text: COM(2024)580 final and COM(2024)581 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2024)580 final and COM(2024)581 final. 4 See pages 1 - 3, COM(2024)580 final and COM(2024)581 final. Idem. 6 Idem. 4

text: For further details see the EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data. 8 See Opinion 1/15 of the Court of Justice (Grand Chamber) of 26 July 2017, EU:C:2017:592, para. 140, and the cited CJEU case law. 9 For further details see the EDPS Opinion 14/2023 on the negotiating mandate to conclude an international agreement on the exchange of personal data between Europol and Brazilian law enforcement authorities, issued on 3 May 2023. 5

text: See pages 19 and 20, Annex to COM(2024)580 final and COM(2024)581 final. 6

text: DIRECTIVE

text: (EU) 2016/680

text: OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89). 7

identifier: EDPS yttrande 02/2025

title: EDPS Opinion 2/2025 on the Proposals for Council Decisions on the signing and conclusion of the Agreement between the European Union and Brazil on cooperation between Europol and the Federal Police of Brazil

text: 10 February 2025

text: Opinion 2/2025

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to Commission Proposals for Council Decisions on the signing and conclusion, on behalf of the European Union, of the Agreement between the European Union and Brazil on cooperation with and through the European Union Agency for Law Enforcement Cooperation (Europol) and the Federal Police of Brazil . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 18 December 2024, the European Commission issued two Proposals for Council Decisions on the signing and on the conclusion of the Agreement between the European Union and Brazil on the exchange of personal data between Europol and the Brazilian authorities competent for fighting serious crime and terrorism. The objective of the Agreement is to establish cooperative relations between Europol and the competent authorities of Brazil and to allow the transfer of personal and non-personal data between them while ensuring appropriate safeguards with respect to the human rights and fundamental freedoms of individuals, including the right to privacy and data protection.

text: The EDPS previously had the opportunity to comment on the exchange of personal data between Europol and the law enforcement authorities of Brazil in his Opinion 14/2023 on the negotiating mandate for the present Agreement. There, the EDPS positively noted the recent establishment in Brazil of an independent data protection authority (Autoridade Nacional de Proteção de Dados – ANPD). At the same time, the EDPS made several recommendations in order to clarify and, where necessary, further develop, the safeguards and controls with respect to protection of personal data. The recommendations related in particular to the scope of the Agreement, the principle of storage limitation, the processing of special categories of personal data, automated decisions and data security, as well as the provision of information to data subjects and of the supervision.

text: The EDPS notes with satisfaction that his recommendations have been taken into account during the negotiations and have been subsequently reflected in the final text of the Agreement.

text: In light of the above, the EDPS considers that the presented Agreement between the European Union and Brazil on the exchange of personal data between Europol and the Brazilian authorities competent for fighting serious crime and terrorism adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals. In addition, the EDPS makes specific recommendations related to the interpretation and the implementation of the Agreement. In particular, he stresses that the existence of an independent data protection authority in Brazil competent to exercise effective oversight over the Brazilian law enforcement authorities processing personal data pursuant to the Agreement should be an essential condition for the acceptance by the EU of the notification under Article 30(3) of the Agreement, and for its consequent entry into application.

text: Contents

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 18 December 2024, the European Commission issued two Proposals for Council Decisions on the signing and on the conclusion of the Agreement between the European Union and Brazil on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Brazilian authorities competent for fighting serious crime and terrorism (‘the Proposals’) .

text: 2. The objective of the Proposals is to establish cooperative relations between Europol and the competent authorities of Brazil and to allow the transfer of personal and non-personal data between them, in order to support and strengthen the action by the authorities of the Member States of the Union and those of Brazil, as well as their mutual cooperation in preventing and combating criminal offences, including serious crime and terrorism, while ensuring appropriate safeguards with respect to the human rights and fundamental freedoms of individuals, including the right to privacy and data protection .

text: 3. The negotiations between the Commission and Brazil on the Agreement were carried out between July 2023 and October 2024 in accordance with the negotiation directives adopted by the Council on 15 May 2023, further to Commission Recommendation of 9 March 2023 .

text: 4. The envisaged Agreement builds upon already existing close partnership between the European Union and Brazil. In this regard, it should be noted that the Parties signed an Agreement on Strategic Cooperation in April 2017 to establish cooperative relations to support in preventing and combating organised crime, terrorism and other forms of international crime in all areas of crime within Europol’s mandate .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 18 December 2024, pursuant to Article 42(1) of EUDPR, on the Proposals for Council Decisions on the signing and on the conclusion of the Agreement. However, bearing in mind that both Proposals concern the same Agreement, the present Opinion covers both of them.

text: 2. General remarks

text: 6. Transfers of personal data gathered in the context of criminal investigations, envisaged under the Agreement, are liable to have a significant impact on the lives of the individuals concerned, as the personal data may potentially be used in prosecution cases in the receiving country under its national law.

text: 7. As transfers of personal data to third countries constitute an interference with individuals’ rights to privacy and data protection guaranteed by Articles 7 and 8 of the Charter, requirements of necessity and proportionality of the envisaged processing need to be assessed in accordance with Article 52(1) of the Charter . Consequently, the international agreement must ensure that the limitations to rights to privacy and data protection in relation to the fight against serious crime and terrorism apply only in so far as is strictly necessary .

text: 8. The EDPS previously had the opportunity to comment on the exchange of personal data between Europol and the law enforcement authorities of Brazil in his Opinion 14/2023 on the negotiating mandate for the present Agreement . In particular, he positively noted that the Commission has by now established, based also on the recommendations from the previous EDPS Opinions on this matter, a well-structured set of objectives (negotiating directives), which incorporate key data protection principles and safeguards.

text: 9. In his Opinion 14/2023, the EDPS provided several additional recommendations in order to clarify and, where necessary, further develop the safeguards and controls with respect to the protection of personal data, taking into consideration the specific context of Brazil. Among others, the EDPS recommended that: a. the future Agreement explicitly excludes transfers of personal data obtained in a manifest violation of human rights; b. the future Agreement explicitly lays down the list of the criminal offences regarding which personal data could be exchanged and that the transferred personal data must be related to individual cases; c. the future Agreement provides for a periodic review of the need for storage of the transferred personal data as well as other appropriate measures ensuring that the time limits are observed; d. the future Agreement adduces the necessary safeguards for processing of special categories of personal data and of different categories of data subjects, in line with Article 30 of the Europol Regulation; e. the security measures cover data processed in the place of destination, as well as in transit; f. no automated decision based on the received data under the Agreement would take place without the possibility for a human being to intervene in an effective and meaningful way; g. the future Agreement lays down clear and detailed rules regarding the information that should be made available to the data subjects; h. for the purposes of the review of the Agreement, that the Parties exchange on a regular basis information on the exercise of rights by data subjects and relevant information about the use of the oversight and redress mechanisms related to the application of the Agreement.

text: 10. The EDPS notes with satisfaction that these recommendations have been taken into account during the negotiations and are subsequently reflected in the final text of the Agreement, as follows: a.

text: Article 4

text: (“General data protection principles”) excludes, in its paragraph 5, the transfer of personal data which have been obtained in a manifest violation of human rights recognised by the norms of international law binding on the Contracting Parties. In addition, it prohibits the use of the personal data received for requesting, handing down or executing the death penalty or any form of torture and other cruel, inhuman or degrading treatment or punishment. The EDPS positively welcomes this further safeguard; b. Annex I (“Areas of Crime”) to the Agreement lays down an exhaustive list of criminal offences, thus providing legal certainty about its material scope . In the same vein, the EDPS welcomes that the “supplementary, compatible and specific purpose” for which data transferred under the Agreement can be processed by common accord of the Contracting Parties shall fall within the scope of the Agreement, including its Annexes, and the respective mandates of the competent authorities whereby ensuring compliance with the data protection principles, and providing legal certainty; c. According to

text: Article 12

text: (“Storage, review, correction and deletion of personal data”), the Contracting Parties shall provide for appropriate time limits to be established for the storage of personal data received under the Agreement or for a periodic review of the need for the storage of such data (emphasis added), so that data are stored only as long as is necessary for the purpose for which they are transferred; d.

text: Article 5

text: (“Special categories of personal data and different categories of data subjects”) of the Agreement provides for safeguards when the transfer and further processing concern special categories of personal data and for different categories of data subjects; e.

text: Article 19

text: (“Data security”) includes a general security obligation and lists types of security measures that the Contracting Parties shall ensure to protect the data exchanged under the Agreement.

text: Article 27

text: (“Secure communication line”) provides that personal data and non-personal data shall be exchanged by means of a secure communication line. This set of provisions should ensure that the data security principle is well implemented and that security measures cover data both at rest and in transit; f.

text: Article 6

text: (“Automated processing of personal data”) provides that “decisions based solely on automated processing of the personal data exchanged, including profiling, which may produce an adverse legal effect on the data subject or significantly affect him or her, shall be prohibited, unless authorised at law for preventing or combating a criminal offence and with appropriate safeguards for the rights and freedoms of the data subject, including at least the right to obtain human intervention”, therefore laying down the necessary safeguards in respect to automated processing of personal data; g. Pursuant to paragraph 1 of

text: Article 29

text: (“Notification of implementation”) each Contracting Party shall provide for its competent authorities to make publicly available a document setting out in an intelligible form the provisions regarding the processing of personal data transferred under the Agreement including the means available for the exercise of the rights of data subjects. The EDPS understands that this includes the obligation for competent authorities, as controllers, to make available or give to data subjects specific information about the processing of their personal data under this Agreement. The EDPS notes however that

text: Article 29

text: is part of Chapter VI dedicated to “Final provisions”. For the sake of clarity, the EDPS suggests for future agreements to include a separate article specifically dedicated to the right to information, laying down clear and detailed rules regarding the information that should be made available to data subjects, as it is the case for

text: Article 79

text: EUDPR and for Article 13 of the Law Enforcement Directive . Such rules should also include information about the applicable regime for EU data subjects to exercise their rights of access, rectification and erasure; h.

text: Article 32

text: (“Review and evaluation”) provides for the regular review and evaluation of the Agreement. Under its paragraph 3, it states that “For the purposes of any review, the Union and Brazil shall ensure access to relevant documentation, systems and personnel”. The EDPS understands that such access will include data protection related information when relevant. In addition,

text: Article 32(3)

text: specifically envisages the participation of “relevant experts on data protection” in the respective review teams. In this context, the EDPS recommends that representatives of independent data protection authorities should also be involved in the review and the evaluation of the Agreement.

text: 11. Finally, the EDPS welcomes the inclusion of the right to compensation for any damage caused to data subjects by means of Article 15 of the Agreement.

text: 3. Supervisory authority

text: 12. The existence of an independent data protection authority competent to monitor the processing of personal data for law enforcement purposes is a key guarantee for the protection of personal data and therefore amounts to an essential condition for the compliance of the Agreement with the Union law, in particular Article 8(3) of the Charter. Furthermore, for the independent data protection authority to be able to control the processing of personal data, such authority should be provided with effective powers of investigation and intervention to exercise oversight over those public authorities of Brazil that exchange and use personal data pursuant to the Agreement.

text: 13. In his Opinion 14/2023, the EDPS welcomed the establishment of an independent data protection authority in Brazil, the Brazilian Data Protection Supervisory Authority (Autoridade Nacional de Proteção de Dados – ANPD). However, the competence of the ANPD as regards processing activities in the field of law enforcement and prosecution of criminal offences was not discussed or analysed.

text: 14. The EDPS notes that Article 14 of the Agreement (“Supervisory authority”) provides in its paragraph 1, that the Contracting Party shall notify each other of the authority that each of them designates as the supervisory authority, following the notification procedure set out in

text: Article 29(3)

text: . In addition, pursuant to Article 30(3) of the Agreement, for it to enter into application, it is required that the notifications by a Contracting Party referred to in

text: Article 29(3)

text: are accepted by the other Contracting Party.

text: 15. In light of the above, the EDPS considers that the acceptance of the notifications under

text: Article 30(3)

text: and the consequent entry into application of the Agreement should be dependent on whether the Commission is satisfied with the existence of an independent data protection authority with the competence to exercise oversight over the public authorities of Brazil that exchange and use personal data pursuant to the Agreement (ANPD or another body meeting the necessary conditions).

text: 4. Conclusions

text: 16. The presented Agreement between the European Union and Brazil on the exchange of personal data between Europol and the authorities of Brazil competent for fighting serious crime and terrorism adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

text: 17. The EDPS makes the following specific recommendations related to the interpretation and the implementation of the Agreement: (1) to ensure that the existence of an independent data protection authority in Brazil with effective powers of investigation and intervention to exercise oversight over the Brazilian public authorities processing personal data for law enforcement purposes pursuant to the Agreement 8 is treated as an essential condition for the acceptance by the EU of the notification under

text: Article 30(3)

text: and the consequent entry into application of the Agreement; (2) to involve independent data protection authorities in the future reviews and evaluations of the Agreement. Brussels, 10 February 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 9


text: COM(2025) 842 final.

text: OJ L 295, 21.11.2018, p. 39. 3

text: Directive (EU) 2016/2341

text: of the European Parliament and of the Council of 14 December 2016 on the activities and supervision of institutions for occupational retirement provision (IORPs) (recast), OJ L 354, 23.12.2016, pp. 37–85. 4

text: Directive (EU) 2016/97

text: of the European Parliament and of the Council of 20 January 2016 on insurance distribution (recast), OJ L 26, 2.2.2016, pp. 19–59. COM(2025) 842 final. 6 COM(2025) 842 final, pages 2 and 6. 7 COM(2025) 842 final, page 3. 8

text: Regulation (EU) 2019/1238

text: of the European Parliament and of the Council of 20 June 2019 on a pan-European Personal Pension Product (PEPP), OJ L 198, 25.7.2019, pp. 1–63.

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1). 10

text: Article 6(4) of Directive (EU) 2016/2341

text: . 11 Articles 6(9), 13(2) , 15(1) and 27(1) of

text: Directive (EU) 2016/2341

text: See Articles 1(7) of the Proposal, which adds point (22) to

text: Article 6 of Directive (EU) 2016/2341

text: , and Article 2(1) of the Proposal, which adds point 20 to

text: Article 2 of Directive (EU) 2016/97

text: . 13 Article 1(37) of the Proposal, adding

text: Article 22

text: a(6) to

text: Directive (EU) 2016/2341

text: . 14 See proposed new

text: Article 44

text: b(2) for

text: Directive (EU) 2016/2341

identifier: EDPS yttrande 02/2026

publisher: Europeiska datatillsynsmannen

sprak: en

title: Opinion 2/2026 on the Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision

serie: yttranden

text: (EU) 2016/2341

type: rubrik

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Directive of the European Parliament and of the Council amending Directives

text: (EU) 2016/2341

text: and 2016/97 as regards the strengthening of the framework for occupational retirement provision.

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: (EU) 2016/2341

text: The objective of the Proposal is to strengthen the capacity of occupational pension funds to deliver adequate retirement income, to act as stable long-term investors supporting sustainable growth, and to contribute to the resilience and deepening of the Union’s capital markets. The EDPS welcomes the objectives of the Proposal, particularly the objective of enhancing transparency and facilitating member and beneficiaries’ awareness of their entitlements.

text: Data about members and beneficiaries of pension schemes qualifies as personal data within the meaning of EU data protection law. Records on pension rights may also contain special categories of data within the meaning of Article 9(1) of the GDPR, in particular data concerning health. Therefore, it is important to clearly indicate which categories of personal data will be collected and shared and to ensure that appropriate safeguards are in place.

text: The Proposal establishes that, where pension tracking systems are established at the national level, institutions for occupational retirement provision (IORPs), insurance undertakings and insurance intermediaries would be required to share information with such pension tracking systems. The EDPS recommends defining clear rules for the functioning of pension tracking systems, including in what concerns the processing of personal data. The EDPS recommends empowering the Commission to determine via delegated regulation the types of personal data that should be shared by IORPs, insurance undertakings and insurance intermediaries with the entities managing pension tracking systems. In the same vein, the EDPS recommends to further clarify the categories of personal data that IORPs are expected to collect from members and beneficiaries of pensions schemes to determine their risk tolerance in the context of assessing the long-term risk of pensions schemes.

text: Lastly, the EDPS recommends empowering the Commission to lay down in a delegated or implementing act the procedures to be followed by IORPs when carrying out checks and reporting on the qualifications, knowledge, experience, good repute and integrity of the persons who effectively run the IORP, their management, administrative, supervisory and internal audit functions. The categories of personal data that should be processed in that context should be specified.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 20 November 2025, the European Commission adopted the Proposal for a Directive of the European Parliament and of the Council amending Directives

text: (EU) 2016/2341

text: and 2016/97 as regards the strengthening of the framework for occupational retirement provision (‘the Proposal’).

text: 2. The Proposal aims to contribute to the creation of a European Savings and Investments Union by mobilising private savings for productive investment and ensuring that the benefits of such investment are channelled back to citizens in the form of higher and reliable retirement incomes. The Commission considers that private and occupational pensions can support EU citizens in securing their retirement and to facilitate the channelling of savings into the wider economy .

text: 3. The objective of the Proposal is to strengthen the capacity of occupational pension funds to deliver adequate retirement income, to act as stable long-term investors supporting sustainable growth, and to contribute to the resilience and deepening of the Union’s capital markets .

text: 4. The Proposal is part of a broader pension package that includes the review of

text: Regulation (EU) 2019/1238

text: , on which the EDPS is delivering a separate Opinion.

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 20 November 2025, pursuant to Article 42(1) of EUDPR. The EDPS positively 4 notes that he was already previously informally consulted pursuant to recital 60 of EUDPR. The EDPS recommends making a reference to the present consultation under Article 42(1) of EUDPR and to the Opinion of the EDPS in a Recital of the Proposal.

text: 2. General remarks

text: 6. The EDPS welcomes the objectives of the Proposal, particularly the objective of enhancing transparency and facilitating member and beneficiaries’ awareness of their entitlements. Data about members and beneficiaries of pension schemes relates to natural persons and, therefore, qualifies as personal data within the meaning of

text: Article 4(1) of Regulation (EU) 2016/679

text: (‘the GDPR’) and

text: Article 3(1)

text: EUDPR.

text: 7. Pension rights may include retirement benefits that are “in the form of payments on death, disability, or cessation of employment or in the form of support payments or services in case of sickness, indigence or death” . IORPs operating occupational pension schemes may also cover biometric risks, i.e. risks related to death, disability and longevity . Records on pension rights can therefore include special categories of personal data within the meaning of Article 9(1) of the GDPR, in particular data concerning health. Therefore, it is important to clearly indicate which categories of personal data will be collected and shared and to ensure that appropriate safeguards are in place.

text: 8. The EDPS notes that the GDPR would apply when personal data are processed in the context of the Proposal. There may also be situations where EU bodies covered by the Proposal, such as the European Insurance and Occupational Pensions Authority (‘EIOPA’), would be subject to the EUDPR (e.g., when EIOPA would assist a national competent authority in carrying out an on-site inspection).

text: 9. The EDPS therefore welcomes that Article 1(60) of the Proposal refers to the application of the GDPR and of the EUDPR in the context of

text: Directive (EU) 2016/2341

text: . The EDPS recommends including a similar provision in Article 2 of the Proposal to amend

text: Article 37 of Directive (EU) 2016/97

text: , which currently refers to the application of repealed Directive

text: and of repealed

text: Regulation (EC) No 45/2001

text: . In the same vein, the EDPS recommends adding a reference to the applicability of the EUDPR in Recital 50 of the Proposal. 5

text: 3. Pension tracking systems

text: 10. Article 1(37) of the Proposal provides that “Member States shall ensure that IORPs transmit to pension tracking systems, where such systems have been established, all information necessary to provide members and beneficiaries with a comprehensive, reliable and up-to-date overview of their occupational and personal pension entitlements, insofar as those entitlements are administered by the IORP.” Such information (which qualifies as personal data of members and beneficiaries) would be transmitted in “standardised, machine-readable and interoperable format enabling pension tracking systems to aggregate data on accrued rights, accumulated capital and projected benefits in a coherent and comparable manner.” A similar provision is Article 2(3) of the Proposal, in relation to data sharing by insurance undertakings and insurance intermediaries with pension tracking systems under

text: Directive (EU) 2016/97

text: 11. The EDPS notes that the Proposal would define a “pension tracking system”, under both Directives

text: (EU) 2016/2341

text: and 2016/97 as “a digital tool, typically a secure web portal or mobile application, that provides individuals with an overview of their individual accrued pension entitlements, and projections of future benefits, across the pension schemes of which the individual is a member or beneficiary” .

text: 12. The EDPS recommends defining clear rules for the functioning of pension tracking systems, including in what concerns the processing of personal data. In this regard, the EDPS recommends that the regulatory technical standards defining the format and structure of the information to be transmitted to pension tracking systems - to be adopted via delegated regulation by the European Commission - also define the categories of personal data to be shared by IORPs. The EDPS recommends similarly empowering the Commission to specify such elements also under

text: Directive (EU) 2016/97

text: for the sharing of information by insurance undertakings and insurance intermediaries with pension tracking systems.

text: 4. Appropriate structure and implementation of pension schemes

text: Article 1(45)

text: would add a new Chapter 4 to Title IV of

text: Directive (EU) 2016/2341

text: . Among various business conduct rules for IORPs, Article 1(45) of the Proposal would require Member States to ensure that, where members bear investment risk, IORPs assess the longterm risk from the perspective of members and beneficiaries, including the determination of the risk tolerance of members and beneficiaries bearing risks .

text: 14. Based on recital (28) of the Proposal, the EDPS understands that the determination of risk tolerance would take into account the capacity and appetite for risk of members and beneficiaries. No indication is provided, however, as to how such an assessment should be 6 made. To enhance legal certainty and foreseeability, the EDPS recommends further clarifying which categories of personal data IORPs are expected to collect from members and beneficiaries to determine their risk tolerance in this context.

text: 5. Requirements for fit and proper management of IORPs

text: 15. The Proposal would provide a requirement for IORPs to ensure that the qualifications, knowledge and experience of persons who effectively run the IORP, their management, administrative, supervisory and internal audit functions are adequate to enable them to ensure a sound and prudent management of the IORP and to carry out their duties. Moreover, such persons would need to be of good repute and integrity .

text: 16. The EDPS recommends including an empowering provision in the draft Proposal to enable the Commission to lay down in a delegated or implementing act the procedures to be followed by IORPs when carrying out such checks and reporting to competent authorities, as well as to specify the categories of personal data that should be processed in that context.

text: 6. Conclusions

text: 17. In light of the above, the EDPS makes the following recommendations: (2) to amend

text: Article 37 of Directive (EU) 2016/97

text: by making a reference to the application of the GDPR and of the EUDPR to the processing of personal data entailed by the application of the Directive; (3) to add a reference to the application of the EUDPR in Recital 50 of the Proposal; (4) to provide rules for the functioning of pension tracking systems, including in what concerns the processing of personal data of members and beneficiaries by the entities managing the systems; (5) to empower the Commission to define via delegated regulation the types of personal data to be shared by IORPs, insurance undertakings and insurance intermediaries with pension tracking systems; (6) to specify the categories of personal data that IORPs are expected to collect from members and beneficiaries to determine their risk tolerance under Article 1(45) of the Proposal; and 7 (7) to empower the Commission to lay down in a delegated or implementing act the procedures to be followed by IORPs when carrying out checks on the qualifications, knowledge, experience, good repute and integrity of the persons mentioned in Article 1(24) of the Proposal and when reporting to competent authorities, as well as to specify the categories of personal data that should be processed in that context. Brussels, 9 January 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8

type: vagledning

utgivare: edps


text: COM(2016) 7 final, 2016/0002 (COD), Strasbourg, 19.1.2016. 2 Council Framework Decision 2009/315/JHA of 26 February 2009 on the organisation and content of the exchange of information extracted from the criminal record between Member States (Framework Decision), OJ L 93, 7.4.2009, p. 23, and Council Decision 2009/316/JHA of 6 April 2009 on the establishment of the European Criminal Records Information System (ECRIS) in application of Article 11 of Framework Decision 2009/315/JHA, OJ L 93, 7.4.2009, p. 33.

text: Explanatory Memorandum of the Proposal, p. 3. 4 Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, OJ L350/60, 30.12.2008. 5 Proposal for a Directive of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties and the free movement of such data, as agreed on 18 December 2015 by the Council. CJEU,

text: and

text: Digital Rights Ireland, 8.4.2014, at 33 and 36.

text: See also Digital Rights Ireland, at 38. 8 CJEU, Cases

text: P and

text: P Kadi and Al Barakaat International Foundation v Council and Commission EU:C:2008:461, at 383; Cases

text: P and

text: P Al-Aqsa v Council EU:C:2012:711, at 130;

text: Case C-145/09

text: Tsakouridis EU:C:2010:708, at 46 and 47. 9 The wording used in

text: Article 4

text: a(1) for this exception is: "in exceptional individual cases, where this is not possible". 10 See, to this effect, CJEU,

text: Schwartz v. Stadt Bochum, 17.10.2013, at 30.

text: Impact Assessment, p. 15. 12 As the Commission acknowledged in one of its communications, "certainly, criminal law is a sensitive policy field, where differences amongst the national systems remain substantial, for example regarding sanction types and levels as well as the classification of certain conduct as an administrative of criminal offence" - Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, "Towards an EU criminal policy: ensuring the effective implementation of EU policies through criminal law", COM(2011) 573 final, 20.09.2011, p. 2. 13 Recital 10 of the Preamble. 14 Explanatory Memorandum, p. 6. 15 Explanatory Memorandum, p. 6. 16 Explanatory Memorandum, p. 6.

text: Opinion of 19 October 2005 on three Proposals regarding the Second Generation Schengen Information System (SIS II) (COM(2005) 230 final, COM(2005) 236 final and COM(2005) 237 final), OJ C 91,19.4.2006, p. 43. 18 EDPS Opinion on SIS II, 2005, p. 44. 19 Article 3(1) of the DPD. 20

text: Article 3

text: (4a) of the DPD.

text: In this regard, see the conclusion of the

text: Article 29

text: Working Party in Opinion No. 4/2007 on the concept of personal data, that "Anonymised data would therefore be anonymous data that previously referred to an identifiable person, but where that identification is no longer possible" (p. 21). Also see "Additional EDPS Comments on the Data Protection Reform Package", p. 1 to 3, published on 13 March 2013. 22

text: Article 4

text: a(1): (a) information on the convicted person (full name, date of birth, place of birth (town and country), gender, nationality and – if applicable – previous name(s); (b) information on the nature of the conviction (date of conviction, name of the court, date on which the decision became final); (c) information on the offence giving rise to the conviction (date of the offence underlying the conviction and name or legal classification of the offence as well as reference to the applicable legal provisions); (d) information on the contents of the conviction (notably the sentence as well as any supplementary penalties, security measures and subsequent decisions modifying the enforcement of the sentence); (e) the convicted person's parents' names; (f) the reference number of the conviction; (g) the place of the offence; (h) if applicable, disqualifications arising from the conviction; (i) the convicted person's identity number, or the type and number of the person's identification document; (j) fingerprints of the person; (k) if applicable, pseudonym and/or alias name(s). 23 Article 1(4) of the Proposal (new

text: Article 4

text: a(1) of the Framework Decision). 24 Points (a), (e), (i), (j) and (k) of the list enumerated in Footnote 22. 25 Explanatory Memorandum of the Proposal, p. 5. 26 Recital 11 of the Preamble of the Proposal. 27 Recital 11 of the Preamble of the Proposal. 28 Explanatory Memorandum, p. 9.

text: Explanatory Memorandum, p. 5. 30 It appears that the European Commission already has a planned technical solution for the implementation of ECRIS-TCN and that the text of the Proposal was written so that it fits this technical solution. As a general point, the process should be to first define the requirements for a technical solution and then to procure or develop a solution fulfilling these requirements. 31 Compared to a fully centralised index file. 32 The DPD is in the final stage of the adoption. On 18 December 2015, the Permanent Representatives Committee (Coreper) confirmed the compromise texts agreed with the European Parliament on data protection reform. The agreement was reached between the Council, Parliament and Commission on 15 December. The formal adoption is expected in the first half of 2016.

text: The Proposal creates two distinctions concerning the personal scope of the measure proposed: one between EU nationals and TCN, and the other one between EU nationals that only have the citizenship of an EU Member State and EU nationals that also have the citizenship of a third country. The two distinctions appear as a result of the creation of the index-filter, which will contain data of TCN, including data of EU citizens that also hold the nationality of an EU Member State. To this effect, Article 1(4) of the Proposal (new

text: Article 4

text: a(4) of the future ECRIS-Directive) specifies that the creation of the index-filter "apply … also regarding third country nationals who hold the nationality of a Member State". This distinction is also made in the new

text: Article 4

text: b(2) on the "use of index-filters".

text: To this effect, see paragraph 7 above and the reference therein. 34 Explanatory Memorandum, p. 3. 35

text: Heinz Huber v. Germany, 16.12.2008, at 81. 36

text: Huber, at 75.

text: Ultimately, the aim of enacting data protection legislation in any area (commercial or criminal matters) is "to ensure a high level of protection of the fundamental rights and freedoms of natural persons, (...), with respect to the processing of personal data" , including the right to non-discrimination. Therefore, a situation in which the processing of personal data would breach the fundamental rights of the persons whose data are processed, such as the right to nondiscrimination as enshrined in Article 21 of the EU Charter, would not be compliant with EU data protection law.

text: See Article 1(1) of the Council Framework Decision 2008/977/JHA and Article 1(1) of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ L 281 23/11/1995, p. 0031 - 0050. 38 Opinion of the EDPS on the Proposal for a Council Framework Decision on the organisation and content of the exchange of information extracted from criminal records between Member States (COM (2005) 690 final), OJ C 313/26, 20.12.2006, paras 15 and 18. 39 "European Agenda on Security" - Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions of 28 April 2015, COM(2015) 185 final.

identifier: EDPS yttrande 03/2016

amnesord:
Police Cooperation
ECRIS
Biometrics

title: Exchange of information regarding criminal records

text: Opinion 3/2016

text: Opinion on the exchange of information on third country nationals as regards the European Criminal Records Information System (ECRIS)

text: 13 April 2016

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 41(2) of Regulation 45/2001 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to privacy, are respected by the Community institutions and bodies’, and ‘…for advising Community institutions and bodies and data subjects on all matters concerning the processing of personal data’. Under Article 28(2) of Regulation 45/2001, the Commission is required, 'when adopting a legislative Proposal relating to the protection of individuals' rights and freedoms with regard to the processing of personal data...', to consult the EDPS.

text: He was appointed in December 2014 together with Assistant Supervisor with the specific remit of being constructive and proactive. The EDPS published in March 2015 a five-year strategy setting out how he intends to implement this remit, and to be accountable for doing so.

text: This Opinion relates to the EDPS' mission to advise the EU institutions on the data protection implications of their policies and foster accountable policymaking - in line with Action 9 of the EDPS Strategy: 'Facilitating responsible and informed policymaking'. The EDPS considers that compliance with data protection requirements will be key to the success of exchanging information on the criminal records of third country nationals through ECRIS.

text: 1 | P a g e

text: Executive Summary

text: The extension of the exchange of information regarding criminal records in the EU to third country nationals (TCN) in the ECRIS (European Criminal Records Information System) has been envisaged for a long time by the EU legislator. The Proposal to extend ECRIS to TCN was accelerated by the EU Agenda on Security, which acknowledged that ECRIS "does not work effectively for non-EU nationals convicted in the EU".

text: The ECRIS framework currently uses the Member State nationality of convicted persons as a central point in the exchange of information. This is why the creation of a parallel system is justified for third country nationals. The Commission chose to implement the exchange of information regarding the criminal records of third country nationals in a decentralised system, through the use of an index-filter for each participating Member State. The indexfilter will be updated with specific information every time a third country national is convicted and will be sent to the other Member States.

text: The EDPS has carefully analysed the legislative Proposal and issues recommendations with a view to assist the legislator and to ensure that the new measures will be compliant with EU data protection law, and in particular Articles 7 and 8 of the EU Charter of Fundamental Rights.

text: While the EDPS welcomes the proposal of an EU decentralised system to process data related to criminal records of TCN, based on a "hit/no hit" search feature and using technical measures intended to limit interferences in the rights to respect for private life and for personal data protection, the EDPS raises three main concerns and other additional recommendations, further detailed in the Opinion.

text: Firstly, a corresponding regime for TCN as the one existing for EU nationals regarding processing of fingerprints should be put in place, which takes into account the specificity of the national criminal systems, meeting thus the requirements of necessity and proportionality of the processing of personal data.

text: Secondly, the text of the Proposal inaccurately refers to the information in the index-filter as being "anonymous". The EDPS recommends the clarification that the information processed for the purposes of ECRIS-TCN is personal data, which has undergone a process of pseudonymisation, and not anonymous data.

text: Thirdly, the EDPS considers that creating a different type of system to process data for EU nationals that have a third country nationality other than the one in place for EU nationals does not meet the requirements of necessity in EU data protection law and could lead to discrimination. Therefore, the EDPS recommends that the measures in the Proposal only refer to TCN and not also to EU nationals that also have a third country nationality.

text: 2 | P a g e

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty of the Functioning of the European Union, and in particular its Article 16,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, and in particular Articles

text: and

text: (d) thereof,

text: Having regard to Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: I. INTRODUCTION AND BACKGROUND

text: I.1 Consultation of the EDPS

text: 1. On 19 January 2016 the European Commission published a Proposal for a Directive of the European Parliament and of the Council amending Council Framework Decision 2009/315/JHA, as regards the exchange of information on third country nationals and as regards the European Criminal Records Information System (ECRIS), and replacing Council Decision 2009/316/JHA ('the Proposal') . The EDPS was consulted informally before the publication of the Proposal. However, the EDPS regrets to have not received a request for an Opinion after the publication of the Proposal. I.2 Objective of the Proposal

text: 2. ECRIS is an electronic system for exchanging information on previous convictions handed down against a specific person by criminal courts in the EU for the purposes of criminal proceedings against a person, and, if so permitted by national law, for other purposes. The system is based on Council Framework Decision 2009/315/JHA ('the Framework Decision') and Council Decision 2009/316-JHA . 4 | P a g e

text: 3. According to the Explanatory Memorandum accompanying the Proposal, the underlying principle of ECRIS is that complete information on previous convictions of an EU national can be obtained from the Member State of nationality of that person, which can provide exhaustive up-to-date information on the criminal records of its nationals upon request, regardless of where in the EU convictions were handed down. This architecture makes it presently difficult for authorities to exchange information on convictions concerning third country nationals and stateless persons (hereinafter: TCN) through ECRIS, as "TCN have no Member State of nationality", and "in order to obtain a complete overview of the criminal records history of a particular individual requests must be sent to all the convicting Member State(s)" .

text: 4. Therefore, the objective of the Proposal is to improve the efficiency of ECRIS with regard to the exchange of information concerning the criminal records of TCN.

text: 5. The Explanatory Memorandum describes the system that was chosen to achieve this objective. The system will be organised in a decentralised way, meaning that there will not be a single EU database containing the relevant information, but each Member State will maintain a data file. Member States will have to extract identity data from their criminal record and feed it into a separate file - "the index-filter", whenever a TCN is convicted. The data will be converted into "locks and keys". The index-filter will be distributed to all Member States, enabling them to search independently at their own premises. The system will allow the Member States to match their own data against the file and to find out whether further entries in criminal records exist in other Member States (a "hit/no hit" system). II. DATA PROTECTION IMPLICATIONS

text: 6. The EDPS welcomes the reference in Recital 12 of the Proposal, to Council Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters and its application in the context of computerised exchange of information extracted from criminal records of Member States, providing for an adequate level of data protection when information is exchanged between Member States, whilst allowing for Member States to require higher standards of protection to national data processing. In addition, the EDPS notes that the proposed Data Protection Directive for criminal matters (DPD) will be fully applicable to the processing of personal data envisaged by the Proposal, once it enters into force. Therefore, the EDPS recommends that the Preamble of the Proposal includes a reference to the DPD, clarifying the relationship between the instruments.

text: 7. The measures laid down in the Proposal involve processing of personal data and, therefore, they constitute an interference with the fundamental right to private life, as enshrined in Article 7 of the Charter of Fundamental Rights of the EU ('EU Charter'), and with the fundamental right to the protection of personal data, as guaranteed by Article 8 of the EU Charter . In this sense, the EDPS welcomes the reference made in the Explanatory 5 | P a g e Memorandum to the jurisprudence of the Court of Justice of the EU applying Articles 7 and 8 of the EU Charter with regard to access of authorities to personal data for law enforcement purposes, and especially to the Digital Rights Ireland (‘DRI’) case.

text: 8. Article 52(1) of the Charter provides that any limitation on the exercise on the exercise of the rights and freedoms laid down by the Charter must be provided for by law, respect their essence and, subject to the principle of proportionality, limitations may be made to those rights and freedoms only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others .

text: 9. The fight against terrorism and fight against serious crime in order to ensure public 8 security is recognized as an objective of general interest in EU law . As acknowledged in the preamble of the Proposal, "the exchange of information on criminal convictions is important in any strategy to combat crime and counter terrorism" (Recital 7). The proposed measures, therefore, meet an objective of general interest and can be justified, subject to the principle of proportionality. The analysis below focuses on several aspects regarding the proportionality of the proposed measures; it will also highlight the need to better define the material scope of the Proposal, in relation to the type of data processing (anonymisation/pseudonymisation). II.1 Material scope of the measure proposed A. Processing of fingerprints

text: 10. According to the Proposal, on the one hand, Member States will have an unconditional (except for cases where prints cannot be taken for factual reasons ) obligation to store the fingerprints of convicted TCN, according to Article 1(4) of the Proposal. In addition, fingerprints of TCN must be stored in the index-filter. On the other hand, Member States only have to store fingerprints of convicted EU citizens when they are available to the central authority (

text: Article 11(1)

text: (c)(ii) of the Framework Decision). It is understood that the fingerprints of EU citizens thus may or may not, in accordance with national legislation, be available to the central authority.

text: 11. The proposed compulsory collection, storage and use of fingerprints for the ECRIS-TCN system is an interference according to both Articles 7 and 8 of the Charter. In this sense, the Court of Justice of the European Union (CJEU) found in its Schwarz judgment that "the taking and storing of fingerprints by the national authorities (...) constitutes a threat to the rights to respect for private life and the protection of personal data" . While the use and storage of fingerprints for ECRIS-TCN indeed pursues a legitimate interest, as required by Article 52(1) of the Charter, namely the fight against terrorism and fight against serious crime in order to ensure public security, it must be assessed whether the measure is necessary and proportionate.

text: 12. As a preliminary remark, it must be noted that "the conditions under which Member States store fingerprints during criminal investigations and proceedings are not harmonised 6 | P a g e by EU law" . In practice, this means that Member States currently have different rules for storing fingerprints for law enforcement purposes, depending on the seriousness of crimes and offences. A factor to consider when assessing the necessity of the compulsory use of fingerprints is that each Member State has its unique criminal law policy, with different thresholds of the gravity of offences which require the storage of fingerprints of convicted persons in their own judicial databases . As a consequence, a situation may arise that a Member State may be obliged pursuant to the Proposal to collect and store the fingerprints of a person for a minor offence (which represents an interference in the person's right to private life), while its national law does not require the fingerprints to be stored in relation to the criminal record of that person.

text: 13. The obligation of Member States to store the fingerprints of all convicted TCN in the index-filter is justified by the legislator through the need to "secure identification" , having regard to the fact that "this is the only way to be sure of the identity of the person" . The added value of using fingerprints especially for the identification of TCN must be recognised, to the extent that it is conceivable there can be cases of TCN who do not have identification documents or whose names are written in alphabets which are not used by the official languages of the Union, leaving thus room for misidentification.

text: 14. However, according to the Explanatory Memorandum, many Member States’ central authorities do not currently store fingerprints in their national criminal record registers and 15 are not connected to the national automated fingerprint identification system (AFIS) . Member States also invoked "constitutional concerns" raised by the obligation to store fingerprints of all convicted TCN, irrespective of the type of offence or crime committed.

text: 15. It cannot, therefore, be considered that there is no other way to ensure identification of the persons then to use fingerprints and the necessity of the compulsory use of fingerprints for TCN in ECRIS is therefore yet to be demonstrated.

text: 16. Having regard to all of the above, it does not seem necessary, nor proportionate to impose an obligation to all Member States to store the fingerprints of TCN, regardless of the sanction thresholds and the nature of offences in their own national systems. The EDPS recommends the legislator to consider creating a corresponding regime for TCN as the one existing for EU nationals regarding processing of fingerprints, by extending the scope ratione personae of Article 11 of the current Framework Decision 2009/315/JHA to TCN. This would make storage of fingerprints optional at national level, in compliance with the constitutional systems of the Member States, but it would maintain the obligation that whenever fingerprints of TCN are stored at national level, they must be inserted in the index-filter. 7 | P a g e

text: 17. The EDPS has emphasised in previous Opinions related to data-bases containing biometric data that "the inherently sensitive nature of biometric data requires specific safeguards" , such as a targeted impact assessment on the use of biometrics, putting an emphasis on the enrolment process (the way they will be collected), highlighting the level of accuracy and putting in place a fall-back procedure, in order to respect the dignity of persons who could have been wrongly identified and to avoid transferring onto them the burden of the system imperfections .

text: 18. As for the measure at hand, the Impact Assessment of the Proposal contains dedicated sections to the analysis of the use of fingerprints, taking into account several options – centralised/decentralised storage, compulsory/voluntary use. In addition, the legislative Proposal contains specific safeguards that take into account the sensitive nature of biometric data. Both the mechanism to pseudonymise data within the index-filter and the implementation of an EU decentralised "hit/no hit" system are welcome safeguards concerning the processing of fingerprints in the data file. In addition, the EDPS recommends that in the following implementing acts to be proposed by the Commission, further safeguards are inserted concerning the enrolment process, highlighting the level of accuracy and putting in place a fall-back procedure. B. Anonymisation/pseudonymisation

text: 19. The Proposal refers to an "anonymous" index filter allowing Member States to check if other Member States hold information about a specific TCN. According to the information provided, the EDPS considers that the information provided cannot be qualified as "anonymous", because of the nature of the system, which is to allow the identification of individuals that have a criminal record issued by another Member State. In order to assess the usage of terminology in the Proposal, it is appropriate to revisit the relevant definitions:  "Personal data" are defined in the EU legal order as meaning "any information relating to an identified or identifiable natural person 'data subject'; an identifiable person is one who can be identified, directly or indirectly" . The term thus also covers indirect identification, e.g. via a reference number;  "Pseudonymisation" is defined in DPD as "the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information, as long as such additional information is kept separately and subject to technical and organisational measures to ensure non-attribution to an identified or identifiable person" . Pseudonymised data are thus still personal data and as such within the scope of data protection law;  "To make anonymous" is defined in

text: Article 2

text: (k) of the Council Framework Decision 2008/977/JHA as "to modify personal data in such a way that details of personal or material circumstances can no longer or only with disproportionate investment of time, cost and labour be attributed to an identified or identifiable natural person". The

text: Article 29

text: Working Party found that "'anonymised data' would therefore be anonymous data that previously referred to an identifiable person, but where that 8 | P a g e identification is no longer possible" . As they are not related to identified or identifiable natural persons, "anonymous data" are thus outside the scope of data protection law. It is against these established definitions that the wording of the Proposal needs to be assessed.

text: 20. The Proposal enables two different processing operations of personal data belonging to TCN, in addition to the exchange of information per se. The first processing operation of 22 personal data is the "storage" by Member States of a set of 11 personal data items , including fingerprints of the person, "where a conviction is handed down against a third country national (...), unless, in exceptional individual cases, this is not possible" .

text: 21. The second processing operation of personal data is the creation and use of the indexfilter. Article 1(4) of the Proposal, inserting an

text: Article 4

text: a(2) in the ECRIS Directive, provides that "the central authority shall create an index-filter containing anonymised information" (our emphasis), which must contain five of the data items stored by Member States , including fingerprints. According to the Explanatory Memorandum, the index-filter as described above "will not contain personal data" , because the information that will be 26 stored in the index-filter will be "anonymised" . Moreover, the Preamble of the Proposal further states that "[t]he personal data should be rendered anonymous in such a way that the data subject is not identifiable" (our emphasis).

text: 22. Therefore, it is clear that the very purpose of the existence of the index-filter containing fingerprints is in fact the precise identification of TCN who have a criminal record in other Member States, by identifying those Member States and further requiring all available information regarding that specific TCN who is the subject of the search. As according to established definitions any information relating to an identified or identifiable natural person is personal data this includes the information which is contained by the index-filter. The Explanatory Memorandum of the Proposal itself specifies that "to secure effective identification of third country nationals, fingerprints should be included in the identification data to be stored in the person's criminal record and in the index-filter" . 9 | P a g e

text: 23. Even though the process used for feeding data in the index-filter is described as 29 "irreversible" , the fact remains, beyond doubt, that the purpose of the processing data in the index-filter is the identification of specific TCN that have criminal records in other Member States by producing a "hit/no hit" result. The "hit/no hit" result, together with the identity data used to search the index filter lead to the identification of natural persons and additional information about them (i.e. whether they have a criminal record in one or more of the other Member States).

text: 24. The data processed in the index-filter cannot, therefore, be defined as "anonymous". It appears that it is pseudonymised instead - which is personal data subjected to the process of pseudonymisation as described in paragraph 9 above.

text: 25. While we appreciate the technique envisaged to transform the data in the index-filter into "locks and keys" as an appropriate safeguard to limit the interferences to the right to private life and the right to personal data protection of the individuals concerned , we underline that data protection law applies to the data in the index-filter. Therefore, we recommend that, for the purposes of clarity and legal certainty, the text of the Proposal should be synchronised with the text of the DPD to the extent that references to anonymous data should be removed from the Proposal and replaced with accurate references to the process of pseudonymisation. C. Categories of personal data to be processed

text: 26. Article 1(4) of the Proposal introducing a new

text: Article 4

text: a(1) in the ECRIS-Directive specifically lists the data to be stored by the central authority of a Member State in the case of a conviction of a TCN. A similar list is laid down in Article 11 of the current Framework Decision for the EU nationals that have been convicted. Article 11 of the Framework Decision - compared to the new

text: Article 4

text: a - is more limited with regard to the interference in the private life of EU nationals. It creates three different categories of data to be processed for the purposes of ECRIS: obligatory information, optional information (e.g. names of convicted person's parents) and additional information. This differentiation does not exist for the data of TCN to be processed for the purposes of ECRIS.

text: 27. In practice, by comparing the two lists, it is apparent that the information items concerning "the convicted person’s parents’ names", "the reference number of the conviction" and "the place of the offence", which are optional information to be transmitted in the case of EU nationals, are compulsory information to be transmitted in the case of TCN. Having two different articles in the proposed Directive that detail the information to be exchanged, one article applicable to EU nationals, and the other applicable to TCN, does not appear to be justified. There is additional information required about TCN, which for EU nationals is just optional information. This distinction could be justified only if it is based on 10 | P a g e strong and precise legal reasoning, which does not seem to be available. The EDPS recommends extending the ratione personae scope of application of

text: Article 11

text: ("Format and other ways of organising and facilitating exchanges of information on convictions") of the Framework Decision 2009/315/JHA to TCN, instead of inserting an additional article in the Directive that specifically lists the information of TCN to be processed. II.2 Personal scope of the measure

text: 29. The EDPS recalls that Article 8(2) of the Charter requires that processing of personal data must be fair. In addition, as shown above, processing of personal data represents an interference with the right to the protection of personal data , and Article 52(1) of the Charter requires that any interference with

text: Article 8

text: must be necessary and proportionate.

text: 30. The distinction between TCN and EU nationals made with regard to different ways of processing their personal data seems to be necessary, because it is justified by objective factors related to the purpose of the measures proposed, as described in paragraph 3 of this Opinion. Particularly, the creation of the index-file for TCN is justified by the fact that TCN do not have a Member State of nationality, so that the regular ECRIS procedure for exchange 34 of information cannot be applied to them .

text: 31. With regard to the distinction between EU nationals who are only EU nationals and EU nationals who are also the citizens of a third country, the necessity of the measure is not demonstrated. If a certain processing operation, such as the processing of data in the indexfilter, is not needed for EU nationals, it is not needed for EU nationals who are also TCN, either.

text: 32. In Huber, the Court of Justice found that former

text: Article 12(1)

text: EC providing for the right to non-discrimination based on nationality within the EU (current

text: Article 18(1)

text: TFEU) "must be interpreted as meaning that it precludes the putting in place by a Member State, for the purpose of fighting crime, of a system for processing personal data specific to Union citizens who are not nationals of that Member State" . The Court recalled that "comparable situations must not be treated differently and that different situations must be treated in the same way. Such treatment may be justified only if it is based on objective considerations independent of the nationality of the persons concerned and is proportionate to the objective being legitimately pursued" (our emphasis). 11 | P a g e

text: 33. The difference of treatment contained in the proposal does not seem to be necessary to achieve the objective pursued, considering that for EU nationals the existing procedures of ECRIS can be applied in order for authorities to share information. The Explanatory Memorandum of the proposal does not provide any explanation as to why such a distinction would be necessary. This difference of treatment may result in discrimination, which would breach Article 21(1) of the EU Charter. This Article prohibits, within the scope of application of the TEU, "any discrimination based on any ground" which cannot be justified in accordance with Article 52(1) of the Charter.

text: 35. The EDPS therefore recommends that the index-filter is limited only to information pertaining to TCN, without EU nationals who also hold the citizenship of a third country. II.3 Data quality

text: 36. The EDPS welcomes the provision in the Proposal in

text: Article 4

text: a(3) of an automatic update of the personal data contained in the index-filter, following any alteration or deletion of the information, which is similar to the obligation enshrined in Article 4(3) of the current Council Framework Decision 2009/315/JHA with regard to the criminal records of EU nationals. Accuracy of information is particularly important in the exchange of information in criminal matters, where a person can be subject to decisions having legal effects or adverse effects as a consequence of the processing of data. III. CONCLUSION

text: 37. As already stated in the EDPS 2006 Opinion on the ECRIS Proposal, "for third country nationals, an alternative system might be needed", because "for obvious reasons, the proposed system cannot work in those cases" . We therefore welcome the current Proposal and we acknowledge the importance of efficient exchange of information extracted from criminal records of convicted persons, particularly in the context of the adoption of the EU Agenda on Security . 12 | P a g e

text: 38. After carefully analysing the Proposal, the EDPS makes the following recommendations, in order to ensure compliance with EU data protection law: 1) With regard to the compulsory use of fingerprints for TCN, a corresponding regime for TCN as the one existing for EU nationals should be created, in line with the existing rules on collecting fingerprints at national level; 2) References to anonymous data should be removed from the Proposal and replaced with accurate references to the process of pseudonymisation; 3) The data to be stored at national level regarding convicted EU nationals and convicted TCN should not be differently categorised, by extending the same regime currently existing for EU nationals (e.g. "optional data", "additional data") to TCN as well; 4) The use of the index-filter system should be limited only to personal data of TCN, a category of persons that should not include EU nationals who also hold the citizenship of a third country.

text: 39. In addition, the EDPS makes the following recommendations which would strengthen the protection of personal data processed for the purposes of ECRIS-TCN: 1) The Preamble of the Proposal should include a reference to the DPD, clarifying the relationship between the instruments; 2) Further safeguards should be provided for the processing of fingerprints in the Implementing Acts to be proposed by the Commission, concerning the enrolment process, highlighting the level of accuracy and putting in place a fall-back procedure; Done in Brussels, 13 April 2016 Giovanni BUTTARELLI European Data Protection Supervisor 13 | P a g e