text: COM(2023) 177 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 177 final. 4 COM(2023) 177 final, p. 2. COM(2021) 118 final. 6 COM(2021) 350 final. 7 COM (2020) 103 final. 8 COM(2022) 548 final. 4

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1–88. 10 See Recital 15 of the Proposal. 11 See in particular Judgment of the European Court of Justice of 9 November 2010, Volker und Markus Schecke GbR and Hartmut Eifert v Land Hessen, in Joined Cases

text: and

text: , ECLI:EU:C:2010:662, paragraph 85. 12

text: Directive (EU) 2018/843

text: of the European Parliament and of the Council of 30 May 2018 amending

text: Directive (EU) 2015/849

text: on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, and amending Directives

text: and

text: , OJ L 156, 19.6.2018, p. 43. 13

text: Regulation (EU) 2015/848

text: of the European Parliament and of the Council of 20 May 2015 on insolvency proceedings (recast), OJ L 141, 5.6.2015, p. 19. 14 EDPS Opinion 4/2018 on the Proposals for two Regulations establishing a framework for interoperability between EU large-scale information systems, issued on 16 April 2018, paragraph 27. 5

text: Article 1 of the Proposal, which would replace

text: Article 3 of Directive 2009/102/EC

text: . 16 Article 2 of the Proposal, which would introduce new

text: Article 18(5) of Directive 68/151/EEC

text: . 17 See Judgment of the Court of Justice of the European Union of 9 March 2017, Camera di Commercio, Industria, Artigianato e Agricoltura di Lecce v. Salvatore Manni,

text: Case C‑398/15

text: ECLI:EU:C:2016:652, paragraphs 49 and following. 6

text: COM(2023) 177 final, page 12: “The proposal will require the disclosure and cross-border access to certain information in relation to legal entities (e.g. partnerships), including certain personal data such as information about partners, single-member shareholders. This data is normally already publicly disclosed in Member States and this proposal makes such data available cross-border through BRIS. Member States may also process some personal data to verify the company data which is already currently the case in Member States”. 19

text: Article 3 of Directive 2009/102/EC

text: reads as follows : “Where a company becomes a single-member company because all its shares come to be held by a single person, that fact, together with the identity of the sole member, must either be recorded in the file or entered in the register as referred to in

text: Article 3(1)

text: and (2) of Directive

text: or be entered in a register kept by the company and accessible to the public”. 20 COM(2023) 177 final, page 2. 21 The Court of Justice of the European Union also recently confirmed that the principle of transparency cannot be considered, as such, as an objective of general interest capable of justifying the interference with the fundamental rights guaranteed in Articles 7 and 8 of the Charter where it does not concern institutional or procedural transparency covering activities of a public nature. See Judgment of the Court of Justice of the European Union of 22 November 2022, WM, Sovim SA v Luxembourg Business Registers, Joined Cases

text: and

text: , ECLI:EU:C:2022:912, paragraph 62. 7

text: Judgment of the Court of 16 July 2015, Client Earth v Commission,

text: Case C-612/13

text: P, ECLI:EU:C:2015:489, para. 30. See also judgement of Court of Justice of European Union of 9 November 2010, Volker und Markus Schecke Gbr v. Land Hessen and Eifert v. Land Hessen and Bundesanstalt für Landwirtschaft und Ernahrung, Joined Cases C92/09 and

text: , at paragraph 53, where the CJEU considered that legal persons can claim the protection of Articles 7 and 8 of the Charter in so far as the official title of the legal person identifies one or more natural persons. 23 Article 2 of the Proposal, modifying

text: Article 14

text: and creating

text: Article 14

text: a of

text: Directive (EU) 2017/1132

text: . 24 Judgment of the Court of Justice of the European Union of 22 November 2022, WM, Sovim SA v Luxembourg Business Registers, Joined Cases

text: and

text: , ECLI:EU:C:2022:912, paragraph 82. 8

identifier: EDPS yttrande 19/2023

title: EDPS Opinion 19/2023, on the Proposal for a Directive amending Directives 2009/102/EC and (EU) 2017/1132 as regards further expanding and upgrading the use of digital tools and processes in company law

text: 17 May 2023

text: Opinion 19/2023

text: on the Proposal for a Directive amending Directives

text: and

text: (EU) 2017/1132

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the proposal for a Directive of the European Parliament and of the Council amending Directives

text: and

text: (EU) 2017/1132

text: as regards further expanding and upgrading the use of digital tools and processes in company law .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: and

text: (EU) 2017/1132

text: as regards further expanding and upgrading the use of digital tools and processes in company law (‘the Proposal’).

text: The EDPS takes note of the overall objective of the Proposal, aiming at increasing transparency and trust in the business environment, for companies, consumers and other private stakeholders as well as public authorities. According to settled case-law of the Court of Justice of the European Union, legislation providing for the public disclosure of personal data interferes with the rights to protection of personal life and to personal data. While the EDPS understands that it might be necessary to make certain categories of personal data public to achieve specific and clearly defined objectives of public interest, the objective of transparency cannot be invoked as an end in itself. To ensure compliance with Articles 7 and 8 of the Charter, the EDPS considers that the objectives of public interest justifying disclosure of personal data should be articulated more clearly in the enacting terms of the Proposal. In addition, the categories of personal data to be made publicly available should be specified in an exhaustive manner, having regard to the requirements of necessity and proportionality.

text: Similarly, the EDPS understands that connecting the different Union level systems of interconnection of registers aims to further increase transparency. However, the establishment of connections between the system of interconnection of registers (BRIS), the beneficial ownership registers interconnection system (BORIS) and the insolvency registers interconnection system (IRI) should correspond to specific objectives, explicitly laid down in the enacting terms of the Proposal.

text: Finally, the Proposal should clarify the respective roles of Member States and the Commission, in particular in the context of the BRIS, and of the connection between the BRIS and the BORIS and IRI.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 29 March 2023, the European Commission issued the proposal for a Directive of the European Parliament and of the Council amending Directives

text: and

text: (EU) 2017/1132

text: 2. The overall objectives of the Proposal are to enhance transparency and trust in the business environment, achieve more digitalised and connected cross-border public services for companies, and easier cross-border expansion for SMEs leading, in turn, to a more integrated and digitalised single market. To achieve this, the Proposal would increase the amount of company data available in business registers and/or Business Registers Interconnection System (BRIS) and improve its reliability. It would also enable direct use of company data available in business registers when setting up cross-border branches and subsidiaries, and in other cross-border activities and situations .

text: 3. The Proposal is in line with the EU digitalisation objectives set out, in particular, in the Commission Communication 2030 Digital Compass: the European way for the Digital Decade . It is also in line with the Commission Communications Updating the 2020 New 6 7 Industrial Strategy and SME Strategy for a sustainable and digital Europe , since it aims to address obstacles to cross-border expansion that small and medium-sized enterprises (SMEs) currently face in the single market. The Proposal is included in the 2023 Commission work programme as one of the key actions under the Commission’s headline ambition of ‘Europe fit for the digital age’ .

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 30 March 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 39 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 5. The EDPS takes note that the Proposal provides for the publication of personal data, in order to allow third parties to have access to company information not only from national business registers in their Member State but also in cross-border situations, at EU level.

text: 6. In this regard, the EDPS welcomes the reference to the applicability of

text: Regulation (EU) 2016/679

text: (‘the GDPR’) in recital 34, when Member States process any personal data about persons that can lawfully represent a company, as well as single shareholders. The EDPS also welcomes the reference to the applicability of the EUDPR in the same recital, when the Commission processes personal data in the context of the Proposal.

text: 7. While recognizing the need for enhancing transparency on companies in the single market in order to protect the interests of third parties and to strengthen trust in business transactions , the EDPS recalls that the objective of transparency does not automatically prevail over the right to protection of personal data .

text: 8. The EDPS also notes that, in order to increase transparency, the Proposal provides for the connection of the system of interconnection of registers (BRIS) with the EU Beneficial Ownership Registers Interconnection System (BORIS) , and with the EU Insolvency Registers Interconnection system (IRI) . The EDPS recalls that interoperability should not be an end in itself but should always serve a genuine public interest objective , in order to avoid using the connections beyond the purposes for which they were originally intended.

text: 9. In this Opinion, the EDPS will focus his analysis on the publication of personal data in the context of the Proposal, the establishment of connections between BRIS, BORIS and IRI, as well as the respective roles of the Member States and the Commission when processing data for the purposes of the Proposal.

text: 3. Publication of personal data

text: 3.1. Public accessibility

text: 10. The Proposal provides for the publication of personal data of the following categories of individuals, both in the context of single-member companies and of limited liability companies, partnerships and groups of companies: − as regards single-member companies, where all shares are held by a single person, Article 1 of the Proposal provides that this fact, together with the identity of the sole member, must be recorded in the file or entered in the register as referred to in

text: Article 3(1)

text: and (2) of Directive

text: and made publicly available through the BRIS . Article 2 of the Proposal in turn specifies that the BRIS must make publicly available the first name, surname and the date of birth of the persons referred to in

text: Article 3 of Directive 2009/102/EC

text: . − as regards limited liability companies, partnerships and groups of companies, Article 2 of the Proposal specifies in

text: Article 18(4) of Directive (EU) 2017/1132

text: , that the BRIS must make publicly available the first name, surname and date of birth of the persons referred to in

text: Articles 14

text: (d), 14a(j) and (k), 19(2)(g) and 19a(2)(g), 30(1)(e), and 36(3)(f).

text: 11. The EDPS first recalls that, according to settled case-law of the Court of Justice of the European Union, legislation providing for the public disclosure of personal data interferes with the rights to protection of personal life and to personal data. Any requirement to publish personal data should, in addition to being provided by law, also fulfil the other requirements arising from Article 52(1) of the Charter and Article 6(3) of the GDPR, and in particular must meet an objective of public interest and be proportionate to the legitimate aim pursued.

text: 12. In its judgment of 9 March 2017, the Court of Justice of the European Union (‘CJEU’) considered that the public nature of the company register in question was intended to ensure legal certainty in dealings between companies and third parties and to protect, in particular, the interests of third parties in relation to joint stock companies and limited liability companies . The Court considered that the interference with the fundamental rights of the persons concerned (in particular the right to respect for private life and the right to protection of personal data guaranteed by the Charter of Fundamental Rights of the Union) was not disproportionate in so far as disclosure was required only for a limited number of personal data items, and the only safeguards that joint-stock companies and limited liability companies offer to third parties were their assets. Therefore, the CJEU considered it justified that natural persons who choose to participate in trade through such a joint stock company or limited liability company should be required to disclose data relating to their identity and functions within that company.

text: 13. Against this background, the EDPS considers that the publication of personal data envisaged by the Proposal should be duly justified in light of the criteria of necessity and proportionality.

text: 14. The EDPS acknowledges that the Proposal builds on and extends the use of the BRIS without altering its functioning, which means that a number of personal data at stake are already made public . This is in particular the case with data related to the identity of the sole member of single-member companies, since the former

text: Article 3 of Directive 2009/102/EC

text: already laid down their accessibility to the public . However, one of the objectives of the Proposal is to increase the amount of publicly available company data in business registers and/or through the system of interconnection of registers, which requires the demonstration of an objective of public interest.

text: 15. The Proposal also mentions in several recitals the need to improve the reliability and trustworthiness of company information in the registers in order to facilitate its use without further formalities in a cross-border context. In addition, recital (5) of the Proposal indicates that “[a]ll stakeholders, including companies themselves, authorities and the public at large need to be able to rely on information about companies for their business purposes or in administrative procedures or court proceedings”.

text: 16. The EDPS notes that the rationale for the different publication requirements is closely linked to the “stronger calls for transparency, from investors, creditors, consumers or companies themselves” . While the EDPS understands that it might be necessary to make certain categories of personal data public to achieve specific and clearly defined objectives of public interest, the objective of transparency cannot be invoked as an end in itself .

text: 17. Given the interference to the fundamental rights to privacy and data protection stemming from the publication of personal data, the EDPS considers that the objectives that justify the public accessibility of those data should be clearly set out in the enacting terms of the Proposal as such. Moreover, the EDPS considers that a general reference to ‘business purposes’ without further qualification or explanation does not constitute a clearly defined objective of public interest justifying public accessibility. To ensure compliance with Articles 7 and 8 of the Charter, the EDPS considers that the objectives of public interest justifying disclosure of personal data should be articulated more clearly in the enacting terms of the Proposal.

text: 3.2. Categories of personal data

text: 18. The EDPS recalls that personal data is defined under the GDPR as any information relating to an identified or identifiable natural person (‘data subject’). Thus, the GDPR does not cover the processing of data concerning legal persons and in particular undertakings established as legal persons (including the name and the form of the legal person and the contact details of the legal person). However, “the fact that information [is] provided as part of a professional activity does not mean that it cannot be characterised as a set of personal data” .

text: 19. In this context, the EDPS notes that the Proposal does not specify in an exhaustive manner which categories of personal data must be processed in the national registers and in the BRIS. According to Article 2 of the Proposal, Member States must ensure compulsory disclosure by companies of “at least” documents and particulars listed in

text: Articles 14

text: a and 14b . The EDPS understands that such a wording is intended to provide Member States a certain a degree flexibility when implementing the Directive. However, from a data protection perspective, and as stressed by the CJUE in Joined Cases

text: and

text: , the use of the expression ‘at least’ entails that those provisions would allow for data to be made available to the public which are not sufficiently defined and identifiable. Consequently, the substantive rules governing interference with the rights guaranteed in Articles 7 and 8 of the Charter do not meet the requirement of clarity and precision. The EDPS considers that all categories of personal data that are to be made publicly available should be specified exhaustively in the Proposal, having regard to the requirements of necessity and proportionality.

text: 20. The Proposal refers, in several of the proposed amendments to articles of

text: Directive (EU) 2017/1132

text: , to the notion of “particulars” to be disclosed. Given the present opportunity to amend

text: Directive (EU) 2017/1132

text: , the EDPS recommends to specify what is meant by ‘particulars’ (for instance by providing a definition in the Proposal).

text: 21. The EDPS welcomes on the other hand the justification provided by the Commission, in Recital 33, for the disclosure of the date of birth of the persons concerned, in order to ensure certainty about the exact identity of such persons, in particular in cross-border situations.

text: 4. Connection of BRIS with BORIS and IRI

text: 22. According to Article 2 of the Proposal, connections must be established between the system of interconnection of registers (BRIS), the beneficial ownership registers interconnection system (BORIS) and the insolvency registers interconnection system (IRI). The amended

text: Article 22 of Directive (EU) 2017/1132

text: would provide that the establishment of connections “shall not alter or circumvent the rules and requirements related to the access of the information set out under the relevant frameworks establishing those registers and interconnections”. Recital 29 clarifies that “for example, this means that a user of BRIS should only be able to access BORIS if that user is entitled to access BORIS under its respective rules and requirements”.

text: 23. The EDPS welcomes the clarification provided as regards the modalities of access to those registers. However, the enacting terms of the Proposal do not clearly specify purposes of the connections to be established. Connection between the systems of interconnection of registers cannot be considered a purpose in itself. The EDPS consider it is necessary to amend

text: Article 22

text: in order clearly define the specific purposes of the connections in the enacting terms of the Proposal.

text: 5. Roles and responsibilities

text: 24. The EDPS recalls that the concepts of controller, joint controller and processor play a crucial role in the application of data protection law, since they determine who is responsible for compliance with different data protection rules, and how data subjects can exercise their rights in practice.

text: 25. The EDPS notes that the Proposal does specify the roles of the Member States and the Commission under EU data protection law. The EDPS considers that the Proposal should clarify the respective roles of Member States and the Commission, in particular in the context of the BRIS, and of the connection between the BRIS and the BORIS and IRI. Ensuring clarity of roles and responsibilities is particularly important in a context where multiple registers are interconnected to ensure transparency towards the individuals affected.

text: 6. Conclusions

text: 26. In light of the above, the EDPS makes the following recommendations: (1) to articulate the objectives of public interest justifying public disclosure more clearly, and to do so in the enacting terms of the Proposal, (2) to specify exhaustively in the Proposal all categories of personal data that are to be made publically available, (3) to specify what is meant by the use of the term ‘particulars’, 9 (4) to specify in the enacting terms of the Proposal the specific purposes of the connection between the system of interconnection of registers, the beneficial ownership registers interconnection and the insolvency registers interconnection, (5) to clarify the respective roles of Member States and the Commission, in particular in the context of the connections to be established between between the system of interconnection of registers, the beneficial ownership registers interconnection and the insolvency registers interconnection. Brussels, 17 May 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI p.o Leonardo CERVERA NAVAS Acting Head of EDPS Secretariat 10


text: COM(2024) 280 final. COM(2024) 281 final. 1

text: OJ L 295, 21.11.2018, p. 39. 4

text: Regulation (EU) 2018/1727

text: of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council Decision 2002/187/JHA (OJ L 295, 21.11.2018, p. 138).

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89). 6 At the moment, the only existing adequacy decision under the LED is on the United Kingdom, available at https://eurlex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D1773 7 COM(2020) 743 final. 8 EDPS Opinion 10/2020 on the negotiating mandate to conclude ten agreements allowing the exchange of data between Eurojust and the competent authorities for judicial cooperation in criminal matters in certain third countries. 4

text: Council Decision authorising the opening of negotiations for Agreements between the European Union and Algeria, Argentina, Armenia, Bosnia and Herzegovina, Brazil, Colombia, Egypt, Israel, Jordan, Lebanon, Morocco, Tunisia and Turkey on cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the competent authorities for judicial cooperation in criminal matters of those third States, see 6153/21 + ADD 1, Council Decision adopted by written procedure on 1 March 2021 (CM 1990/21). 10 See Explanatory Report, COM(2024) 280 final, p. 2. 11 COM(2024) 280 final. 12 COM(2024) 281 final. 13 See Article 1 of the Annexes to the Proposals. 14 See Explanatory Report, COM(2024) 280 final, p. 1. 5

text: For further details see the EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data, issued on 19 December 2019, https://edps.europa.eu/sites/edp/files/publication/19- 12- 19_edps_proportionality_guidelines_en.pdf. 16 See Judgments of the Court of Justice of 6 October 2020, La Quadrature du Net and others, joined cases

text: and 520/18, ECLI:EU:C:2020:791, paragraph 130, of 8 April 2014 in Joined Cases

text: and

text: , Digital Rights, EU:C:2014:238, paragraph 52; and Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592, paragraph 140. 17 In accordance with Article 26 of the Eurojust Regulation,

text: Article 3

text: and Chapter IX of EUDPR apply to the processing of operational personal data by Eurojust. 6

text: See to that effect

text: Article 56

text: and recital 45 of the Eurojust Regulation. 19 Opinion 1/15, EU-Canada PNR Agreement, ECLI:EU:C:2017:592, par. 219. 7

text: COM(2024) 280 final, page 6. 8

identifier: EDPS yttrande 19/2024

amnesord:
International Agreements
Transfers of data

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 19/2024 on the Proposals for Council Decisions on the signing and conclusion of an Agreement between the EU and the Republic of Lebanon on cooperation between Eurojust and the authorities of the Republic of Lebanon

serie: yttranden

text: 28 August 2024

type: rubrik

text: Opinion 19/2024

text: on two Proposals for Council Decisions on the signing and conclusion of an Agreement between the EU and Lebanon on cooperation between Eurojust and the authorities of Lebanon competent for judicial cooperation in criminal matters

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Council Decision on the signing, on behalf of the Union, of an Agreement between the European Union and the Republic of Lebanon on the cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the authorities of the Republic of Lebanon competent for judicial cooperation in criminal matters , and the Proposal for a Council Decision on the conclusion of an Agreement between the European Union and the Republic of Lebanon on the cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the authorities of the Republic of Lebanon competent for judicial cooperation in criminal matters .

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposals and the future Agreement that are relevant from a data protection perspective.

text: Executive Summary

text: On 10 July 2024, the European Commission issued two Proposals for Council Decisions, under

text: Article 16(2)

text: and

text: Article 85

text: in conjunction with

text: Article 218(5)

text: Article 218(6)

text: , second subparagraph, point (a)(v), and Article 218(7) of the Treaty on the Functioning of the European Union, one on the signing and other on the conclusion, on behalf of the Union, of an Agreement between the European Union, of the one part, and the Republic of Lebanon, of the other part, on cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the authorities of the Republic of Lebanon competent for judicial cooperation in criminal matters. The proposals are accompanied by an Annex containing the agreed text of the Agreement.

text: The objective of the future Agreement is to enhance judicial cooperation between Eurojust and the competent authorities of Lebanon by allowing the transfer of personal data between Eurojust and the competent authorities of Lebanon, in order to support and strengthen their cooperation in investigating and prosecuting serious crime, in particular organised crime and terrorism, while ensuring appropriate safeguards with respect to fundamental rights and freedoms of individuals, including privacy and the protection of personal data.

text: The EDPS has already had the opportunity to comment on the exchange of personal data between Eurojust and the competent authorities of Lebanon in his Opinion 10/2020, where the EDPS provided several recommendations in order to clarify and, where necessary, further develop the safeguards and controls with respect to protection of personal data. The EDPS notes with satisfaction that his recommendations have been taken into account and that the provisions of the future Agreement are consistent with the provisions of Chapter IX of EUDPR on the processing of operational personal data by union bodies, offices and agencies. As a result, it could be concluded that the presented Agreement between the EU and Lebanon adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

text: At the same time, in this Opinion, the EDPS provides some recommendations, in particular with regards to onward transfers of personal data, the right to erasure of personal data, the possibility to postpone or suspend transfer of personal data and on the review and evaluation of the Agreement, aimed at facilitating the practical implementation of the future Agreement by Eurojust and the competent authorities of Lebanon.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: Regulation (EU) 2018/1727

text: (‘Eurojust Regulation’) lays down specific rules regarding transfers of personal data by Eurojust to third countries and international organisations.

text: Article 56(2)

text: thereof lists a number of legal grounds, based on which Eurojust could lawfully transfer data to authorities of third countries, such as an adequacy decision of the Commission in accordance with

text: Article 36 of Directive (EU) 2016/680

text: finding that the third country ensures an adequate level of protection ; a cooperation agreement allowing for the exchange of operational personal data concluded before 12 December 2019 between Eurojust and the given third country or international organisation; or an international agreement between the Union and the third country or international organisation pursuant to

text: Article 218

text: TFEU that provides for adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

text: 2. On 19 November 2020, the Commission adopted a Recommendation for a Council Decision authorising the opening of negotiations for Agreements between the European Union (EU) and Algeria, Armenia, Bosnia and Herzegovina, Egypt, Israel, Jordan, Lebanon, Morocco, Tunisia and Turkey on cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the competent authorities for judicial cooperation in criminal matters of those third States .

text: 3. The European Data Protection Supervisor issued an Opinion regarding the Recommendation on 17 December 2020. The Council granted the authorisation for the opening of the negotiations on 1 March 2021, adding also Argentina, Brazil and Colombia to the list, and adopted a set of negotiating directives .

text: 4. The negotiations with Lebanon began in December 2022 and a preliminary agreement was reached in October 2023 . Consequently, on 10 July 2024, the Commission issued the Proposal for a Council Decision on the signing, on behalf of the Union, of an Agreement between the European Union and the Republic of Lebanon on the cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the authorities of the Republic of Lebanon competent for judicial cooperation in criminal matters , and the Proposal for a Council Decision on the conclusion of an Agreement between the European Union and the Republic of Lebanon on the cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the authorities of the Republic of Lebanon competent for judicial cooperation in criminal matters (‘the Proposals’), both accompanied by their respective Annexes containing the final negotiated text of the Agreement.

text: 5. The objective of the future Agreement is to enhance judicial cooperation between Eurojust and the competent authorities of Lebanon in combating serious crime, by allowing for the transfer of personal data between Eurojust and the competent authorities of Lebanon, in order to support and strengthen the action by the competent authorities of the Member States of the Union and those of Lebanon, as well as their cooperation in investigating and prosecuting serious crime, in particular organised crime and terrorism, while ensuring appropriate safeguards with respect to fundamental rights and freedoms of individuals, including privacy and the protection of personal data .

text: 6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 10 July 2024, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 9 of the Proposals.

text: 2. General remarks

text: 7. The EDPS does not dispute the need for cooperation between Eurojust and judicial authorities of third countries involved in the investigation and prosecution of serious crimes, which do not stop at Union borders. In this regard, Eurojust should be able to cooperate and exchange personal data with them to the extent necessary for the accomplishment of its tasks within the framework of the requirements set out in the Eurojust Regulation .

text: 8. However, it must be borne in mind that transfers of personal data gathered in the context of criminal investigations envisaged under the future Agreement are liable to have a significant impact on the lives of the individuals concerned, as they will be used in prosecution cases in the receiving country under its national law. Consequently, the necessity and proportionality of the envisaged processing need to be assessed in accordance with Article 52(1) of the Charter .

text: 9. In particular, transfers of personal data between Eurojust and the authorities competent for judicial cooperation in criminal matters of Lebanon constitute an interference with individuals’ rights to privacy and data protection guaranteed by Articles 7 and 8 of the Charter. Therefore, the future Agreement must ensure that the derogations and limitations to rights to privacy and data protection, including in relation to fighting crime, apply only in so far as is strictly necessary . In that regard, the EDPS welcomes Article 10(5) of the future Agreement, obliging the Parties to comply with the safeguards provided for in the Agreement regardless of the nationality of the data subject concerned and without discrimination.

text: 10. As mentioned above, the EDPS has already had the opportunity to comment on the exchange of personal data between Eurojust and the competent authorities of Lebanon in his Opinion 10/2020, where the EDPS provided several recommendations in order to clarify and, where necessary, further develop the safeguards and controls with respect to protection of personal data. The EDPS notes with satisfaction that his recommendations have been taken into account and that the future Agreement provides for similar data protection safeguards as provided for in Chapter IX of EUDPR with regard to processing of operational personal data by Union bodies, offices and agencies when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part three TFEU .

text: 11. As a result, it could be concluded that the presented Agreement between the European Union and Lebanon adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

text: 12. At the same time, the EDPS considers that certain safeguards with respect to the protection of personal data, while already provided for in the future Agreement, may still benefit from additional precision and clarity. In this regard, the subsequent comments by the EDPS aim at facilitating the practical implementation of the Agreement by Eurojust and the competent authorities of Lebanon as well as to provide guidance for future agreements with other third countries that are still under negotiations or negotiations are still to begin.

text: 3. Onward transfers of personal data received

text: 13. The EDPS recalls that, in accordance with

text: Article 56(6)

text: and recital 45 of the Eurojust Regulation, when personal data are transferred from Eurojust to a third country, the level of protection of natural persons ensured by the Eurojust Regulation and by Union law must not be undermined. This requirement is fully valid also in case of a potential onward transfer of personal data received from Eurojust by the competent authorities of Lebanon to other Lebanese authorities or to the authorities of a third country or to an international organisation .

text: 14. The EDPS therefore welcomes Article 13 of the future Agreement, which prohibits further transferring the personal data received from Eurojust to other Lebanese authorities or to the authorities of a third country or to an international organisation, unless such onward transfer is carried out under strictly limited conditions.

text: 15. The EDPS additionally welcomes paragraph 1(c) of

text: Article 13

text: , which lays down that the possible onward transfer to other Lebanese authorities is subject to the same conditions and safeguards as those applying to the original transfer.

text: 16. In that regard, although this is not explicitly mentioned in paragraph 2 of the same Article, regulating onward transfers to the authorities of a third country or to an international organisation, the EDPS expects that, when giving its explicit prior authorisation pursuant to paragraph 2(b), Eurojust will assess and clearly indicate the modalities applying to the onward transfer in question. These modalities could be the same conditions and safeguards as those applying to the original transfer, similarly to the explicit obligation in paragraph 1(c) of

text: Article 13

text: , or other conditions and safeguards deemed necessary and appropriate in the specific case.

text: 4. Right of access, rectification, erasure or restriction

text: 17. The EDPS recalls that the right of access and the right to rectification are essential elements of the right to data protection under Article 8(2) of the Charter. Furthermore, as regards Article 7 of the Charter, the European Court of Justice has held that “the fundamental right to respect for private life, enshrined in that article, means that the person concerned may be certain that his personal data are processed in a correct and lawful manner. In order to carry out the necessary checks, that person must have a right of access to the data relating to him which is being processed” . The EDPS therefore welcomes the inclusion, under Articles 14 and 15 of the future Agreement, of a right to access as well as rectification, erasure or restriction.

text: 18. As regards specifically the right to erasure, the EDPS positively notes that paragraph 2 of

text: Article 15

text: prescribes that the Parties must provide for any data subject to have the right to obtain from the authorities processing personal data transferred under the Agreement the erasure of personal data concerning the data subject where the processing of the personal data infringes data protection principles (Article 10(1) of the Agreement) or rules on the transfer of special categories of personal data (

text: Article 11(2)

text: thereof), or where the personal data must be erased in order to comply with a legal obligation to which the authorities are subject.

text: 19. The EDPS considers that even though the provision of

text: Article 15(2)

text: mentions explicitly only infringements of

text: Articles 10(1)

text: or Article 11(2) of the Agreement as grounds enabling the data subject to obtain erasure of personal data, this should not be viewed as an exhaustive list. In particular, it is the understanding of the EDPS that the infringement of

text: Article 10(1)

text: (a) - lawfulness of processing of personal data - should be interpreted broadly, thus covering possible infringements of other legal obligations under the future Agreement, such as those laid down in

text: Article 10(6)

text: and

text: Article 11(1)

text: 5. Postponement of the transfer of personal data

text: 20. The EDPS welcomes the obligation included in Article 29(4) of the future Agreement, according to which a Party must “postpone the transfer of personal data in the event that, and for as long as, the other Party ceases to provide for, and implement, the safeguards and obligations contained in Chapter II (Information exchange and data protection) of this Agreement” (emphasis added).

text: 21. The EDPS considers that it may provide a useful and effective safeguard, especially in cases of third countries that face practical issues to meet the obligations stemming from the Agreement, e.g. need to amend domestic legislation, accession and/or ratification of international legal instruments, establishment of supervisory authority, etc.

text: 22. At the same time, the EDPS believes that the provision

text: Article 29(4)

text: may benefit from additional clarity, in particular as regards the specific context and the modalities of its possible application, as well as its distinction from other provision of the Agreement with similar effect.

text: 23. More specifically, the EDPS notes that the Explanatory Memorandum of the Proposal for Council Decision provides a slightly different description of the new safeguard: “[...] a Party shall postpone the transfer of personal data for as long as the other Party has not provided

text: for in law and implemented the safeguards and obligations contained in Chapter II of

text: the Agreement (Information exchange and data protection)” (emphasis added).

text: 24. Furthermore, the EDPS notes that Article 32(2) of the future Agreement lays down another safeguard with a similar effect, according to which “[...] a Party is entitled to suspend the transfer of personal data to another Party if it has substantial evidence that the other Party is in systematic or material breach of the terms of this Agreement or that a material breach is imminent.” The two provisions seem to bring the same result in substance, namely effective blocking of transfers of personal data, however in different contexts.

text: 25. Therefore, in view of ensuring legal clarity and certainty, the EDPS invites the Commission to clarify, e.g. in the Explanatory Memorandum to the Proposal for Council Decision, what

text: 26. Furthermore, the EDPS considers that it is important to clarify who on the EU side would carry out the assessment whether the safeguards and the obligations required by the Agreement are provided for in the law of the third country and implemented in practice - Eurojust, the Commission, or another competent Union body.

text: 6. Review and evaluation of the Agreement

text: 27. The EDPS welcomes Article 31 of the future Agreement that provides for the regular review and evaluation of the Agreement and specifically envisages the participation of “relevant experts on data protection” in the respective review teams. In this context, the EDPS recommends the involvement in the review and the evaluation of the Agreement also representatives of the independent data protection authorities.

text: 7. Conclusions

text: 28. In light of the above, the EDPS makes the following recommendations: (1) in case of onward transfers to the authorities of a third country or an international organisation, when giving its prior explicit authorisation, Eurojust to assess and clearly indicate whether the same conditions and safeguards as those applying to the original transfer should also apply to the onward transfer, or whether some other conditions and safeguards are deemed necessary and appropriate in the specific case; (2) regarding the right to erasure pursuant to

text: Article 15(2)

text: , to interpret broadly the infringement of

text: Article 10(1)

text: (a) - lawfulness of processing of personal data - thus providing the data subjects with the right to obtain from the authorities processing personal data transferred under the Agreement the erasure of their personal data also in case of infringements of other legal obligations under the future Agreement, such as

text: Article 10(6)

text: and

text: Article 11(1)

text: ; (3) to clarify the practical application of the safeguards provided for in

text: Article 29(4)

text: and in Article 32(2) of the future Agreement, as well as to clarify who on the EU side would carry out the assessment whether the safeguards and the obligations required by the Agreement are provided for in the law of the third country and implemented in practice; (4) to involve the independent data protection authorities in the future reviews and evaluations of the Agreement. Brussels, 9

type: vagledning

utgivare: edps


text: COM(2025) 396 final. COM(2025) 397 final. 1

text: OJ L 295, 21.11.2018, p. 39. 4 COM(2025) 397 final. COM(2025) 396 final. 6 Conclusion Proposal,

text: Article 1

text: . 4

text: Signing Proposal and Conclusion Proposal, Explanatory Memorandum, page 1 and 2. 8 OJ L359 of 16.12.2014, p. 1 to 29. 9 OJ L, 24.10.2023. 10 EDPS Opinion 9/2023 on the Proposal for a Council Directive amending Directive

text: on administrative cooperation in the field of taxation. 11 See

text: Article 1(3)

text: GDPR and Annex XI of the EEA Agreement, incorporating the GDPR into the national laws of the EEA countries. 5

text: Article 23

text: GDPR. 13 EDPB Guidelines 10/2020 on restrictions under

text: Article 23

text: GDPR, version 2.1, adopted on 13 October 2021. 6

identifier: EDPS yttrande 19/2025

amnesord:
Finance
International Cooperation
Transfers of data

title: EDPS Opinion the Proposal on the signing and conclusion of the provisional application of the Amending Protocol between the EU and Liechtenstein on the automatic exchange of financial account information to improve international tax compliance

text: Opinion 19/2025

text: on the Proposal for a Council Decision on the signing and conclusion of the Amending Protocol to the Agreement between the European Union and the Principality of Liechtenstein on the automatic exchange of financial account information to improve international tax compliance

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to (i) the Proposal for a Council Decision on the signing, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Liechtenstein on the automatic exchange of financial account information to improve international tax compliance and to (ii) the Proposal for a COUNCIL DECISION on the conclusion, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Liechtenstein on the automatic exchange of financial account information to improve international tax compliance .

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposals that are relevant from a data protection perspective.

text: Executive Summary

text: The EDPS is consulted on the Proposals for Council Decisions to sign and conclude, on behalf of the Union, the Amending Protocol to the Agreement between the European Union and the Principality of Liechtenstein on the automatic exchange of financial account information to improve international tax compliance.

text: The Amending Protocol aims to ensure that the automatic exchange of financial account information between EU Member States and Liechtenstein is aligned with the updated Common Reporting Standard developed by the Organisation for Economic Co-operation and Development. In addition, the Amending Protocol aims to align the text of the Agreement with the new data protection framework (i.e. the GDPR for EU Members States and the Data Protection Act of 4 October 2018 for Liechtenstein). Finally, the Amending Protocol would ensure that the existing agreement between the European Union and Liechtenstein remains aligned with Union legislation in the same field.

text: As an EEA EFTA country, Liechtenstein is not considered as a third country within the meaning of Chapter V of the GDPR. The EDPS recommends the Commission to further clarify the status of Liechtenstein in a recital to the Proposals.

text: The EDPS observes that the Agreement would require Member States and Liechtenstein to restrict the scope of the right of access and the right to information. In this respect, the EDPS recalls the conditions for such restrictions provided under

text: Article 23

text: GDPR.

text: Contents

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 17 July, the European Commission issued: - a Proposal for a Council Decision on the conclusion, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Liechtenstein on the automatic exchange of financial account information to improve international tax compliance (‘the Conclusion Proposal’) ; - a Proposal for a Council Decision on the signing, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Liechtenstein on the automatic exchange of financial account information to improve international tax compliance (‘the Signing Proposal’) .

text: 2. The objective of the Signing Proposal is to authorise the signing, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Principality of Liechtenstein (Liechtenstein) on the automatic exchange of financial account information to improve international tax compliance (‘the Agreement’).

text: 3. The objective of the Conclusion Proposal is to approve the Amending Protocol .

text: 4. The Agreement provides the legal basis for the reciprocal automatic exchange of financial account information between the EU Member States and Andorra, in accordance with the Common Reporting Standard (CRS) developed by the Organisation for Economic Cooperation and Development (OECD).

text: 5. The Amending Protocol aims to (i) ensure that the automatic exchange of financial account information between EU Member States and Liechtenstein is aligned with, and continues to take place in accordance with, the updated CRS from 1 January 2026; and to (ii) align the text of the Agreement with the new data protection framework (i.e.

text: Regulation (EU) 2016/679

text: on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General data protection regulation, GDPR) for EU Members States; and where necessary the Data Protection Act of 4 October 2018 adopted by Liechtenstein to implement the GDPR where needed) .

text: 6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 17 July 2025, 2025, pursuant to Article 42(1) of the EUDPR. The EDPS welcomes the reference to this consultation in Recital 6 of the Signing Proposal and of the Conclusion Proposal.

text: 2. General Remarks

text: 7. The EDPS welcomes the objectives pursued by the Proposals, notably to improve administrative cooperation in the area of direct taxation, and to improve international tax compliance. The EDPS acknowledges that the negotiated Amending Protocol ensures that the existing agreement between the European Union and Liechtenstein remains aligned with Union legislation in the same field, notably

text: Council Directive 2014/107/EU

text: 2 amending Directive

text: on administrative cooperation in the field of taxation (DAC 2) as amended by

text: Council Directive (EU) 2023/2226 of 17 October 2023

text: amending Directive

text: on administrative cooperation in the field of taxation (DAC8) . The EDPS has already issued an opinion on DAC8 on 3 April 2023 .

text: 8. The EDPS regrets not having been consulted on the Council Decision authorising the opening of negotiations for the amendment of the Agreement in line with

text: Article 42(1)

text: EUDPR.

text: 9. The EDPS recalls that, as a member of the European Economic Area, Liechtenstein applies the same data protection rules as the ones provided by the GDPR, due to the incorporation of the GDPR in the EEA Agreement, and it is not considered as a third country within the meaning of Chapter V of the GDPR . As a result, Chapter V of the GDPR does not apply to the exchange of personal data regulated by the Proposals and no additional safeguards or binding instrument is needed to ensure the protection of personal data transferred to Liechtenstein. The EDPS recommends to mention in a Recital the status of Liechtenstein of EEA EFTA country, having implemented the EEA acquis.

text: 10. The EDPS observes that Article 6 of the Amending Protocol would require Member States and Liechtenstein to restrict the scope of the right of access (

text: Article 15

text: GDPR) and the right to information (Articles

text: and

text: GDPR) to the extent required in order to safeguard the interests referred to in

text: Article 23(1)

text: (e) of the GDPR.

text: Article 23(1)

text: (e) GDPR refers to an important objective of general public interest of the Union or of a Member State, which includes taxation. Whereas such a restriction is optional under

text: Article 23

text: GDPR, the Amending Protocol would make it an obligation for the Member States and Lichtenstein.

text: 11. At the same time, the EDPS also notes that paragraph 2 of Article 6 of the Amending Protocol prohibits to extend such restriction to the information to be given to data subjects by the Reported Financial Institutions.

text: 12. Regarding the restrictions to the rights to access and to the right to information, the EDPS understands that it is for the EU Member States and Liechtenstein to provide for the relevant restrictions. In this context, the EDPS recalls that to be lawful, restrictions shall be provided for in a legislative measure, concern a limited number of rights of data subjects and/or controller’s obligations. They shall respect the essence of the fundamental rights and freedoms at issue, be a necessary and proportionate measure in a democratic society and safeguard an important objective of public interest . Restrictions may only continue for as long as the reason for the restriction exists.

text: 13. The EDPS also recalls that, in line with the EDPB Guidelines 10/2020 on restrictions under

text: Article 23

text: GDPR , the grounds for the restriction need to be clear, and include a number of elements, such as the categories of personal data restricted, the scope of the restriction, the safeguards to prevent abuse or unlawful access or transfer as well as the risks to data subject’s rights and freedoms entailed by the restrictions. The EDPS encourages Member States and Liechtenstein to use the EDPB Guidelines 10/2020 on restrictions under

text: Article 23

text: GDPR as a reference when regulating the restrictions to data subjects’ rights.

text: 14. Finally, the EDPS notes that the obligation to inform data subjects in the event of a data breach, as provided by paragraph 5 of Article 6 of the Amending Protocol, applies to any data breach likely to adversely affect data subjects. The EDPS understands that this obligation to notify encompasses cases where the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, as it is the case under

text: Article 34

text: GDPR.

text: 3. Conclusions

text: 15. In light of the above, the EDPS recommends to further clarify the specific status of Liechtenstein as an EEA EFTA country having implemented the EEA acquis in a recital of both the Signing and the Conclusion Proposals. Brussels, 20 August 2025 (e-signed) p.o. Leonardo CERVERA NAVAS