identifier: EDPS yttrande (2021)

publisher: Europeiska datatillsynsmannen

sprak: en

title: Authorising the opening of negotiations for a cooperation between the EU & INTERPOL

serie: yttranden

type: stycke

text:   11

type: vagledning

utgivare: edps


title: EDPS Opinion on the Proposal for a Regulation on Markets in Crypto-assets, and amending Directive (EU) 2019/1937

text: 1 BACKGROUND

type: rubrik

text: 2 GENERAL COMMENTS

text: 3 SPECIFIC COMMENTS

text: 3.1 The roles and responsibilities of issuers under the GDPR

text: 3.2 Regarding the content of the crypto-asset white paper

text: 3.3 Publications of decisions imposing administrative penalties

text: 3.4 Administrative cooperation between competent authorities, the EBA and ESMA, as well as cooperation with oversight authorities in third countries

text: 4 CONCLUSIONS


title: Proposal for a Council Regulation on the establishment and operation of an evaluation and monitoring mechanism to verify the application of the Schengen acquis


amnesord:
Money laundering
Counter-terrorism

title: Anti-money laundering and countering the financing of terrorism

text:       17


identifier: EDPS yttrande (2022)

title: EDPS Opinion on the Proposal for Regulation on the transparency and targeting of political advertising


title: EDPS Opinion on the two Proposals for Council Decisions authorising Member States to sign and to ratify in the interest of the EU the Second Additional Protocol to the Convention on Cybercrime on enhanced cooperation and disclosure of electronic evidence

text: o o o o

text:   o o 


title: EDPS Opinion on Intelligent Transport Systems


title: EDPS Opinion on the Proposal for a Regulation on automated data exchange for police cooperation


text: OJ L 295, 21.11.2018, p. 39. 2 Article 1 of the Signing Proposal. 3 g Article 1 of the Conclusion Proposal. 4 Article 2(1) of the draft Protocol. Fisheries Partnership Agreement between the European Union and the Republic of Mauritius, OJ L 79, 18.3.2014, https://eurlex.europa.eu/legalcontent/EN/TXT/?uri=uriserv%3AOJ.L_.2014.079.01.0003.01.ENG&toc=OJ%3AL%3A2014%3A079%3AT OC 4

text: Article 1 of the Regulation Proposal. 7 The EDPS notes that Recital 11 of the Signing Proposal refers to the ‘advice’ of the EDPS while Recital 5 of the Conclusion Proposal refers to the ‘opinion’ of the EDPS. The correct wording is ‘opinion’. 8

text: Council Decision 2014/146/EU of 28 January 2014

text: on the conclusion of the Fisheries Partnership Agreement between the European Union and the Republic of Mauritius (OJ L 79, 18.3.2014, p. 2). 9 Recital 2, 3 and 4 of the Signing Proposal. 10 Recital 5 of the Signing Proposal. 11 Recital 6 of the Signing Proposal. 12 See in particular point 15 and 16 of Chapter V of the Annex to the draft Protocol. 5

text: Council Regulation (EC) No 1005/2008 of 29 September 2008

text: establishing a Community system to prevent, deter and eliminate illegal, unreported and unregulated fishing, amending Regulations

text: (EEC) No 2847/93

text: (EC) No 1936/2001

text: and

text: (EC) No 601/2004

text: and repealing Regulations

text: (EC) No 1093/94

text: and

text: (EC) No 1447/1999

text: , OJ L 286, 29.10.2008, p. 1–32. 14 See Recital 42 of the IUU Regulation, referring to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (replaced by the EUDPR). 15

text: Regulation (EU) 2017/2403

text: of the European Parliament and of the Council of 12 December 2017 on the sustainable management of external fishing fleets, and repealing

text: Council Regulation (EC) No 1006/2008

text: , OJ L 347, 28.12.2017, p. 81–104. 16 Article 43 of the SMEFF Regulation: ‘1. When a Member State receives information from a third country or an RFMO which is relevant for the effective application of this Regulation, it shall communicate that information to the Commission or the body designated by it, and, where appropriate, to other Member States concerned, provided that it is permitted to do so under bilateral agreements with that third country or the rules of the RFMO concerned. 2.The Commission or the body designated by it may, in the framework of fisheries agreements concluded between the Union and third countries, under the auspices of RFMOs to which the Union is a contracting party, communicate relevant information concerning non-compliance with the rules of this Regulation, or serious infringements, to other parties to those agreements or organisations subject to the consent of the Member State that supplied the information and in accordance with

text: Regulation (EC) No 45/2001

text: Article 15(1) of the draft Protocol. 18 Article 15(3) of the draft Protocol. 19 See for instance Article 17 of the Protocol implementing the Sustainable Fisheries Partnership Agreement between the European Union and the Islamic Republic of Mauritania (OJ L 439, 8.12.2021, p. 3). 20 Article 15(4) of the draft Protocol: ‘Further safeguards and legal remedies with regard to personal data and data subject’s rights may be established by the Joint Committee’. 21

text: Article 48(2)

text: (a) EUDPR and

text: Article 46(2)

text: (a) GDPR. 22

text: Article 48(1)

text: EUDPR and

text: Article 46(1)

text: GDPR. 23 European Data Protection Board (EDPB) Guidelines 2/2020 on

text: articles 46 (2)

text: (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, issued on 15 December 2020. The same guidance also clarifies the safeguards required to be put in place by provisions to be inserted into administrative arrangements between public bodies, subject to authorisation from the competent supervisory authority. 7

identifier: EDPS yttrande 21/2022

amnesord:
Rights of the Individual
International Cooperation

title: Fisheries Partnership Agreement between the EU and the Republic of Mauritius

text: 24 October 2022 Opinion 21/2022 on the signing, provisional application and conclusion of the Protocol implementing the Fisheries Partnership Agreement between the European Union and the Republic of Mauritius

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to (i) the Proposal for a Council Decision on the signing, on behalf of the Union, and provisional application of a Protocol implementing the Fisheries Partnership Agreement between the European Union and the Republic of Mauritius (2022-2026) and (ii) the Proposal for a Council Decision on the conclusion of a Protocol implementing the Fisheries Partnership Agreement between the European Union and the Republic of Mauritius (2022-2026). This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the draft Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 28 September 2021, the Council authorised the Commission to open negotiations with the Republic of Mauritius for the conclusion of a new protocol implementing the Fisheries Partnership Agreement concluded between the EU and the Republic of Mauritius on 2014. Those negotiations were successfully concluded and a new protocol implementing the Fisheries Partnership Agreement for a period of 4 years was initialled on 7 May 2022.

text: The EDPS is now consulted on the Commission proposal to sign and conclude the protocol. The EDPS welcomes the inclusion of

text: Article 15

text: on data protection in the draft protocol, which reinforces the level of protection for data subjects. In particular, the EDPS welcomes the clarification that the data will be processed exclusively for the implementation of the draft Protocol and that personal data shall not be kept beyond the time necessary for which the exchange was made. The EDPS nevertheless recommends to make use of the joint committee (made of representatives of the EU and of the Republic of Mauritius) to further detail these data protection safeguards and to establish appropriate safeguards, enforceable data subject rights and effective legal remedies, allowing for personal data to be transferred in compliance with the GDPR/EUDPR.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of natural persons with regard to the processing of personal data by the EU institutions, bodies, offices and agencies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 16 September 2022, the European Commission (‘the Commission’) issued: - a Proposal for a Council Decision on the signing, on behalf of the Union, and provisional application of a Protocol implementing the Fisheries Partnership Agreement between the European Union and the Republic of Mauritius (2022-2026) (‘the Signing Proposal’); - a Proposal for a Council Decision on the conclusion of a Protocol implementing the Fisheries Partnership Agreement between the European Union and the Republic of Mauritius (2022-2026) (‘the Conclusion Proposal’); and - a Proposal for a Council Regulation on the allocation of fishing opportunities under the Protocol implementing the Fisheries Partnership Agreement between the European Union and the Republic of Mauritius (2022-2026) (‘the Regulation Proposal’).

text: 2. The objective of the Signing Proposal is to approve on behalf of the Union, the signing of the Protocol implementing the Fisheries Partnership Agreement between the European Union and Mauritius (2022-2026) (‘the draft Protocol’), in accordance with

text: Article 43(2)

text: in conjunction with

text: Article 218(5)

text: TFEU .

text: 3. The objective of the Conclusion Proposal is to approve the draft Protocol, in accordance with

text: Article 43(2)

text: in conjunction with

text: Article 218(6)

text: (a)(v) and (7) TFEU .

text: 4. The objective of the draft Protocol is to implement the provisions of the Fisheries Partnership Agreement between the Republic of Mauritius and the European Union (‘the Fisheries Partnership Agreement) .

text: 5. The objective of the Regulation Proposal is to allocate among the EU Member States the fishing opportunities established under the draft Protocol .

text: 6. The present Opinion of the EDPS is issued in response to a consultation by the Commission of 23 September 2022, pursuant to Article 42(1) of EUDPR and relating to the Signing Proposal and the Conclusion Proposal. The Regulation Proposal was communicated to the EDPS for information only. The EDPS welcomes the reference to this consultation in Recital 11 of the Signing Proposal and Recital 5 of the Conclusion Proposal. In this regard, the EDPS also positively notes that he was previously informally consulted on the draft Protocol pursuant to Recital 60 of EUDPR.

text: 2. General remarks

text: 7. On 28 January 2014, the Council adopted a decision on the conclusion of the Fisheries Partnership Agreement between the European Union and the Republic of Mauritius .

text: 8. A first protocol to the Fisheries Partnership Agreement set out, for a period of 3 years, the fishing opportunities granted to Union vessels in the fishing zone in the Republic of Mauritius waters and the financial contribution granted by the EU. The period of application of that protocol expired on 27 January 2017 and it was then replaced by a second protocol. The period of application of that protocol expired on 7 December 2021 and an agreement in the form of an exchange of letters between the EU and the Republic of Mauritius was authorised by the Council and extended the application of the last protocol until 4 October 2022 .

text: 9. On 28 September 2021, the Council authorised the Commission to open negotiations with the Republic of Mauritius for the conclusion of a new protocol implementing the Fisheries Partnership Agreement . Those negotiations were successfully concluded and a new protocol implementing the Fisheries Partnership Agreement for a period of 4 years was initialled on 7 May 2022 .

text: 10. The draft Protocol should now be signed and approved on behalf of the EU.

text: 11. The EDPS recalls that data processed to prevent and fight against illegal fishing may constitute personal data relating to criminal convictions and offences, in which case appropriate safeguards for the rights and freedoms of data subjects should be provided, in accordance with

text: Article 11

text: EUDPR and/or

text: Article 10

text: GDPR . In this respect, the EDPS understands that, should such data be processed in the EU Member States, this processing will in any event have to comply with

text: establishing a Community system to prevent, deter and eliminate illegal, unreported and unregulated fishing (‘the IUU Regulation’) . The EDPS takes note and welcomes that:  the IUU Regulation clarifies that the EUDPR is fully applicable to the processing of personal data for the purposes of the IUU Regulation, in particular as regards the rights of data subjects to access, rectification, blocking and erasure of data and notification to third parties ; and  the IUU Regulation also provides for some specific safeguards. In particular, Article 27(2) of the IUU Regulation clarifies that, before placing any fishing vessel on the EU IUU vessel list, the Commission should provide the owner and, where appropriate, the operator of the fishing vessel concerned with a detailed statement of reasons for the intended listing and with all elements supporting the suspicion that the fishing vessel has carried out IUU fishing. The statement shall mention the right to ask for or to provide additional information, and give the owner, and, where appropriate, the operator the possibility of being heard and to defend their case, leaving them adequate time and facilities.

text: 12. Furthermore, the EDPS understands that the roles and responsibilities of the EU and of the Member States for issuing and managing fishing authorisations are laid down in

text: Regulation (EU) 2017/2403

text: Council Regulation (EC) No 1006/2008

text: (‘the SMEFF Regulation) . In this respect, the EDPS takes note that Title IV and in particular Article 43 of the SMEFF Regulation on relations with third countries and Regional Fisheries Management Organisations (RFMOs) clarify, to a certain extent, the roles and responsibilities of the Commission and the Member States regarding the exchange of information with third countries and RFMOs .

text: 3. Data protection safeguards

text: 13. The EDPS welcomes the inclusion of a specific provision on data protection in Article 15 of the draft Protocol. This article reinforces the level of protection for data subjects. In particular, the EDPS welcomes the clarification that the data will be processed exclusively 6 for the implementation of the draft Protocol and that personal data shall not be kept beyond the time necessary for which the exchange was made .

text: 14. The EDPS notes that the following provisions, successfully negotiated in the case of similar protocols implementing fisheries agreements , are not included in the draft Protocol: - a clear indication of the categories of personal data that will be processed; - the identification of a specific storage retention period and the obligation to anonymise the remaining personal data after a certain period.

text: 15. In this context, the EDPS notes that Article 15(4) of the draft Protocol provides that further safeguards and legal remedies with regard to personal data and data subject’s rights may be established by a joint committee i.e. a committee made up of representatives of the EU and the Republic of Mauritius (‘the Joint Committee’) .

text: 16. Therefore, the EDPS recommends making use of this possibility so that the data protection safeguards of Article 15 of the draft Protocol be further detailed. This should aim, in particular, to have a clear indication of the categories of personal data that will be processed and to identify a specific storage retention period and lay down an obligation to anonymise the remaining personal data after a certain period.

text: 4. International transfers of personal data

text: 17. The EDPS recalls that in the absence of an adequacy decision, transfers of personal data to a third country may be based on a legally binding and enforceable instrument between public authorities or bodies . In such case, such instrument should provide appropriate safeguards and ensure that enforceable data subject rights and effective legal remedies for data subjects are available .

text: 18. The EDPB has clarified what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies .

text: 19. Among those requirements, the EDPS points out in particular to the obligation to provide for redress mechanisms, supervision mechanisms, data subjects rights or restrictions on onward transfers and sharing of data.

text: 20. In view of the above, it is apparent that the draft Protocol does not meet all the requirements to be considered, within the meaning of the GDPR/EUDPR, as a legally binding and enforceable instrument between public authorities or bodies on which the transfer of personal data could be based.

text: 21. However, the EDPS notes that Article 15(4) of the draft Protocol provides that further safeguards and legal remedies may be established by the Joint Committee. In this respect, the EDPS recommends that the Joint Committee indeed establishes appropriate safeguards, enforceable data subject rights and effective legal remedies, allowing thus for personal data to be transferred in compliance with the GDPR/EUDPR. In doing so, the EDPS recommends the Commission to take due account of the EDPB Guidelines 2/2020 on

text: Articles 46(2)

text: 5. Conclusions

text: 22. In light of the above, the EDPS makes the following recommendations: (1) to make use of the Joint Committee to further detail the data protection requirements of Article 15 of the draft Protocol. This should aim, in particular, to have a clear indication of the categories of personal data that will be processed and to identify a specific storage retention period and lay down an obligation to anonymise the remaining personal data after a certain period. (2) to make use of the Joint Committee to establish appropriate safeguards, enforceable data subject rights and effective legal remedies, allowing for personal data to be transferred in compliance with the GDPR/EUDPR. In doing so, the EDPS recommends the Commission to take due account of the EDPB Guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies. Brussels, 24 October 2022 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8


text: OJ L 295, 21.11.2018, p. 39. 2 COM(2023) 218 final. 3 COM(2023) 219 final. 4 Article 1 of the Signing Proposal. Article 3 and 4 of the Signing Proposal. 6 Article 1 of the Conclusion Proposal. 7 Article 2 of the Partnership Agreement. 4

text: Article 2 of the Protocol. 9 Recital 1 of the Signing Proposal. 10 Recital 2 and 3 of the Signing Proposal. 11 Recital 4 of the Signing Proposal. 12

text: Regulation (EU) 2017/2403

text: of the European Parliament and of the Council of 12 December 2017 on the sustainable management of external fishing fleets, and repealing

text: Council Regulation (EC) No 1006/2008

text: , OJ L 347, 28.12.2017, p. 81. 13 Article 43 of the SMEFF Regulation: ‘1. When a Member State receives information from a third country or an RFMO which is relevant for the effective application of this Regulation, it shall communicate that information to the Commission or the body designated by it, and, where appropriate, to other Member States concerned, provided that it is permitted to do so under bilateral agreements with that third country or the rules of the RFMO concerned. 2.The Commission or the body designated by it may, in the framework of fisheries agreements concluded between the Union and third countries, under the auspices of RFMOs to which the Union is a contracting party, communicate relevant information concerning non-compliance with the rules of this Regulation, 5

text: or serious infringements, to other parties to those agreements or organisations subject to the consent of the Member State that supplied the information and in accordance with

text: Regulation (EC) No 45/2001

text: .’ 14 Article 16(1) of the Protocol. 15 Article 16(3) of the Protocol. 16

text: Article 48(2)

text: (a) EUDPR and

text: Article 46(2)

text: (a) GDPR. 17

text: Article 48(1)

text: EUDPR and

text: Article 46(1)

text: GDPR. 18 European Data Protection Board (EDPB) Guidelines 2/2020 on

text: articles 46 (2)

text: (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, issued on 15 December 2020. The same guidance also clarifies the safeguards required to be put in place by provisions to be inserted into administrative arrangements between public bodies, subject to authorisation from the competent supervisory authority. 19 Para 31 of the EDPB Guidelines. 6

text: Para 33 of the EDPB Guidelines. 21 Para 36 of the EDPB Guidelines. 22 Para 36 of the EDPB Guidelines. 23 Section 2.7 of the EDPB Guidelines. 24 Para 54 of the EDPB Guidelines. 25 Para 55 of the EDPB Guidelines. 26 Para 57 of the EDPB Guidelines. 27 Para 59 of the EDPB Guidelines. 28 Para 64 of the EDPB Guidelines. 7

identifier: EDPS yttrande 21/2023

title: EDPS Opinion 21/2023 on the signing, conclusion and provisional application of a Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Madagascar and the Implementing Protocol thereto (2023-2027).

text: 1 June 2023

text: Opinion 21/2023

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to (i) the Proposal for a Council Decision on the signing, on behalf of the European Union, and provisional application of a Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Madagascar and the Implementing Protocol thereto (2023-2027) and (ii) the Proposal for a Council Decision on the conclusion, on behalf of the European Union, and provisional application of a Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Madagascar and the Implementing Protocol thereto (2023-2027). This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposals that are relevant from a data protection perspective.

text: Executive Summary

text: The EDPS is consulted on the Commission proposals to sign, conclude and provisionally apply a new Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Madagascar and its Implementing Protocol, whose main objective is to establish a partnership and a framework for legal, environmental, economic and social governance in the area of fisheries.

text: The EDPS welcomes the inclusion of a specific provision on data protection in Article 16 of the Protocol as well as the inclusion of Appendix 2 to the annex to the Protocol that usefully details the conditions and safeguards relating to the processing of personal data. For the purpose of transferring data, the EDPS nevertheless recommends to make use of the joint committee, consisting of representatives of the Union authorities and the Malagasy Ministry responsible for fisheries, to further detail these appropriate safeguards, enforceable data subject rights and effective legal remedies. In doing so, the EDPS recommends the Commission to take due account of the EDPB Guidelines 2/2020 on

text: Articles 46(2)

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 28 April 2023, the European Commission (‘the Commission’) issued:  a proposal for a Council Decision on the signing, on behalf of the European Union, and provisional application of a Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Madagascar and the Implementing Protocol thereto (2023-2027) (‘the Signing Proposal’) ; and  a proposal for a Council Decision on the conclusion, on behalf of the European Union, and provisional application of a Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Madagascar and the Implementing Protocol thereto (2023-2027) (‘the Conclusion Proposal’) .

text: 2. The objective of the Signing Proposal is (i) to authorise the signing, on behalf of the Union, of the Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Madagascar (‘the Partnership Agreement’) and the Implementing Protocol to the Partnership Agreement (2023-2027) (‘the Protocol’) and (ii) to provide for the provisional application of the Partnership Agreement and the Protocol .

text: 3. The objective of the Conclusion Proposal is to approve the Partnership Agreement and the Protocol .

text: 4. The objective of the Partnership agreement is to establish a partnership and a framework for legal, environmental, economic and social governance in the area of fisheries .

text: 5. The objective of the Protocol is to implement the provisions of the Partnership Agreement by laying down, in particular, the conditions governing access by Union vessels to Madagascar’s fishing zone and the cooperation provided for by the Partnership Agreement .

text: 6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 28 April 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 9 of the Signing Proposal and in Recital 8 of the Conclusion Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 7. The previous Fisheries Partnership Agreement between the European Community and the Republic of Madagascar entered into provisional application on 1 January 2007 along with its protocol setting out the fishing opportunities and financial contribution, which has been replaced several times .

text: 8. The previous protocol to the agreement expired on 31 December 2018 and on 4 June 2018 the Council adopted a Decision authorising the Commission to open negotiations with Madagascar for the conclusion of a new Sustainable Fisheries Partnership Agreement and a new protocol implementing that Agreement .

text: 9. Eight rounds of negotiations regarding the Partnership Agreement and its Protocol were held with Madagascar between July 2018 and October 2022. Following these negotiations, the Partnership Agreement and the Protocol were signed on 28 October 2022 .

text: 10. The Partnership Agreement and its Protocol should now be signed and approved on behalf of the EU.

text: 11. In this context, the EDPS understands that the roles and responsibilities of the EU and of the Member States for issuing and managing fishing authorisations are laid down in

text: Regulation (EU) 2017/2403

text: Council Regulation (EC) No 1006/2008

text: 3. Data protection safeguards

text: 12. The EDPS welcomes the inclusion of a specific provision on data protection in Article 16 of the Protocol. This article reinforces the level of protection for data subjects. In particular, the EDPS welcomes the clarification that:  the data exchanged in the framework of the Partnership Agreement are to be used by the competent authorities solely for the purpose of implementing the Partnership Agreement and, in particular, for the purpose of fisheries monitoring, control and surveillance ;  Personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject .

text: 13. The EDPS also welcomes the inclusion of Appendix 2 to the Annex to the Protocol that usefully details the conditions and safeguards relating to the processing of personal data (please refer to Section 4 of these comments for further details).

text: 14. The EDPS recalls that in the absence of an adequacy decision, transfers of personal data to a third country may be based on a legally binding and enforceable instrument between public authorities or bodies . In such case, such instrument should provide appropriate safeguards and ensure that enforceable data subject rights and effective legal remedies for data subjects are available .

text: 15. The EDPB has clarified in its Guidelines 2/2020 (‘the EDPB Guidelines’) what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies on that basis .

text: 16. The EDPS notes and welcomes that Appendix 2 to the Annex to the Protocol provides for many of those safeguards. In light of the EDPB Guidelines, the EDPS nevertheless encourages to complement Appendix 2 by adding, in particular, the following provisions:  To provide for individual notification of data subjects as a rule (with the possibility to provide as well for some exceptions to such individual notification) .  To provide for data subjects’ right to restriction of processing .  To lay down an obligation to provide information to the data subjects, once their personal data have been transferred, on the action taken on their request under their rights by setting an appropriate time limit (e.g. one month) .  To clarify that information should be provided to data subjects, if the parties do not take action on the request of the data subject, without delay by setting an appropriate time limit (e.g. within one month of receipt of the request), of the reasons for not taking action and on the possibility of lodging a complaint and of seeking a judicial remedy .  To further detail the provisions on the right to redress to ensure that data subjects are afforded independent and effective redress mechanism .  To provide for an obligation for the parties to inform each other of the outcome of the proceedings, in particular if a complaint of an individual is dismissed or not resolved .  To clarify that the redress mechanism must be combined with the possibility for the transferring public body to suspend or terminate the transfer of personal data under the Partnership Agreement where the parties do not succeed in resolving a dispute amicably until it considers that the issue has been satisfactorily addressed by the receiving party .  To provide for internal supervision ensuring compliance with the data protection safeguards .  To clarify and detail the independent supervision’s mechanisms in place to ensure that the parties comply with the data protection provisions .  To provide that any personal data transferred pursuant to the Partnership Agreement prior to its effective termination shall continue to be processed in accordance with the data protection provisions of the Partnership Agreement .  To clarify in Clause 4 that complaints relating to data processed under the controllership of the flag Member States’ authorities are to be addressed to EU national data protection supervisory authorities and not to the EDPS (as Clause 1.3 of Appendix 2 refers also to the flag Member States’ authorities as controllers).

text: 17. In this context, the EDPS notes that Article 16(4) of the Protocol provides that further safeguards and remedies in relation to personal data and data subject’s rights may be established by a joint committee consisting of representatives of the Union authorities and the Malagasy Ministry responsible for fisheries (‘the Joint Committee’). In this respect, the EDPS recommends to make use of the Joint Committee to further detail the appropriate safeguards, enforceable data subject rights and effective legal remedies. In doing so, the EDPS recommends the Commission to take due account of the EDPB Guidelines.

text: 5. Conclusions

text: 18. In light of the above, the EDPS makes the following recommendations: (1) to make use of the Joint Committee to further detail appropriate safeguards, enforceable data subject rights and effective legal remedies listed in Appendix 2 to the Annex to the Protocol. In doing so, the EDPS recommends the Commission to take due account of the EDPB Guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies. Brussels, 1 June 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8


text: COM(2024) 316 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 OJ L 188, 12.7.2019, p. 67. 4 Landeshauptstadt Wiesbaden CJEU judgment of 21 March 2024, case

text: , ECLI:EU:C:2024:251. See COM(2024) 316 final, p. 1. 4

text: EDPS Opinion 7/2018 on the Proposal for a Regulation strengthening the security of identity cards of Union citizens and other documents, issued on 10 August 2018. 7 See CJEU judgment of 21 March 2024,

text: , Landeshauptstadt Wiesbaden, ECLI:EU:C:2024:251, para. 123. 8 See Articles 3(7) and 10(3) of the Proposal. 9 Landeshauptstadt Wiesbaden See CJEU judgment of 21 March 2024,

text: , , ECLI:EU:C:2024:251, para. 35. 10 See CJEU judgment of 21 March 2024,

text: , Landeshauptstadt Wiesbaden, ECLI:EU:C:2024:251, para. 113. 5

identifier: EDPS yttrande 21/2024

title: EDPS Opinion 21/2024 on the Proposal for a Council Regulation on strengthening the security of identity cards

text: 13 September 2024

text: Opinion 21/2024

text: on Proposal for a Council Regulation on strengthening the security of identity cards

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to Proposal for a Council Regulation on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement .

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposals and the future Agreement that are relevant from a data protection perspective.

text: Executive Summary

text: On 23 July 2024, the European Commission issued a Proposal for a Council Regulation on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement.

text: Regulation (EU) 2019/1157

text: on strengthening the security of identity cards of Union citizens and of residence documents, which was invalidated by the Court of Justice of the EU because it was adopted on an incorrect legal basis. On substance, the Proposal essentially reproduces the text of the current Regulation with several limited adaptations of the original text.

text: The EDPS has already had the opportunity to comment on the initial proposal for

text: Regulation (EU) 2019/1157

text: in his Opinion 7/2018. In this regard, the EDPS notes that the CJEU in its judgment has found that the limitation on the exercise of the rights guaranteed in Articles 7 and 8 of the Charter resulting from the inclusion of two fingerprints in the storage medium of identity cards does not appear disproportionate when compared with the significance of the various objectives pursued, thus addressing the main concern of the EDPS as regard the legal act in question.

text: In this Opinion, the EDPS welcomes Recital 19 of the current Proposal, which clarifies that the Regulation does not provide a legal basis for setting up or maintaining databases at national level for the storage of biometric data in Member States, nor for setting up or maintaining a centralised database at Union level. At the same time, he is concerned that the proposed Regulation does not exclude the legal possibility of such databases under the national law. Therefore, the EDPS recommends further strengthening of the language of the Proposal by eliminating entirely the possibility to set up or maintain databases for the storage of biometric data collected under Regulation 2019/1157 and the current Proposal under national law, or, alternatively, by restricting it substantially. In addition, the EDPS invites the Commission to pay specific attention to this issue during the monitoring and evaluation of the Regulation under Articles 12 and 13 of the Proposal, and, if necessary, to intervene in accordance with its powers under the Treaties.

text: Contents

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: Regulation (EU) 2019/1157

text: of the European Parliament and of the Council of 20 June 2019 on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement has been in application since 2 August 2021.

text: 2. In March 2024,

text: Regulation (EU) 2019/1157

text: was invalidated by the CJEU because it was adopted erroneously on the basis of

text: Article 21(2)

text: TFEU and under the ordinary legislative procedure. According to the Court,

text: Regulation (EU) 2019/1157

text: falls within the specific scope of

text: Article 77(3)

text: TFEU, which provides for a special legislative procedure and, in particular, for unanimity in the Council. The Court decided, however, to maintain the effects of the regulation until the entry into force of a new regulation with the correct legal basis, within a reasonable time and by 31 December 2026 at the latest.

text: 3. On 23 July 2024, the Commission adopted a Proposal for a Council Regulation on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement.

text: 4. The objective of the Proposal is to replace the invalidated

text: Regulation (EU) 2019/1157

text: on the basis of the correct legal basis. On substance, the Proposal essentially reproduces the text of

text: Regulation (EU) 2019/1157

text: with several limited adaptations of the original text .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 23 July 2024, pursuant to Article 42(1) of EUDPR. The EDPS positively notes that he was already previously informally consulted pursuant to Recital 60 of EUDPR. The EDPS also welcomes the reference to this consultation in Recital 48 of the Proposal.

text: 2. General remarks

text: 6. The EDPS issued Opinion 7/2018 on the initial proposal for

text: Regulation (EU) 2019/1157

text: . In this Opinion, the EDPS supported the objective of the European Commission to enhance the security standards applicable to identity cards and residence documents, thus contributing to security of the Union as a whole. At the same time, the EDPS considered that the Proposal did not sufficiently justify the need to process two types of biometric data (facial image and fingerprints).

text: 7. The EDPS duly notes that the CJEU in its Landeshauptstadt Wiesbaden judgment has found that the limitation on the exercise of the rights guaranteed in Articles 7 and 8 of the Charter resulting from the inclusion of two fingerprints in the storage medium of identity cards does not appear to be disproportionate when compared with the significance of the various objectives pursued by that measure, and, accordingly, such a measure must be regarded as being based on a fair balance between, on the one hand, those objectives and, on the other, the fundamental rights involved .

text: 8. The EDPS Opinion from 2018 contained several additional recommendations aimed at enhancing the safeguards for biometric data processing, in particular as regards deletion of biometric identifiers after their inclusion in the secure storage medium as well as the setting of age limit for collecting children's fingerprints. The EDPS positively notes that these recommendations have been addressed, even if not in their entirety, by the Union legislator in Regulation 2019/1157, and have been retained by the Commission in the current Proposal .

text: 9. At the same time, as explained in the following section, the EDPS remains concerned about the potential risks stemming from the possibility to set up or maintaining databases at national level for the storage of biometric data as well as to use such data for other purposes.

text: 3. Setting up or maintaining databases of biometric data at national level

text: 10. The EDPS notes that the Proposal would have a wide-ranging impact on a very big proportion of EU population by subjecting them to mandatory processing of biometric data . This wide scope, combined with the sensitive data processed (facial images in combination with fingerprints) calls for strict purpose limitation of the processing of the collected data.

text: 11. The EDPS recalls the clear position of the CJEU in this regard, according to which the provision of Article 10(3) of Regulation 2019/1157, which remains unchanged in the current Proposal, does not permit Member States to process biometric data for purposes other than those laid down in that Regulation and precludes centralised storage of fingerprints which goes beyond the temporary storage of those fingerprints for the purpose of personalising identity cards .

text: 12. In the same vein, the EDPS welcomes Recital 19 of the current Proposal, which clarifies that the Regulation does not provide a legal basis for setting up or maintaining databases at national level for the storage of biometric data in Member States, nor for setting up or maintaining a centralised database at Union level.

text: 13. At the same time, the EDPS is concerned that the proposed Regulation nevertheless does not entirely exclude the legal possibility of such databases under the national law. In particular, Article 10(3) of the Proposal refers to instances “where required for the purpose of processing in accordance with Union and national law [...]” and Recital 19 clarifies that this remains “a matter of national law”.

text: 14. The EDPS would like to stress that setting up or maintaining databases at national level for storing biometric data in Member States, or similarly, setting up or maintaining a centralised database at Union level, along with the potential use of such data for other purposes, would need to meet a strict necessity and proportionality test under the Charter, as interpreted by the relevant case law of the Court. Moreover, it should be borne in mind that such biometric database(s), irrespective of the fact whether centralised or decentralised, could create not only the risk of potential misuse or even abuse, but also a very significant vulnerability in case of data breach, e.g. due to a cyberattack.

text: 15. The EDPS therefore recommends further strengthening the language of

text: Article 10(3)

text: and recital 19 of the Proposal by either prohibiting the possibility to set up or maintain databases for the storage of biometric data collected under Regulation 2019/1157 and the current Proposal under national law, or by restricting it substantially. In addition, the EDPS invites the Commission to pay specific attention to this issue during the monitoring and evaluation of the Regulation under Articles 12 and 13 of the Proposal, and, if necessary, to intervene in accordance with its powers under the Treaties.

text: 4. Conclusions

text: 16. In light of the above, the EDPS recommends: (1) to further strengthen the language of

text: Article 10(3)

text: and recital 19 of the Proposal by eliminating entirely the legal possibility to set up or maintain databases for the storage of biometric data collected under Regulation 2019/1157 and the current Proposal under national law, or, alternatively, by restricting it substantially; (2) the Commission to pay specific attention to this element during the monitoring and evaluation of the Regulation under Articles 12 and 13 of the Proposal, and, if necessary, to intervene in accordance with its powers under the Treaties. Brussels, 13 September 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 6


text: COM(2025) 405 final. COM(2025) 404 final. 1

text: OJ L 295, 21.11.2018, p. 39. 4 COM(2025) 405 final. COM(2025) 404 final. 6 Conclusion Proposal,

text: Article 1

text: . 4

text: Signing Proposal and Conclusion Proposal, Explanatory Memorandum, page 1 and 2. 8 OJ L359 of 16.12.2014, p. 1 to 29. 9 OJ L, 24.10.2023. 10 EDPS Opinion 9/2023 Opinion 9/2023 on the Proposal for a Council Directive amending Directive

text: on administrative cooperation in the field of taxation. 5

text: Recital 102 GDPR. 12

text: Article 6(2)

text: as updated by the Amending Protocol. 13 Idem. 14 Paragraph 3 of Annex III as updated by Amending Protocol. 15 Paragraph 4 of Annex III as updated by the Amending Protocol. 16 Paragraph 8 of Annex III to the Agreement. 17 The purpose for which his personal data are processed; the legal basis for the processing operation; the recipients of his personal data; the identity of the data controllers; the time-limits for storing the data; the existence of the right of a person to ask the controller for access to, and rectification and erasure of, their personal data; the right to seek administrative and/or judicial redress; 6

text: the procedure for exercising the right to administrative and/or judicial redress; the right to apply to the competent data protection supervisory authority or authorities and their contact details. 18 EDPB Guidelines 10/2020 on restrictions under

text: Article 23

text: GDPR, available at the following link https://www.edpb.europa.eu/system/files/2021-10/edpb_guidelines202010_on_art23_adopted_after_consultation_en.pdf 19 Paragraph 10 of Annex III as updated by the Amending Protocol. 20 Paragraph 5 of Annex III to the Amending Protocol. 21

text: Article 7(2)

text: as updated by the Amending Protocol. 22

text: Article 9

text: as updated by the Amending Protocol. 7

identifier: EDPS yttrande 21/2025

amnesord:
Finance
International Cooperation
Transfers of data

title: EDPS Opinion the Proposal on the signing and conclusion of the provisional application of the Amending Protocol between the EU and Monaco on the automatic exchange of financial account information to improve international tax compliance

text: Opinion 21/2025

text: on the Proposal for a Council Decision on the signing and conclusion of the Amending Protocol to the Agreement between the European Union and the Principality of Monaco on the exchange of financial account information to improve international tax compliance

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to (i) the Proposal for a Council Decision on the signing, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Monaco on the exchange of financial account information to improve international tax compliance in accordance with the Standard for Automatic Exchange of Financial Account Information in Tax Matters developed by the Organisation for Economic Cooperation and Development (OECD) ; and to (ii) the Proposal for a Council Decision on the conclusion, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Monaco on the exchange of financial account information to improve international tax compliance in accordance with the Standard for Automatic Exchange of Financial Account Information in Tax Matters developed by the Organisation for Economic Cooperation and Development (OECD) .

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposals that are relevant from a data protection perspective.

text: Executive Summary

text: The EDPS is consulted on the Proposals for Council Decisions to sign and conclude, on behalf of the Union, the Amending Protocol to the Agreement between the European Union and the Principality of Monaco on the exchange of financial account information to improve international tax compliance in accordance with the Standard for Automatic Exchange of Financial Account Information in Tax Matters developed by the Organisation for Economic Cooperation and Development (OECD).

text: The Amending Protocol aims to ensure that the automatic exchange of financial account information between EU Member States and Monaco is aligned with the updated Common Reporting Standard developed by the Organisation for Economic Co-operation and Development. In addition, the Amending Protocol aims to align the text of the Agreement with the new data protection framework (i.e. the GDPR for EU Members States and Law No. 1.565 of 3 December 2024 relating to the protection of personal data for Monaco). Finally, the Amending Protocol would ensure that the existing agreement between the European Union and Monaco remains aligned with Union legislation in the same field.

text: The EDPS welcomes the specific provisions on data protection, i.e.

text: Article 6

text: and Annex III of the Agreement, which clarify the purposes of the processing, and provide for - inter alia - data accuracy and data minimisation, storage limitation, security and confidentiality of the data, as well as data subjects rights and restrictions on onward transfers and sharing of data. Taking these provisions into account, the EDPS considers that the Agreement, as updated by the Amending Protocol, provides for appropriate safeguards to enable the transfer of personal data.

text: The EDPS observes that the Agreement would require Member States and Monaco to restrict the scope of the right of access and the right to information. In this respect, the EDPS recalls the conditions for such restrictions provided under

text: Article 23

text: GDPR.

text: Contents

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 17 July, the European Commission issued: - a Proposal for a Council Decision on the signing on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Monaco on the exchange of financial account information to improve international tax compliance in accordance with the Standard for Automatic Exchange of Financial Account Information in Tax Matters developed by the Organisation for Economic Cooperation and Development (OECD) (‘the Signing Proposal’) ; - a Proposal for a Council Decision on the conclusion, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Monaco on the exchange of financial account information to improve international tax compliance in accordance with the Standard for Automatic Exchange of Financial Account Information in Tax Matters developed by the Organisation for Economic Cooperation and Development (OECD) (‘the Conclusion Proposal’) .

text: 2. The objective of the Signing Proposal is to authorise the signing, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Monaco (Monaco) on the exchange of financial account information to improve international tax compliance in accordance with the Common Reporting Standard (CRS) developed by the OECD (‘the Agreement’).

text: 3. The objective of the Conclusion Proposal is to approve the Amending Protocol .

text: 4. The Amending Protocol aims to (i) ensure that the automatic exchange of financial account information between EU Member States and Monaco is aligned with, and continues to take place in accordance with, the updated CRS from 1 January 2026; and to (ii) align the text of the Agreement with the new data protection framework (i.e.

text: Regulation (EU) 2016/679

text: on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General data protection regulation, GDPR) for EU Members States; and Law No. 1.565 of 3 December 2024 relating to the protection of personal data including the conditions of implementation set out by Sovereign Order for Monaco) .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 17 July 2025, 2025, pursuant to Article 42(1) of the EUDPR. The EDPS welcomes the reference to this consultation in Recital 6 of the Signing Proposal and in Recital 8 of the Conclusion Proposal.

text: 2. General Remarks

text: 6. The EDPS welcomes the objectives pursued by the Proposals, notably to improve administrative cooperation in the area of direct taxation, and to improve international tax compliance. The EDPS acknowledges that the negotiated Amending Protocol ensures that the existing agreement between the European Union and Monaco remains aligned with the Union legislation in the same field, notably

text: Council Directive 2014/107/EU

text: amending Directive

text: on administrative cooperation in the field of taxation (DAC 2) as amended by

text: Council Directive (EU) 2023/2226 of 17 October 2023

text: amending Directive

text: on administrative cooperation in the field of taxation (DAC8) . The EDPS notes he already issued an opinion on DAC8 on 3 April 2023 .

text: 7. The EDPS regrets not having been consulted on the Council Decision authorising the opening of negotiations for the amendment of the Agreement in line with

text: Article 42(1)

text: EUDPR.

text: 8. The EDPS notes that the amendments that would affect the provisions on data protection concern (i) updating references to the legislative data protection framework to align them with the new framework; (ii) replacing the term “information” with “personal data” (where appropriate); (iii) aligning the wording on automated decision-making and handling of sensitive data with the GDPR; and (iv) clarifying that the onward transfers (Article 6(5) of the Amending Protocol) are also subject to the safeguards provided under Annex III of the Agreement. In addition, the principle of data minimisation has been further clarified.

text: 3. International transfers of personal data

text: 9. Any transfer of information containing personal data from the European Union to Monaco under the Agreement constitutes an international transfer of personal data in the meaning of Chapter V of the GDPR. Recital 102 GDPR recalls that international agreements concluded between the Union and third countries may be a ground for transfer of personal data, insofar as they provide appropriate safeguards .

text: 10. The EDPS positively notes that

text: Article 6

text: and Annex III to the Agreement, as updated by the Amending Protocol, would provide for such safeguards.

text: 11. The Agreement, as updated by the Amending Protocol, clearly sets out the categories of data transferred, the purposes of the processing, as well as the principle of storage limitation . It would also provide a clear indication of the relevant data controllers in the Agreement . In addition, the Agreement provides that the data processed must be adequate, relevant and limited to what is necessary in relation to the purposes set out in the Agreement and prohibits the exchange of sensitive data .

text: 12. The EDPS observes that the provision of data subjects’ right, such as the right to transparency, right of access, rectification, and erasure of data are included . As regards the right of access, the EDPS understands that such right includes the right for data subjects to obtain confirmation as to whether or not personal data concerning them is being processed, and if that is the case, to obtain access to that data.

text: 13. Furthermore, the EDPS positively notes the inclusion of data security and data integrity principles . With regards to the commitment taken by the parties to having in place appropriate technical and organisational measures to protect personal data against accidental or unlawful access, destruction, loss, alteration, or unauthorised disclosure, the EDPS understands that the level of security of such measures will take into consideration the risks, the state of the art and the related costs.

text: 14. The EDPS takes note that paragraph 1, section 2, of Article 6 of the Amending Protocol would require Member States and Monaco to restrict the scope of the right of access and of the right to information (Article

text: and

text: GDPR) to the extent required in order to safeguard the interests referred to in

text: Article 23(1)

text: (e) of the GDPR.

text: Article 23(1)

text: (e) GDPR refers to an important objective of general public interest of the Union or of a Member State, which includes taxation. Whereas such a restriction is optional under

text: Article 23

text: GDPR, the Amending Protocol would make it an obligation for the Member States and Monaco.

text: 15. At the same time, the EDPS also notes that section 2 of Article 6(1) of the Amending Protocol guarantees certain information to be given to data subjects by the Reported Financial Institutions .

text: 16. Regarding restrictions to the rights to access and to the right to information, the EDPS understands that it is for the EU Member States and Monaco to provide for the relevant restrictions. In this context, the EDPS recalls that to be lawful, restrictions shall be provided for in a legislative measure, concern a limited number of rights of data subjects and/or controller’s obligations. They shall respect the essence of the fundamental rights and freedoms at issue, be a necessary and proportionate measure in a democratic society and safeguard an important objective of public interest. Restrictions may only continue for as long as the reason for the restriction exists.

text: 17. The EDPS recalls that, in line with the EDPB Guidelines 10/2020 on restrictions under

text: Article 23

text: GDPR , the grounds for the restriction need to be clear, and include a number of elements, such as the categories of personal data restricted, the scope of the restriction, the safeguards to prevent abuse or unlawful access or transfer as well as the risks to data subject’s rights and freedoms entailed by the restrictions. The EDPS encourages Member States and Monaco to take into account the EDPB Guidelines 10/2020 on restrictions under

text: Article 23

text: GDPR as a reference when regulating the restrictions to data subjects’ rights.

text: 18. The EDPS notes that the obligation to inform data subjects in the event of a data breach, as provided by paragraph 5 of Article 6(1) of the Amending Protocol, applies to any data breach likely to adversely affect data subjects. The EDPS understands that this obligation to notify encompasses cases where the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, as it is the case under

text: Article 34

text: GDPR.

text: 19. Additionally, the EDPS notes that

text: Article 6(4)

text: and (5) and Annex III, paragraph 7, to the Amending Protocol would regulate further processing as well as onward sharing and onward transfers of personal data. It welcomes the safeguards included for the further processing and with specific regard to the possibility of onward sharing, the EDPS positively welcomes the requirement for prior authorisation by the transferring competent authority, as well as the clarification that onward transfers are also subject to the safeguards provided for under Annex III - notably paragraph 7 - which outlines the additional requirements under which onward transfers are allowed.

text: 20. The EDPS welcomes the reference to the oversight of the competent data protection 19 20 supervisory authority and to the right to redress .

text: 21. Finally, the EDPS welcomes the inclusion of provisions recognising that significant noncompliance with data protection rules may constitute grounds for suspending data exchanges, provided that no adequate resolution is reached by the parties . It also notes that, in the event of termination of the agreement, any personal data transferred from the EEA under the Agreement prior to its termination will continue to be processed in accordance with the provisions of the international agreement .

text: 4. Conclusions

text: 22. In light of the above, the EDPS considers that the Agreement, as updated by the Amending Protocol, provides for appropriate safeguards to enable the transfer of personal data. Brussels, 20 August 2025 (e-signed) p.o. Leonardo CERVERA NAVAS 8


text: In accordance with

text: Article 36 of Council Directive (EU) 2020/262 of 19 December 2019

text: laying down the general arrangements for excise duty (recast) , as from 13 February 2023 all intra-EU movements of excise goods released for consumption in one Member State and moved to another Member State to be delivered there for commercial purposes (so-called “Duty Paid movements”) will be monitored through the computerised system, that is the Excise Movement and Control System (EMCS). Until 13 February 2023, EMCS is only covering intra-EU movements of excise goods in suspension of excise duty.

text: OJ L 295, 21.11.2018, p. 39.

text: OJ L 58, 27.2.2020, p. 4. 4

text: The extension of the computerised system to Duty Paid movements by

text: Council Directive (EU) 2020/262

text: requires to extend also the scope of

text: Regulation (EU) No 389/2012

text: Council Regulation (EU) No 389/2012 of 2 May 2012

text: on administrative cooperation in the field of excise duties and repealing

text: Regulation (EC) No 2073/2004

text: , OJ L 121, 8.5.2012, p. 1–15. 5

identifier: EDPS yttrande 22/2022

title: EDPS Opinion on the exchange of information concerning economic operators who move excise goods between Member States for commercial purposes

text: 9 November 2022

text: Opinion 22/2022

text: on the Proposal for a Council Regulation amending

text: Regulation (EU) No 389/2012

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to [insert full name of the legislative Proposal or Recommendation or Proposal to the Council Pursuant to

text: Article 218

text: TFEU].This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the draft Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: The EDPS notes that the draft Proposal would introduce the following amendments to Council Regulation EU (No) 389/2012:

text: - according to the new

text: Article 19(4)

text: , the information contained in the national registers concerning all economic operators engaged in movements of excise goods as referred to in Chapter IV, and Chapter V, Section 2, of

text: Council Directive (EU) 2020/262

text: shall be automatically exchanged via a central register;

text: - according to the new

text: Article 20(1)

text: The EDPS considers that these amendments do not raise significant data protection issues, notably since the information to be provided in the context of administrative cooperation in the field of excise duties are not modified by the proposed amendments.

text: The EDPS also notes that the proposed amendments would not impact on the already established means for the processing of personal data in the context of Council Regulation EU (No) 389/2012.

text: Contents

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 24 October 2022 the European Commission adopted the Proposal for a Council Regulation amending

text: Regulation (EU) No 389/2012

text: as regards the exchange of information maintained in the electronic registers concerning economic operators who move excise goods between Member States for commercial purposes (‘the Proposal’).

text: 2. The objective of the Proposal according to the explanatory memorandum is to introduce the obligations of Member States regarding the exchange of data of economic operators moving goods under Chapter V, section 2 of

text: Directive (EU) 2020/262

text: maintained in the national registers with the central register, enabling full exchange of information and reducing the administrative burden on economic operators as well as the risk of fraud and improving the administrative cooperation between the competent authorities of the Member States. To achieve these objectives, the Proposal seeks to align the procedure of exchanging the data of economic operators moving goods under Duty Suspension with the exchange of data of the economic operators moving goods under Duty Paid. This alignment will contribute to the digitalisation of the monitoring of movements of excise goods released for consumption in the territory of one Member State and moved to the territory of another Member State in order to be delivered there for commercial purposes and improve the fight against tax fraud, according to the explanatory memorandum.

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 26 October 2022, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital (6) of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: Regulation (EC) No 2073/2004

text: (‘the Regulation’) lays down the conditions under which the competent authorities in the Member States for the application of the legislation on excise duties are to cooperate with each other, and with the Commission, in order to ensure compliance with that legislation. To that end, it lays down rules and procedures to enable the competent authorities of the Member States to cooperate and to exchange, by electronic means or otherwise, information that is necessary to ensure the correct application of legislation on excise duties.

text: 6. Article 19(1) of the Regulation provides for an electronic database containing inter alia a register of economic operators belonging to one of three categories, inter alia registered consignees and registered consignors. The content of the registers is provided for by Article 19(2) of the Regulation. It consists of the unique excise number issued by the competent authority in respect of an economic operator or premises; the name and address of the economic operator or premises; the excise product category and/or the excise product code; further information on authorisations for registered consignees; and other specified information. The EDPS observes that these datasets do not necessarily have to constitute personal data; however, based on the individual circumstances, this may be the case, for example when the economic operator is a sole proprietor or the name of a company refers to its majority owner. Therefore the EDPS considers it necessary and welcomes that the Proposal is based on the presumption that personal data is exchanged.

text: 7. Article 19(4) of the Regulation provides for an automatic exchange of the data referred to in paragraph 2 via a central register. The Proposal replaces the limitation of this provision to excise goods under duty suspension arrangements and widens it to (all) goods referred to in Chapter IV and Chapter V, Section 2, of

text: Council Directive (EU) 2020/262

text: , extending the exchange via a central register to Duty Paid movements. In practice these provisions allow the consignor and consignee to document a movement of excise goods at every stage through an electronic Administrative Document (eAD), issued by the original consignor and containing information on the consignment and the planned movement within the EU. The eAD is validated by the Member State of dispatch using a European register of operators, and then the eAD is electronically transmitted by the Member State of dispatch to the Member State of destination, which forwards it to the consignee. At receipt of the excise goods, the consignee submits an electronic report of receipt, which is forwarded by the Member States involved to the consignor who can then discharge the movement and recover financial guarantees they had to make.

text: 8. In addition, according to the new

text: Article 20(1)

text: , the Commission must ensure that all persons involved in the movement of excise goods can obtain confirmation by electronic means of the validity of excise numbers held in the central register. The EDPS notes that this legislative consultation is not the right occasion to deal in all details with the Excise Movement Control System and its technical implementation. The following comment is therefore without prejudice to the practical implementation.

text: 3. Comments

text: 9. The EDPS considers that the amendments of the Regulation by the Proposal do not raise significant data protection issues, notably since the information to be provided in the context of administrative cooperation in the field of excise duties are not modified by the proposed amendments. The EDPS also notes that the proposed amendments would not impact on the already established means for the processing of personal data in the context of the Regulation.

text: 10. Given the subject matter and the provisions of the Proposal, which do not raise significant issues having regard to the protection of personal data, the EDPS has no comments on the draft Proposal.

text: 4. Conclusions

text: 11. In light of the above, the EDPS refrains from making any recommendations. Brussels, 9 November 2022 (e-signed) Wojciech Rafał WIEWIÓROWSKI 6


identifier: EDPS yttrande 22/2023

title: EDPS Opinion 22/2023 on the Proposal for a Directive on deposit protection, cross-border cooperation and transparency