/2005

text: into one Regulation .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 11 June 2026, pursuant to Article 42(1) of EUDPR.

text: 2. General remarks

text: 6. The EDPS welcomes the Proposal’s objectives of better addressing the developments in the illicit manufacture of drugs, in particular the proliferation of designer precursors . The EDPS also welcomes that this Proposal aims to give effect to the obligations deriving from Article 12 of the United Nations Convention against Illicit Traffic in Narcotic Drugs and Psychotropic Substances .

text: 7. The EDPS notes that the measures established by the Proposal imply the processing of personal data of operators . The Proposal, for example, obliges operators to document information relating to each transaction, including the names and addresses of other operators involved in the transaction ; to notify competent authorities of suspicious transactions, significant disappearances and thefts of scheduled drug precursors and subsequently to provide available information to the competent authorities including names and addresses of operators involved in the supply chain ; and operators must obtain a license from the competent authorities, for which application requires information such as the name and contact details of the operator, including their postal and electronic address and telephone number .

text: 8. Considering both Member States and the Commission will process personal data in the context of their use of the central electronic system established in Article 35 of the Proposal, both the GDPR and EUDPR are applicable. The EDPS welcomes that Recital 26 of the Proposal specifies that the processing of personal data must be carried out in compliance with the provisions of the GDPR or the EUDPR, within their respective scope of application.

text: 9. The EDPS also welcomes the reference in Article 28(2) of the Proposal, requiring that competent authorities protect personal data in accordance with Union and national law.

text: 10. The EDPS notes that there is no reference in the Proposal to the consultation of the EDPS in accordance with

text: Article 42(1)

text: EUDPR and recommends including such a reference in a recital to the Proposal.

text: 3. Drug precursors electronic system

text: 11. Article 35(1) of the Proposal provides that the Commission must establish and maintain a centralised electronic system for the submission, storage, processing, decision-making, and exchange of information for the monitoring and control of drug precursors in accordance with the Proposal . The Commission must establish the electronic system to be capable of the following functions: a. To enable operators to: i. register in the system in order to perform formalities set out in the Proposal; ii. request a license in accordance with Article

text: and

text: ; iii. make the registration required by Article

text: and

text: ; iv. file a prior notification in accordance with

text: Article 17(2)

text: ; v. verify in accordance with Article

text: and

text: that other operators hold a licence or made a prior notification; vi. notify quantities to competent authorities in accordance with Articles

text: and

text: ; b. To enable operators and providers of online marketplaces to report on suspicious transactions in accordance with Article 8 of the Proposal; c. To enable competent authorities to: i. issue, suspend or revoke a licence; ii. order operators to suspend or cease activities covered by a registration or a prior notification, in accordance with

text: Article 15(5)

text: or

text: Article 17(5)

text: respectively; iii. provide information in accordance with Article

text: and

text: ; d. To facilitate the preparation of the report to the International Narcotic Control Board in accordance with

text: Article 34

text: , by the Commission in consultation with Member States .

text: 12. The EDPS notes that the accompanying documents to the Proposal include a mapping of the data flows envisioned by the Proposal . The EDPS takes note that only data of responsible officers in charge of licenses, self-registration or prior notification is referred to as being ‘personal data’. The EDPS recalls that in addition to the data relating to responsible officers, the information required for the application for a license pursuant to Article

text: and

text: , registration pursuant to

text: Article 9(7)

text: and

text: Article 15

text: , and prior notification pursuant to

text: Article 17(2)

text: may involve the personal data of operators (including external traders), which may be natural persons . This information includes, for example, the name and contact 1920 details of the operator, including postal and electronic address, and telephone number ; 2122 the name of the responsible officer appointed and their contact details ; and a certificate of good conduct of the operator and the responsible officer . Furthermore, when personal data is associated with an application or other type of procedure where it cannot be separated at the time of collection, the entire data set should be treated as personal data.

text: 13. The competent authority may issue a license through the electronic system after confirming that the operator demonstrates, among others, integrity by the absence of any serious infringements or repeated infringements in the field of drug precursors and the absence of a record of serious criminal offences . The decision to refuse or revoke a license, to suspend an existing license, or to order the suspension or cessation of activities in 25,26 accordance with

text: Article 15(5)

text: is also communicated through the electronic system . Each of those decisions must be motivated and subject to appeal under the conditions set out in the national law. For the avoidance of doubt, the EDPS recommends stipulating that the possibilities of appeal shall be explicitly mentioned in any decision to refuse or revoke a license, to suspend an existing license, or to order the suspension or cessation of activities.

text: 14. The EDPS notes that the decision by a competent authority to refuse or revoke a license, to suspend an existing license, or to suspend or cease activities in accordance with

text: Article 15(5)

text: may contain or refer to personal data, particularly when that decision is based upon findings that a prior serious infringement or serious criminal offence by a natural person acting as operator exists . The EDPS recalls that any processing of personal data relating to criminal convictions and offences is subject to compliance with Article 10 of the GDPR and Article 11 of the EUDPR. In this regard, the EDPS welcomes that the Proposal includes a specific provision concerning the protection of personal data (subject to the recommendations provided below).

text: 15. The Proposal also requires that the Commission interconnect the electronic system with the EU Single Window Environment for Customs (‘EU CSW-CERTEX’), established by 2829

text: Regulation (EU) 2022/2399

text: . The EDPS understands that, through the electronic system established in Article 35 of the Proposal, the EU eLicensing central portal for licenses and registrations would be connected to the EU CSW-CERTEX and would contain information on substances, validity, quantity and whether exemptions apply, enabling the automation of the authorisation process. The EDPS notes in particular that

text: Article 23(3)

text: and (4) of the Proposal require that customs authorities release a substance for a customs procedure or re-export only after verifying, at a minimum, that an active license, registration, or prior notification exists, where required, and that the quantities are within the thresholds established in Article 20 and 22 of the Proposal. The Proposal notes that the verifications referred to in

text: Article 23(3)

text: and (4) would be carried out automatically via the interconnection with the EU CSW-CERTEX from the date the interconnection is operational . The EDPS understands that the automatic, digital verification of operators by customs authorities would involve processing of personal data, for example, in the information about economic operators, applications, registrations or prior notifications or other documentation, including reports on suspicious transactions . The EDPS recalls that automated individual decision-making is subject to compliance with

text: Article 22

text: GDPR and the corresponding provisions of the EUDPR. The EDPS recommends defining suitable measures to safeguard the rights and freedoms and legitimate interests of data subjects in cases of automated individual decision-making, including at least the right to obtain human intervention on the part of the controller, to express their point of view, and to contest the decision .

text: 16. The EDPS understands that the electronic system established in Article 35 of the Proposal may also be used by external traders, which engage in the import and/or export of drug precursors . Considering that import and export of drug precursors involve the movement of non-Union goods in, and the movement of Union goods out, of the customs territory of the Union, the EDPS understands that the transfer and exchange of data by external traders via the electronic system may involve the transfer of data to third countries. On this basis, the EDPS recalls that all transfers of personal data to third countries must comply with Chapter V GDPR and the corresponding provisions of the EUDPR.

text: 4. Data protection in the context of the electronic system

text: 17. The EDPS welcomes that the Proposal includes a specific provision concerning the protection of personal data. Article 36 of the Proposal establishes that the processing of personal data within the electronic system will be carried out in compliance with the GDPR or EUDPR, as applicable. It further specifies that the processing of personal data under the Proposal within the electronic system will take place only for the purposes established by the Proposal. Access to personal data is limited to duly authorised staff of the Commission and other Union bodies, competent authorities and customs authorities to the extent necessary for the performance of their tasks under the Proposal. Those Union bodies and authorities must ensure the confidentiality and integrity of those data and protect them against unauthorised access, use or disclosure, in accordance with applicable Union data protection rules.

text: 18. The EDPS understands that the Commission is tasked, pursuant to Article 35 of the Proposal, with establishing and maintaining the electronic system for the submission, storage, processing, decision-making, and exchange of information for the monitoring and control of drug precursors . The EDPS recommends clarifying in Article 36 of the Proposal the roles and responsibilities applicable with respect to the processing of data in the context of the electronic system, in particular by clarifying the roles of the Commission and of the Member States as controller, joint controller or processor. These roles should be attributed in alignment with Chapter IV of the GDPR and the corresponding provisions of the EUDPR . Finally, the EDPS recalls that any relationship between (joint) controllers and processors must be governed by appropriate legal arrangements .

text: 5. Other specific comments

text: 19. The EDPS understands that the electronic system established by Article 35 of the Proposal is envisaged to be interconnected with, or to facilitate connections between, various other systems or portals based in the Union, including national export and import systems of 37; 38 Member States the EU eLicensing central portal for licenses and registrations ; the EU 39; 40 CSW-CERTEX and the Drug Precursors Information Repository . The EDPS also understands that

text: Article 35(8)

text: requires the Commission to adopt an implementing act establishing the implementing arrangements for the development and operation of the electronic system, including technical specifications and the procedures to be followed for the implementation of Articles 6, 8, 9, 13, 15, 17, 18, 19(1), 20, 21, 22, 23, 32, 33 and 34 of the Proposal.

text: 20. The EDPS takes note that the implementing act mentioned in

text: Article 35(8)

text: does not envisage establishing the arrangements for the interconnection, or the facilitation of connections, between the various systems or portals mentioned above. The EDPS recommends that Article 35(8) of the Proposal be amended to require that the interconnection of these systems must also be addressed by this implementing act. This should include clarifications on how the interoperability of these systems is envisioned, the types of data that will be transmitted between them, and the safeguards in place to ensure the safety and security of that data, particularly personal data. The EDPS also takes this opportunity to recall the obligation in Article 32 of the GDPR and the corresponding provision of the EUDPR to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

text: 21. Recital 28 of the Proposal states that the implementing powers conferred on the Commission to determine the implementing arrangements for the electronic system should include the rules for the protection, safety and security of personal data. The EDPS notes, however, that Article 35(8) of the Proposal, which obliges the Commission to adopt this implementing act, makes no reference to the implementation of

text: Article 36

text: on data protection. The EDPS recommends specifying also in

text: Article 35(8)

text: that the implementing act will include the specifications and procedures needed to implement the data protection safeguards specified under Article 36 of the Proposal in the context of the electronic system. The EDPS recalls that if delegated or implementing acts provide for the processing of personal data, the EDPS should be consulted pursuant to

text: Article 42(1)

text: EUDPR.

text: 6. Conclusions

text: 22. In light of the above, the EDPS makes the following recommendations: (1) to add a recital to the Proposal referring to the consultation of the EDPS in accordance with

text: Article 42(1)

text: EUDPR; (2) to specify that the possibilities of appeal shall be explicitly mentioned in any decision to refuse or revoke a license, to suspend an existing license, or to order the suspension or cessation of activities; (3) to define the safeguards applicable to any automated individual decision-making in the context of

text: Article 23(3)

text: and (4) of the Proposal; (4) to clarify in Article 36 of the Proposal the roles and responsibilities applicable to the processing of personal data in the context of the electronic system established by Article 35 of the Proposal, including by defining the controller and processor roles in alignment with Chapter IV of the GDPR and corresponding provisions of the EUDPR; (5) to amend Article 35(8) of the Proposal to require that the implementing act also address the interconnection and interoperability of various systems with the central electronic system established by Article 35 of the Proposal; (6) to specify in Article 35(8) of the Proposal that the envisioned implementing act should implement the arrangements for the electronic system relating to the protection, safety and security of personal data as indicated by Recital 28 of the Proposal. Brussels, 23 July 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 10