text: COM(2023) 185 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 185 final. 4 See page 3 of the Explanatory Memorandum. https://commission.europa.eu/system/files/2023-01/cwp2022_en.pdf 6 Commission Communication on the EU Strategy to tackle Organised Crime 2021-2025, COM(2021) 170 final. 4

text: See Art 23 of the Proposal. 8 Proposal for a Regulation of the European Parliament and of the Council on the digitalisation of judicial cooperation and access to justice in cross-border civil, commercial and criminal matters, and amending certain acts in the field of judicial cooperation, COM(2021) 759 final. 9 See recital 53 of the Proposal. 10 See EDPS Formal comments on the Proposal for a Regulation of the European Parliament and of the Council on the digitalisation of judicial cooperation and access to justice in cross-border civil, commercial and criminal matters, and amending certain acts in the field of judicial cooperation, issued on 25 January 2022.

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89). 12 Art 15(1)-“The competent authority shall be regarded as controller within the meaning of

text: Regulation (EU) 2016/679

text: Regulation (EU) 2018/1725

text: or

text: Directive (EU) 2016/680

text: with respect to the processing of personal data sent or received through the decentralised IT system.” 13

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1). 14 )-“competent authorities” means courts, public prosecutors, Union agencies and bodies and other authorities taking part in

text: Article 2

text: (1 judicial cooperation procedures in accordance with the provisions of the legal acts listed in Annex I and Annex II. 15 See recital 55 of the Proposal. 16 See recital 54 of the Proposal. 6

identifier: EDPS yttrande 20/2023

title: EDPS Opinion 20/2023 on the Proposal for a Regulation on the transfer of proceedings in criminal matters

text: 22 May 2023

text: Opinion 20/2023

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on the transfer of proceedings in criminal matters . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 5 April 2023, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on the transfer of proceedings in criminal matters.

text: The EDPS fully supports the aim of the Commission to provide for common rules to transfer criminal proceedings from one Member State to another in order to efficiently fight cross-border crime and to ensure that the best-placed Member State investigates or prosecutes a criminal offence.

text: He also welcomes the clarification in the Proposal that the future Regulation would be the legal basis for the exchange of personal data between the Member States for the transfer of criminal proceedings in line with

text: Article 8

text: and

text: Article 10

text: (a) of the

text: Directive (EU) 2016/680

text: The EDPS still invites the legislator to clarify the roles and responsibilities of central authorities pursuant to this Proposal as well as the references to the data protection legal framework.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 5 April 2023, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on the transfer of proceedings in criminal matters (‘the Proposal’).

text: 2. The objective of the Proposal is to adopt a new instrument on the transfer of criminal proceedings between Member States in order to: (1) improve the efficient and proper administration of justice in the EU; (2) improve the respect of fundamental rights in the process of transfer of criminal proceedings; (3) improve efficiency and legal certainty of transfers of criminal proceedings; (4) enable transfers of criminal proceedings, where they are in the interest of justice, but currently not possible between Member States and reduce the phenomenon of impunity .

text: 3. This initiative was included in the Commission’s 2022 work programme and is part of the 2021-2025 EU strategy to tackle organised crime .

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 5 April 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in recital 62 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 5. The EDPS fully supports the aim of the Commission to provide for common rules to transfer criminal proceedings from one Member State to another in order to efficiently fight cross- border crime and to ensure that the best-placed Member State investigates or prosecutes a criminal offence.

text: 6. The EDPS also welcomes the clarification in recital 58 of the Proposal that the future Regulation would be the legal basis for the exchange of personal data between the Member States only for the transfer of criminal proceedings. In that regard, recital 58 states: “This Regulation should create the legal basis for the exchange of the personal data between the Member States for the purposes of the transfer of criminal proceedings in line with

text: Article 8

text: and

text: Article 10

text: (a) of the

text: Directive (EU) 2016/680

text: . However, as regards any other aspect, such as the time period for the retention of personal data received by the requesting authority, the processing of personal data by the requesting and requested authorities should be subject to the national laws of Member States adopted pursuant to the

text: Directive (EU) 2016/680

text: 7. The EDPS notes that the Proposal also envisages the use of a decentralised IT system (within the meaning of the Proposal for the digitalisation of justice ) in order to ensure swift, direct, interoperable, reliable and secure exchange of case-related data, communication between the requesting and requested authorities and with the involvement of central authorities, where a Member State has designated a central authority, as well as with Eurojust . The EDPS understands the need for the digitalisation of justice, with the aim of improving access to justice and the efficiency and resilience of the communication flows inherent to the cooperation between judicial and other competent authorities in EU cross-border cases. He agrees it is important that appropriate channels are developed to ensure that justice systems can efficiently cooperate digitally and under the condition that the digital channels used ensure a high level of security of communication enabling the safeguarding the rights of the persons concerned and protection of their privacy and personal data .

text: 3. Roles and responsibilities

text: 8. The EDPS reminds that the concept of controller and its interaction with the concept of processor play a crucial role in the application of the data protection framework, since they determine who shall be responsible for compliance with different data protection rules and how data subjects can exercise their rights in practice.

text: 9. The EDPS therefore welcomes recital 58 of the Proposal clarifying that the requesting and requested authority, when exchanging personal data for the purposes of the transfer of criminal proceedings, should be considered as controllers with respect of the processing of 5 personal data under

text: Directive (EU) 2016/680

text: (‘LED’). This is confirmed in Article 22(2) of the Proposal, when referring to Article 15(1) of the Proposal for the digitalisation of justice .

text: 10. According to the same recital 58 of the Proposal, the central authorities provide administrative support to the requesting and requested authorities and, to the extent they are processing personal data on behalf of those controllers, they should be considered as processors of the respective controller. However, the recital does not clarify whether, concerning their specific tasks under the Proposal, the central authorities would be deemed competent authorities within the meaning of

text: Article 3 (7)

text: LED or whether, given their purely administrative support, they would be processing personal data under

text: Regulation (EU) 2016/679

text: (‘the GDPR’). The EDPS therefore considers it necessary to clearly indicate under which data protection legislation would the central authorities act.

text: 11. In addition, as already mentioned, Article 22(2) of the Proposal refers to Article 15(1) of the Proposal for the digitalisation of justice with regard to the designation of the role of the competent authorities. However, it would seem that the definition of a competent authority in the Proposal for the digitalisation of justice includes central authorities as well, which would then imply that they are also designated as controllers within the meaning of Article 22(2) of the Proposal in connection with Article 15(1) of the Proposal for the digitalisation of justice. Therefore, there appears to be a discrepancy between recital 58 and Article 22(2) of the Proposal which should be removed in order to clearly determine the role and responsibilities of the central authorities under the Proposal.

text: 4. The reference implementation software

text: 12. The EDPS welcomes the intention of the Proposal to ensure that the Commission designs, develops and maintains the reference implementation software in a way that allows the controllers to ensure compliance with the data protection requirements and principles, in particular the obligations of data protection by design and by default as well as high level of cybersecurity . Member states would have the possibility to use this software instead of a national IT system . However, the EDPS notes that recital 55 of the Proposal specifies that the reference implementation software developed by the Commission should allow the controllers to ensure compliance with inter alia the GDPR. Given that recital 58 only refers to controllers under the LED, the EDPS recommends aligning these two recitals to avoid inconsistencies.

text: 5. Conclusions

text: 13. In light of the above, the EDPS makes the following recommendations: (1) to clarify the roles and responsibilities of central authorities in recital 58 and Article 22(2) of the Proposal, (2) to clarify and align recitals 55 and 58 when it comes to references to the data protection legal framework. Brussels, 22 May 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7


text: COM(2024) 298 final. COM(2024) 299 final. 1

text: OJ L 295, 21.11.2018, p. 39. 4

text: Regulation (EU) 2018/1727

text: of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council Decision 2002/187/JHA (OJ L 295, 21.11.2018, p. 138).

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89). 6 At the moment, the only existing adequacy decision under the LED is on the United Kingdom, available at https://eurlex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D1773. 7 COM(2020) 743 final. 8 EDPS Opinion 10/2020 on the negotiating mandate to conclude ten agreements allowing the exchange of data between Eurojust and the competent authorities for judicial cooperation in criminal matters in certain third countries. 4

text: Council Decision authorising the opening of negotiations for Agreements between the European Union and Algeria, Argentina, Armenia, Bosnia and Herzegovina, Brazil, Colombia, Egypt, Israel, Jordan, Lebanon, Morocco, Tunisia and Turkey on cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the competent authorities for judicial cooperation in criminal matters of those third States, see 6153/21 + ADD 1, Council Decision adopted by written procedure on 1 March 2021 (CM 1990/21). 10 See Explanatory Report, COM(2024) 298 and 299 final, p. 2. 11 COM(2024) 298 final. 12 COM(2024) 299 final. 13 See Article 1 of the Annexes to the Proposals. 14 See Explanatory Report, COM(2024) 298 and 299 final, p. 1. 5

text: For further details see the EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data, issued on 19 December 2019, https://edps.europa.eu/sites/edp/files/publication/19- 12- 19_edps_proportionality_guidelines_en.pdf. 16 See Judgments of the Court of Justice of 6 October 2020, La Quadrature du Net and others, joined cases

text: and 520/18, ECLI:EU:C:2020:791, paragraph 130, of 8 April 2014 in Joined Cases

text: and

text: , Digital Rights, EU:C:2014:238, paragraph 52; and Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592, paragraph 140. 17 In accordance with Article 26 of the Eurojust Regulation,

text: Article 3

text: and Chapter IX of EUDPR apply to the processing of operational personal data by Eurojust. 18 See Explanatory Report, COM(2024) 298 and 299 final, p. 2 and 3. 6

text: See to that effect

text: Article 56

text: and recital 45 of the Eurojust Regulation. 20 Opinion 1/15, EU-Canada PNR Agreement, ECLI:EU:C:2017:592, par. 219. 7

identifier: EDPS yttrande 20/2024

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 20/2024 on two Proposals for Council Decisions on the signing and conclusion of Agreement between EU and Bosnia & Herzegovina on cooperation between Eurojust and authorities of Bosnia & Herzegovina for judicial cooperation in criminal matters

serie: yttranden

text: 6 September 2024

type: rubrik

text: Opinion 20/2024

text: on two Proposals for Council Decisions on the signing and conclusion of an Agreement between the EU and Bosnia and Herzegovina on the cooperation between Eurojust and the authorities of Bosnia and Herzegovina competent for judicial cooperation in criminal matters

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Council Decision on the signing, on behalf of the Union, of an Agreement between the European Union and Bosnia and Herzegovina on the cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the authorities of Bosnia and Herzegovina competent for judicial cooperation in criminal matters , and the Proposal for a Council Decision on the conclusion, on behalf of the European Union, of an Agreement between the European Union and Bosnia and Herzegovina on the cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the authorities of Bosnia and Herzegovina competent for judicial cooperation in criminal matters .

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposals and the future Agreement that are relevant from a data protection perspective.

text: Executive Summary

text: On 16 July 2024, the European Commission issued two Proposals for Council Decisions, under

text: Article 16(2)

text: and

text: Article 85

text: in conjunction with

text: Article 218(5)

text: Article 218(6)

text: , second subparagraph, point (a)(v), and Article 218(7) of the Treaty on the Functioning of the European Union, one on the signing and other on the conclusion, on behalf of the Union, of an Agreement between the European Union, of the one part, and Bosnia and Herzegovina, of the other part, on cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the authorities of Bosnia and Herzegovina competent for judicial cooperation in criminal matters. The proposals are accompanied by an Annex containing the agreed text of the Agreement.

text: The objective of the future Agreement is to enhance judicial cooperation between Eurojust and the competent authorities of Bosnia and Herzegovina by allowing the transfer of personal data between Eurojust and the competent authorities of Bosnia and Herzegovina, in order to support and strengthen their cooperation in investigating and prosecuting serious crime, in particular organised crime and terrorism, while ensuring appropriate safeguards with respect to fundamental rights and freedoms of individuals, including privacy and the protection of personal data.

text: The EDPS has already had the opportunity to comment on the exchange of personal data between Eurojust and the competent authorities of Bosnia and Herzegovina in his Opinion 10/2020, where the EDPS provided several recommendations in order to clarify and, where necessary, further develop the safeguards and controls with respect to protection of personal data. The EDPS notes with satisfaction that his recommendations have been taken into account and that the provisions of the future Agreement are consistent with the provisions of Chapter IX of EUDPR on the processing of operational personal data by union bodies, offices and agencies. As a result, it could be concluded that the presented Agreement between the EU and Bosnia and Herzegovina adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

text: At the same time, in this Opinion, the EDPS provides some recommendations, in particular with regards to onward transfers of personal data, the right to erasure of personal data, the possibility to postpone transfer of personal data and on the review and evaluation of the Agreement, aimed at facilitating the practical implementation of the future Agreement by Eurojust and the competent authorities of Bosnia and Herzegovina.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: Regulation (EU) 2018/1727

text: (‘Eurojust Regulation’) lays down specific rules regarding transfers of personal data by Eurojust to third countries and international organisations.

text: Article 56(2)

text: thereof lists a number of legal grounds, based on which Eurojust could lawfully transfer data to authorities of third countries, such as an adequacy decision of the Commission in accordance with

text: Article 36 of Directive (EU) 2016/680

text: finding that the third country ensures an adequate level of protection ; a cooperation agreement allowing for the exchange of operational personal data concluded before 12 December 2019 between Eurojust and the given third country or international organisation; or an international agreement between the Union and the third country or international organisation pursuant to

text: Article 218

text: TFEU that provides for adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

text: 2. On 19 November 2020, the Commission adopted a Recommendation for a Council Decision authorising the opening of negotiations for Agreements between the European Union (EU) and Algeria, Armenia, Bosnia and Herzegovina, Egypt, Israel, Jordan, Lebanon, Morocco, Tunisia and Turkey on cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the competent authorities for judicial cooperation in criminal matters of those third States .

text: 3. The European Data Protection Supervisor issued an Opinion regarding the Recommendation on 17 December 2020. The Council granted the authorisation for the opening of the negotiations on 1 March 2021, adding also Argentina, Brazil and Colombia to the list, and adopted a set of negotiating directives .

text: 4. The negotiations with Bosnia and Herzegovina began in October 2023 and a preliminary agreement was reached in January 2024 . Consequently, on 16 July 2024, the Commission issued a Proposal for a Council Decision on the signing, on behalf of the Union, of an Agreement between the European Union and Bosnia and Herzegovina on the cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the authorities of Bosnia and Herzegovina competent for judicial cooperation in criminal matters , and the Proposal for a Council Decision on the conclusion, on behalf of the European Union, of an Agreement between the European Union and Bosnia and Herzegovina on the cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the authorities of Bosnia and Herzegovina competent for judicial cooperation in criminal matters (‘the Proposals’), both accompanied by their respective Annexes containing the final negotiated text of the Agreement.

text: 5. The objective of the future Agreement is to enhance judicial cooperation between Eurojust and the competent authorities of Bosnia and Herzegovina in combating serious crime, by allowing for the transfer of personal data between Eurojust and the competent authorities of Bosnia and Herzegovina, in order to support and strengthen the action by the competent authorities of the Member States of the Union and those of Bosnia and Herzegovina, as well as their cooperation in investigating and prosecuting serious crime, in particular organised crime and terrorism, while ensuring appropriate safeguards with respect to fundamental rights and freedoms of individuals, including privacy and the protection of personal data .

text: 6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 16 July 2024, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 9 of the Proposals.

text: 2. General remarks

text: 7. The EDPS recognises the need for cooperation between Eurojust and judicial authorities of third countries involved in the investigation and prosecution of serious crimes, which do not stop at Union borders. In this regard, Eurojust should be able to cooperate and exchange personal data with them to the extent necessary for the accomplishment of its tasks within the framework of the requirements set out in the Eurojust Regulation .

text: 8. At the same time, transfers of personal data gathered in the context of criminal investigations envisaged under the future Agreement are liable to have a significant impact on the lives of the individuals concerned, as they will be used in prosecution cases in the receiving country under its national law. Consequently, the necessity and proportionality of the envisaged processing need to be assessed in accordance with Article 52(1) of the Charter .

text: 9. In particular, transfers of personal data between Eurojust and the authorities competent for judicial cooperation in criminal matters of Bosnia and Herzegovina constitute an interference with individuals’ rights to privacy and data protection guaranteed by Articles 7 and 8 of the Charter. Therefore, the future Agreement must ensure that the derogations and limitations to rights to privacy and data protection, including in relation to fighting crime, apply only in so far as is strictly necessary . In that regard, the EDPS welcomes Article 10(5) of the future Agreement, obliging the Parties to comply with the safeguards provided for in the Agreement regardless of the nationality of the data subject concerned and without discrimination.

text: 10. As mentioned above, the EDPS has already had the opportunity to comment on the exchange of personal data between Eurojust and the competent authorities of Bosnia and Herzegovina in his Opinion 10/2020, where the EDPS provided several recommendations in order to clarify and, where necessary, further develop the safeguards and controls with respect to protection of personal data. The EDPS notes with satisfaction that his recommendations have been taken into account and that the future Agreement provides for similar data protection safeguards as provided for in Chapter IX of EUDPR with regard to processing of operational personal data by Union bodies, offices and agencies when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part three TFEU .

text: 11. In addition, the EDPS welcomes that, before the future Agreement enters into force, Bosnia and Herzegovina, as an EU candidate country, is required to adopt a new law on personal data protection, in line with the EU acquis, and to ensure the necessary operational capacity and independence of the Personal Data Protection Agency .

text: 12. As a result, it could be concluded that the presented Agreement between the European Union and Bosnia and Herzegovina adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

text: 13. At the same time, the EDPS considers that certain safeguards with respect to the protection of personal data, while already provided for in the future Agreement, may still benefit from additional precision and clarity. In this regard, the subsequent comments by the EDPS aim at facilitating the practical implementation of the Agreement by Eurojust and the competent authorities of Bosnia and Herzegovina as well as to provide guidance for future agreements with other third countries that are still under negotiations or negotiations are still to begin.

text: 3. Onward transfers of personal data received

text: 14. The EDPS recalls that, in accordance with

text: Article 56(6)

text: and recital 45 of the Eurojust Regulation, when personal data are transferred from Eurojust to a third country, the level of protection of natural persons ensured by the Eurojust Regulation and by Union law must not be undermined. This requirement is fully valid also in case of a potential onward transfer of personal data received from Eurojust by the competent authorities of Bosnia and Herzegovina to other authorities in Bosnia and Herzegovina or to the authorities of a third country or to an international organisation .

text: 15. The EDPS therefore welcomes Article 13 of the future Agreement, which prohibits further transferring the personal data received from Eurojust to other authorities of Bosnia and Herzegovina or to the authorities of a third country or to an international organisation, unless such onward transfer is carried out under strictly limited conditions.

text: 16. The EDPS additionally welcomes paragraph 1(c) of

text: Article 13

text: , which lays down that the possible onward transfer to other authorities of Bosnia and Herzegovina is subject to the same conditions and safeguards as those applying to the original transfer.

text: 17. In that regard, although this is not explicitly mentioned in paragraph 2 of the same Article, regulating onward transfers to the authorities of a third country or to an international organisation, the EDPS expects that, when giving its explicit prior authorisation pursuant to paragraph 2(b), Eurojust will assess and clearly indicate the modalities applying to the onward transfer in question. These modalities could be the same conditions and safeguards as those applying to the original transfer, similarly to the explicit obligation in paragraph 1(c) of

text: Article 13

text: , or other conditions and safeguards deemed necessary and appropriate in the specific case.

text: 4. Right of access, rectification, erasure or restriction

text: 18. The EDPS recalls that the right of access and the right to rectification are essential elements of the right to data protection under Article 8(2) of the Charter. Furthermore, as regards Article 7 of the Charter, the European Court of Justice has held that “the fundamental right to respect for private life, enshrined in that article, means that the person concerned may be certain that his personal data are processed in a correct and lawful manner. In order to carry out the necessary checks, that person must have a right of access to the data relating to him which is being processed” . The EDPS therefore welcomes the inclusion, under Articles 14 and 15 of the future Agreement, of a right to access as well as rectification, erasure or restriction.

text: 19. As regards specifically the right to erasure, the EDPS positively notes that paragraph 2 of

text: Article 15

text: prescribes that the Parties must provide for any data subject to have the right to obtain from the authorities processing personal data transferred under the Agreement the erasure of personal data concerning the data subject where the processing of the personal data infringes data protection principles (Article 10(1) of the Agreement) or rules on the transfer of special categories of personal data (

text: Article 11(2)

text: thereof), or where the personal data must be erased in order to comply with a legal obligation to which the authorities are subject.

text: 20. The EDPS considers that even though the provision of

text: Article 15(2)

text: mentions explicitly only infringements of

text: Articles 10(1)

text: or Article 11(2) of the Agreement as grounds enabling the data subject to obtain erasure of personal data, this should not be viewed as an exhaustive list. In particular, it is the understanding of the EDPS that the infringement of

text: Article 10(1)

text: (a) - lawfulness of processing of personal data - should be interpreted broadly, thus covering possible infringements of other legal obligations under the future Agreement, such as those laid down in

text: Article 10(6)

text: and

text: Article 11(1)

text: 5. Postponement of the transfer of personal data

text: 21. The EDPS welcomes the obligation included in Article 29(4) of the future Agreement, according to which a Party may “postpone the transfer of personal data in the event that, and for as long as, the other Party ceases to provide for, and implement, the safeguards and obligations contained in Chapter II (Information exchange and data protection) of this Agreement”.

text: 22. The EDPS considers that it may provide a useful and effective safeguard, especially in cases of third countries that face practical issues to meet the obligations stemming from the Agreement, e.g. amendments of the relevant domestic legislation, legal or organisational changes affecting the supervisory authority, etc.

text: 23. At the same time, the EDPS believes that the provision of

text: Article 29(4)

text: may benefit from additional clarity, in particular as regards the specific context and the modalities of its possible application, as well as its distinction from other provision of the Agreement with similar effect, such as the legal possibility to suspend in whole or in part the application of the Agreement in the event of non-fulfilment of obligations (

text: Article 32(2)

text: ). To this end, in view of ensuring legal clarity and certainty, the EDPS invites the Commission to clarify, e.g. in the Explanatory Memorandum to the Proposal for Council Decision, what are the envisioned cases of application of the provision of Article 29(4) of the future Agreement.

text: 24. Furthermore, the EDPS considers that it is important to clarify who on the EU side would carry out the assessment whether the safeguards and the obligations required by the Agreement are provided for in the law of the third country and implemented in practice - Eurojust, the Commission, or another competent Union body. 8

text: 6. Review and evaluation of the Agreement

text: 25. The EDPS welcomes Article 31 of the future Agreement that provides for the regular review and evaluation of the Agreement and specifically envisages the participation of “relevant experts on data protection” in the respective review teams. In this context, the EDPS recommends the involvement in the review and the evaluation of the Agreement also representatives of the independent data protection authorities.

text: 7. Conclusions

text: 26. In light of the above, the EDPS makes the following recommendations: (1) in case of onward transfers to the authorities of a third country or an international organisation, when giving its prior explicit authorisation, Eurojust to assess and clearly indicate whether the same conditions and safeguards as those applying to the original transfer should also apply to the onward transfer, or whether some other conditions and safeguards are deemed necessary and appropriate in the specific case; (2) regarding the right to erasure pursuant to

text: Article 15(2)

text: , to interpret broadly the infringement of

text: Article 10(1)

text: (a) - lawfulness of processing of personal data - thus providing the data subjects with the right to obtain from the authorities processing personal data transferred under the Agreement the erasure of their personal data also in case of infringements of other legal obligations under the future Agreement, such as

text: Article 10(6)

text: and

text: Article 11(1)

text: ; (3) to clarify the practical application of the safeguard provided for in Article 29(4) of the future Agreement, as well as to clarify who on the EU side would carry out the assessment whether the safeguards and the obligations required by the Agreement are provided for in the law of the third country and implemented in practice; (4) to involve the independent data protection authorities in the future reviews and evaluations of the Agreement. Brussels, 6 September 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 9

type: vagledning

utgivare: edps


text: COM(2025) 339 final. COM(2025) 398 final. 1

text: OJ L 295, 21.11.2018, p. 39. 4 COM(2025) 399 final. COM(2025) 398 final. 6 Conclusion Proposal,

text: Article 1

text: . 4

text: Signing Proposal and Conclusion Proposal, Explanatory Memorandum, page 1 and 2. 8 OJ L359 of 16.12.2014, p. 1 to 29. 9 OJ L, 24.10.2023. 10 EDPS Opinion 9/2023 Opinion 9/2023 on the Proposal for a Council Directive amending Directive

text: on administrative cooperation in the field of taxation. 5

text: Recital 102 GDPR. 12

text: Article 6(2)

text: as updated by the Amending Protocol. 13 Idem. 14 Paragraph 3 of Annex III as updated by Amending Protocol. 15 Paragraph 4 of Annex III as updated by the Amending Protocol. 16 Paragraph 8 of Annex III to the Agreement. 17 The purpose of the processing of his personal data; the legal basis of the processing operation; the recipients of his personal data; the identity of the data controllers; the time-limits for storing the data; the existence of the right to request access to, rectification and erasure of his personal data from the controller; the right to seek administrative and/or judicial redress and the procedure to do so; the right to have recourse to the competent data protection supervisory authority or authorities and the relevant contact details. 6

text: Article 23

text: GDPR, available at the following link https://www.edpb.europa.eu/system/files/2021-10/edpb_guidelines202010_on_art23_adopted_after_consultation_en.pdf 19 Paragraph 10 of Annex III as updated by the Amending Protocol. 20 Paragraph 5 of Annex III to the Amending Protocol. 21

text: Article 7(2)

text: as updated by the Amending Protocol. 22

text: Article 9

text: as updated by the Amending Protocol. 7

identifier: EDPS yttrande 20/2025

amnesord:
International Cooperation
Transfers of data

title: EDPS Opinion the Proposal on the signing and conclusion of the provisional application of the Amending Protocol between the EU and San Marino on the automatic exchange of financial account information to improve international tax compliance

text: Opinion 20/2025

text: on the Proposal for a Council Decision on the signing and conclusion of the Amending Protocol to the Agreement between the European Union and the Republic of San Marino on the automatic exchange of financial account information to improve international tax compliance

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to (i) the Proposal for a Council Decision on the signing, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Republic of San Marino on the automatic exchange of financial account information to improve international tax compliance ; and to (ii) the Proposal for a Council Decision on the on the conclusion, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Republic of San Marino on the automatic exchange of financial account information to improve international tax compliance .

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposals that are relevant from a data protection perspective.

text: Executive Summary

text: The EDPS is consulted on the Proposals for Council Decisions to sign and conclude, on behalf of the Union, the Amending Protocol to the Agreement between the European Union and the Republic of San Marino on the automatic exchange of financial account information to improve international tax compliance.

text: The Amending Protocol aims to ensure that the automatic exchange of financial account information between EU Member States and San Marino is aligned with the updated Common Reporting Standard developed by the Organisation for Economic Co-operation and Development. In addition, the Amending Protocol aims to align the text of the Agreement with the new data protection framework (i.e. the GDPR for EU Members States and and Law No. 171 of 21 December 2018 for San Marino). Finally, the Amending Protocol would ensure that the existing agreement between the European Union and San Marino remains aligned with Union legislation in the same field.

text: The EDPS welcomes the specific provisions on data protection, i.e.

text: Article 6

text: and Annex III of the Agreement, which clarify the purposes of the processing, and provide for - inter alia - data accuracy and data minimisation, storage limitation, security and confidentiality of the data, as well as data subjects rights and restrictions on onward transfers and sharing of data. Taking these provisions into account, the EDPS considers that the Agreement, as updated by the Amending Protocol, provides for appropriate safeguards to enable the transfer of personal data.

text: The EDPS observes that the Agreement would require Member States and San Marino to restrict the scope of the right of access and of the right to information. In this respect, the EDPS recalls the conditions for such restrictions provided under

text: Article 23

text: GDPR.

text: Contents

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 17 July, the European Commission issued: - a Proposal for a Council Decision on the signing on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Republic of San Marino on the automatic exchange of financial account information to improve international tax compliance (‘the Signing Proposal’) ; - a Proposal for a Council Decision on the conclusion, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Republic of San Marino on the automatic exchange of financial account information to improve international tax compliance (‘the Conclusion Proposal’) .

text: 2. The objective of the Signing Proposal is to authorise the signing, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Republic of San Marino (San Marino) on the automatic exchange of financial account information to improve international tax compliance (‘the Agreement’).

text: 3. The objective of the Conclusion Proposal is to approve the Amending Protocol .

text: 4. The Agreement provides the legal basis for the reciprocal automatic exchange of financial account information between the EU Member States and San Marino, in accordance with the Common Reporting Standard (CRS) developed by the Organisation for Economic Cooperation and Development (OECD).

text: 5. The Amending Protocol aims to (i) ensure that the automatic exchange of financial account information between EU Member States and San Marino is aligned with, and continues to take place in accordance with, the updated CRS from 1 January 2026; and to (ii) align the text of the Agreement with the new data protection framework (i.e.

text: Regulation (EU) 2016/679

text: on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General data protection regulation, GDPR) for EU Members States; and Law No. 171 of 21 December 2018 for San Marino) .

text: 6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 17 July 2025, 2025, pursuant to Article 42(1) of the EUDPR. The EDPS welcomes the reference to this consultation in Recital 6 of the Signing Proposal and in Recital 6 of the Conclusion Proposal.

text: 2. General Remarks

text: 7. The EDPS welcomes the objectives pursued by the Proposals, notably to improve administrative cooperation in the area of direct taxation, and to improve international tax compliance. The EDPS acknowledges that the negotiated Amending Protocol ensures that the existing agreement between the European Union and San Marino remains aligned with the Union legislation in the same field, notably

text: Council Directive 2014/107/EU

text: amending Directive

text: on administrative cooperation in the field of taxation (DAC 2) as amended by

text: Council Directive (EU) 2023/2226 of 17 October 2023

text: amending Directive

text: on administrative cooperation in the field of taxation (DAC8) . The EDPS has already issued an opinion on DAC8 on 3 April 2023 .

text: 8. The EDPS regrets not having been consulted on the Council Decision authorising the opening of negotiations for the amendment of the Agreement in line with

text: Article 42(1)

text: EUDPR.

text: 9. The EDPS notes that the amendments that would affect the provisions on data protection concern (i) updating references to the legislative data protection framework to align them with the new framework; (ii) replacing the term “information” with “personal data” (where appropriate); (iii) aligning the wording on automated decision-making and handling of sensitive data with the GDPR; and (iv) clarifying that the onward transfers (Article 6(5) of the Amending Protocol) are also subject to the safeguards provided under Annex III of the Agreement. In addition, the principle of data minimisation has been further clarified.

text: 3. International transfers of personal data

text: 10. Any transfer of information containing personal data from the European Union to San Marino under the Agreement constitutes an international transfer of personal data in the meaning of Chapter V of the GDPR. Recital (102) GDPR recalls that international agreements concluded between the Union and third countries may be a ground for transfer of personal data, insofar as they provide appropriate safeguards .

text: 11. The EDPS positively notes that

text: Article 6

text: and Annex III to the Agreement, as updated by the Amending Protocol, would provide for such safeguards.

text: 12. The Agreement, as updated by the Amending Protocol, clearly sets out the categories of data transferred, the purposes of the processing, as well as the principle of storage limitation . It would also provide a clear indication of the relevant data controllers in the Agreement . In addition, the Agreement provides that the data processed must be adequate, relevant and limited to what is necessary in relation to the purposes set out in the Agreement and prohibits the exchange of sensitive data .

text: 13. The EDPS observes that the provision of data subjects’ right, such as the right to transparency, right of access, rectification, and erasure of data are included . As regards the right of access, the EDPS understands that such right includes the right for data subjects to obtain confirmation as to whether or not personal data concerning them is being processed, and if that is the case, to obtain access to that data.

text: 14. Furthermore, the EDPS positively notes the inclusion of data security and data integrity principles . With regards to the commitment taken by the parties to having in place appropriate technical and organisational measures to protect personal data against accidental or unlawful access, destruction, loss, alteration, or unauthorised disclosure, the EDPS understands that the level of security of such measures will take into consideration the risks, the state of the art and the related costs.

text: 15. The EDPS takes note that paragraph 1, section 2, of Article 6 of the Amending Protocol would require Member States and San Marino to restrict the scope of the right of access and of the right to information (Article

text: and

text: GDPR) to the extent required in order to safeguard the interests referred to in

text: Article 23(1)

text: (e) of the GDPR.

text: Article 23(1)

text: (e) GDPR refers to an important objective of general public interest of the Union or of a Member State, which includes taxation. Whereas such a restriction is optional under

text: Article 23

text: GDPR, the Amending Protocol would make it an obligation for the Member States and San Marino.

text: 16. At the same time, the EDPS also notes that section 3 of Article 6(1) of the Amending Protocol guarantees certain information to be given to data subjects by the Reported Financial Institutions .

text: 17. Regarding restrictions to the rights to access and to the right to information, the EDPS understands that it is for the EU Member States and San Marino to provide for the relevant restrictions. In this context, the EDPS recalls that to be lawful, restrictions shall be provided for in a legislative measure, concern a limited number of rights of data subjects and/or controller’s obligations. They shall respect the essence of the fundamental rights and freedoms at issue, be a necessary and proportionate measure in a democratic society and safeguard an important objective of public interest. Restrictions may only continue for as long as the reason for the restriction exists.

text: 18. The EDPS recalls that, in line with the EDPB Guidelines 10/2020 on restrictions under

text: Article 23

text: GDPR , the grounds for the restriction need to be clear, and includes a number of elements, such as the categories of personal data restricted, the scope of the restriction, the safeguards to prevent abuse or unlawful access or transfer as well as the risks to data subject’s rights and freedoms entailed by the restrictions. The EDPS encourages Member States and San Marino to take into account the EDPB Guidelines 10/2020 on restrictions under

text: Article 23

text: GDPR as a reference when regulating the restrictions to data subjects’ rights.

text: 19. The EDPS notes that the obligation to inform data subjects in the event of a data breach, as provided by paragraph 5 of Article 6 of the Amending Protocol, applies to any data breach likely to adversely affect data subjects. The EDPS understands that this obligation to notify encompasses cases where the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, as it is the case under

text: Article 34

text: GDPR.

text: 20. The EDPS notes that

text: Article 6(4)

text: and (5) and Annex III, paragraph 7, to the Amending Protocol would regulate further processing as well as onward sharing and onward transfers of personal data. It welcomes the safeguards included for the further processing and with specific regard to the possibility of onward sharing, the EDPS welcomes the requirement for prior authorisation by the transferring competent authority, as well as the clarification that onward transfers are also subject to the safeguards provided for under Annex III notably paragraph 7 - which outlines the additional requirements under which onward transfers are allowed.

text: 21. The EDPS welcomes the reference to the oversight of the competent data protection 19 20 supervisory authority and to the right to redress .

text: 22. Finally, the EDPS welcomes the inclusion of provisions recognising that significant noncompliance with data protection rules may constitute grounds for suspending data exchanges, provided that no adequate resolution is reached by the parties . It also notes that, in the event of termination of the agreement, any personal data transferred from the EEA under the Agreement prior to its termination will continue to be processed in accordance with the provisions of the international agreement .

text: 4. Conclusions

text: 23. In light of the above, the EDPS considers that the Agreement, as updated by the Amending Protocol, provides for appropriate safeguards to enable the transfer of personal data. Brussels, 20 August 2025 (e-signed) p.o. Leonardo CERVERA NAVAS 8