text: This Opinion relates to the EDPS' mission to advise the EU institutions on the data protection implications of their policies and foster accountable policymaking - in line with Action 3.1 of the EDPS Strategy to actively promote justice and the rule of law.

text: The Opinion provides for some additional recommendations related to data protection that should also be taken into consideration in the legislative process.

text: OJ L 119, 4.5.2016, p. 1. OJ L 295, 21.11.2018, p. 39. OJ L 119, 4.5.2016, p. 89. COM(2020) 609 final, https://eur-lex.europa.eu/legalcontent/EN/TXT/?qid=1601287338054&uri=COM:2020:609:FIN COM(2020) 37 final, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52020DC0037 COM(2020)614 final, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=COM:2020:614:FIN COM(2020)611 final, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=COM:2020:611:FIN COM(2020) 610 final, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=COM:2020:610:FIN COM (2020)612 final, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=COM:2020:612:FIN COM (2020)613 final, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=COM:2020:613:FIN COMMISSION RECOMMENDATION

text: (EU) 2020/1366

text: of 23 September 2020 on an EU mechanism for preparedness and management of crises related to migration (Migration Preparedness and Crisis Blueprint), https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32020H1366 COMMISSION RECOMMENDATION

text: (EU) 2020/1364

text: of 23 September 2020 on legal pathways to protection in the EU: promoting resettlement, humanitarian admission and other complementary pathways, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32020H1364 COMMISSION RECOMMENDATION

text: (EU) 2020/1365

text: of 23 September 2020 on cooperation among Member States concerning operations carried out by vessels owned or operated by private entities for the purpose of search and rescue activities, https://eur-lex.europa.eu/legalcontent/EN/TXT/?uri=uriserv%3AOJ.L_.2020.317.01.0023.01.ENG&toc=OJ%3AL%3A2020%3A317%3ATO C Commission Guidance on the implementation of EU rules on definition and prevention of the facilitation of unauthorised entry, transit and residence, C(2020) 6470 final COM(20202)609, p.2. EDPS Strategy 2020-2024 Shaping a Safer Digital Future: a new Strategy for a new decade, https://edps.europa.eu/sites/edp/files/publication/20-06-30_edps_shaping_safer_digital_future_en.pdf COM(2020)609, p.12. COM(2020)609, p.12. SWD(2020) 207 final, https://eur-lex.europa.eu/legalcontent/EN/TXT/?qid=1601291023467&uri=SWD%3A2020%3A207%3AFIN https://ec.europa.eu/home-affairs/what-we-do/policies/asylum/identification-of-applicants_en. Proposal for a Regulation of the European Parliament and of the Council on the establishment of 'Eurodac' for the comparison of fingerprints for the effective application of [

text: Regulation (EU) No 604/2013

text: establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person] , for identifying an illegally staying third-country national or stateless person and on requests for the comparison with Eurodac data by Member States' law enforcement authorities and Europol for law enforcement purposes (recast), COM(2016) 272 final. Commission Staff Working Document, SWD(2020) 207 final, ANNEX: Data protection-relevant elements in Eurodac The EDPS further observes that

text: Article 14(3)

text: stipulates that the initial collection of biometric data is transmitted to both Central System and the CIR while in other instances (e.g.

text: article 13(4)

text: ) only the CIR is mentioned. COM (2020) 612, p.13. See for instance section 2.2 of the European Migration Network, EMN Synthesis Report for the EMN Focussed Study 2017, Challenges and practices for establishing the identity of third country nationals in migration procedures, December 2017, available at: https://ec.europa.eu/homeaffairs/sites/homeaffairs/files/00_eu_synthesis_report_identity_study_final_en_v2.pdf COM(2020)612, p.12. European Data Protection Supervisor, Opinion 07/2016 Opinion on the First reform package on the Common European Asylum System (Eurodac, EASO and Dublin regulations)

identifier: EDPS yttrande 09/2020

title: New Pact on Migration and Asylum

text: Opinion 9/2020

text: EDPS Opinion on the New Pact on Migration and Asylum

text: 30 November 2020 1 | P a g e

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’. Under article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’ and under article 57(1)(g), the EDPS shall ‘advise on his or her own initiative or on request, all Union institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data’.

text: Under article 58(3)(c) of Regulation 2018/1725, the EDPS shall have the power ‘to issue on his or her own initiative or on request, opinions to Union institutions and bodies and to the public on any issue related to the protection of personal data’.

text: Wojciech Wiewiorówski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: 2 | P a g e

text: Executive Summary

text: On 23 September 2020, The European Commission presented the New Pact on Migration and Asylum encompassing five legislative proposals: i) an amended Proposal for a Eurodac Regulation; ii) an amended Proposal for Asylum Procedure; iii) a Proposal for an Asylum and Migration Management Regulation; iv) a Proposal for a Screening Regulation; v) a Proposal for a Crisis and Force Majeure Regulation. It also includes a number of non-legislative initiatives.

text: The EDPS acknowledges the need for a more effective management of migration and asylum. At the same time, as stated in the EDPS Strategy 2020-2024, data protection is one of the last lines of defence for vulnerable individuals, such as migrants and asylum seekers approaching the EU external borders. Therefore, the EDPS considers that the proposed comprehensive approach must be based on full respect to the fundamental rights of persons who seek international protection and other migrants, including their right to data protection and privacy.

text: In general, the EDPS considers that an in-depth fundamental rights and data protection impact assessment should be carried out. He is also of the view that the legislative proposals should clearly allocate the respective responsibilities of the different actors involved for processing personal data. In addition, taking into account the fact that most of the proposals in the New Pact on Migration and Asylum build upon the proposals to reform the Common European Asylum System from 2016, the EDPS considers that the recommendations in his Opinion 07/2016 on the first reform package on the Common European Asylum System, in particular those on Eurodac, remain fully valid.

text: More specifically, with regard to the amended Proposal for a Eurodac Regulation, the EDPS recommends that the authorities of Member States and the Union bodies continue to be able to see only the data that is relevant for the performance of their specific tasks, even if the data sets are linked in a sequence. The EDPS also recommends that the amended proposal explicitly introduces the single model of coordinated supervision in line with Article 62 of the EUDPR. The EDPS also recommends that before the start of the operational use of the modified system, the security framework for the Eurodac’s business and technical environment is properly updated and that the proposal clarifies what data would be stored in the Common Identity Repository and in the Eurodac Central System, respectively.

text: With regard to the Proposal for a Screening Regulation, the EDPS underlines that accuracy of the information processed is of key importance and that the right to rectify and/or supplement the personal data of third country nationals should be ensured in all cases. Furthermore, the EDPS considers that the proposal remains very general when it comes to the methods that can be used to gather data provided by or obtained from the third-country national for their identification or verification, especially taking into account the wide range of practices used at national level, with different degrees of intrusiveness and efficacy. The EDPS also recommends clarifying the purpose and modalities related to the processing of personal data for verifying whether the third country nationals constitute a risk to security.

text: 3 | P a g e

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof, Having regard to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) , Having regard to

text: Regulation (EC) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular Articles

text: (g) and 58(3)(c) thereof, Having regard to

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA ,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION AND BACKGROUND

text: 1. The European Commission presented the New Pact on Migration and Asylum on 23 September 2020. It is one of the key policy initiatives of the Commission and has been envisaged in its Work Programme, published on 29 January 2020, under the fifth priority - 'Promoting our European Way of Life'.

text: 2. The New Pact on Migration and Asylum consists of several legislative proposals as well as non-legislative instruments. It builds upon the Commission proposals to reform the Common European Asylum System (CEAS) presented by the Commission in 2016 and 2018, on which the Parliament and the Council have already found tentative political agreement but have not concluded the negotiations yet.

text: 3. In this context, the Commission presented two amended and three new legislative proposals:  an Amended proposal for a Regulation of the European Parliament and of the Council on the establishment of 'Eurodac' for the comparison of biometric data for the effective application of Regulation on Asylum and Migration Management (hereinafter “amended Proposal for a Eurodac Regulation”)  an Amended proposal for a Regulation of the European Parliament and of the Council establishing a common procedure for international protection in the Union and repealing Directive

text: (hereinafter aAmended Proposal for Asylum Procedure”) 5 | P a g e  a Proposal on asylum and migration management and amending

text: Council Directive (EC) 2003/109

text: and the proposed Regulation (EU) XXX/XXX [Asylum and Migration Fund] (hereinafter the “Proposal for an Asylum and Migration Management Regulation”)  a Proposal for a Regulation of the European Parliament and of the Council introducing a screening of third country nationals at the external borders and amending Regulations

text: (EC) 767/2008

text: (EU) 2017/2226

text: (EU) 2018/1240

text: and

text: (EU) 2019/817

text: (hereinafter the “Proposal for a Screening Regulation”)  a Proposal for a Regulation of the European Parliament and of the Council addressing situations of crisis and force majeure in the field of migration and asylum (hereinafter the “Proposal for a Crisis and Force Majeure Regulation”) In addition, the new Pact includes the following non-legislative initiatives:  a new recommendation on Migration Preparedness and Crisis Blueprint;  a new recommendation on Resettlement and Complementary pathways;  a new recommendation on Search and Rescue Operations by Private Vessels;  a new guidance on the Facilitators Directive.

text: 4. The EDPS was consulted by the Commission informally on 27 July 2020 on the amended Proposal for a Eurodac Regulation and communicated his informal comments to the Commission in August. The EDPS welcomes the fact that his views have been sought at an early stage of the procedure and encourages the Commission to continue with this good practice.

text: 5. The EDPS was subsequently formally consulted by the Commission on 5 October 2020 on the amended Proposal for a Eurodac Regulation. However, the consultation does not cover the other elements of the Migration and Asylum package, adopted on 23 September 2020, that might also have impact on the right to data protection and thus fall within the scope of

text: Article 42(1) of Regulation (EU) 2018/1725

text: (hereinafter the “EUDPR”).

text: 6. At the same time, the amended Proposal for a Eurodac Regulation refers to a number of other legislative proposals, part of the New Pact on Migration and Asylum, such as the Regulation on Asylum and Migration Management, Asylum Procedure Regulation, Screening Regulation, etc. Therefore, while the primary focus of this opinion is the amended Proposal for a Eurodac Regulation, it contains also certain comments and recommendatios on the other legislative proposals.

text: 2. GENERAL REMARKS

text: 7. The New Pact on Migration and Asylum advocates for a comprehensive approach to migration and asylum “[...] bringing together policy in the areas of migration, asylum, integration and border management”. The EDPS understands the need for a more effective management of migration and asylum. At the same time, as already stated in the EDPS Strategy 2020-2024, “[d]ata protection is one of the last lines of defence for vulnerable individuals, such as migrants and asylum seekers approaching EU external borders.” . Therefore, the proposed comprehensive approach must be based on full respect to the fundamental rights of persons who seek international protection and other migrants, including their right to data protection and privacy. 6 | P a g e

text: 8. Bringing asylum and migration management under the same legal and policy framework entails important legal and practical consequences. Different purposes call for different assessments of the necessity and proportionality of the envisaged measures. The proposals under the New Pact on Migration and Asylum further blur the distinction between the different policy areas of asylum, migration, police cooperation, internal security and criminal justice. This approach follows a trend already embedded in the interoperability framework, which, as explained by the Commission, once fully operational will “[...] connect all European systems for borders, migration, security and justice, and will ensure that all these systems ‘talk’ to each other [...].”

text: 9. While the EDPS welcomes the fact that each database will keep its safeguards, the changes brought by the New Pact on Migration and Asylum will introduce new processing operations, notably in the context of the envisaged screening procedure, with personal data of persons seeking international protection and other migrants used for wide-ranging policy goals and operational activities. The comprehensive approach envisaged by the New Pact on Migration and Asylum, together with the potential impact of such framework on fundamental rights, including on privacy and data protection, call for an in-depth fundamental rights and data protection impact assessment. In this context the EDPS notes that the Annex to the Commission Staff Working Document offers an analysis of some of the data protection-relevant elements of Eurodac, but regrets that there are no similar assessments for the other legislative proposals.

text: 10. In addition, the integrated approach of the New Pact on Migration and Asylum assigns specific tasks to a variety of actors at national and Union level, including EU agencies, such as the European Border and Coast Guard (Frontex) and the European Asylum Support Office (EASO), which will play a crucial role in the practical implementation of the proposed initiatives. Based on the experience of supervising EU large-scale IT systems, the EDPS considers that the legal acts should clearly allocate the respective responsibilities for processing personal data, which is essential for the attribution of controllership pursuant to the EUDPR and the GDPR.

text: 3. COMMENTS ON THE AMENDED PROPOSAL FOR A EURODAC REGULATION

text: 3.1. Previous recommendations

text: 11. The Eurodac database, established in 2003, holds and makes it possible to compare fingerprints of asylum seekers in the EU. It enables EU Member States to determine if an asylum seeker has already applied for asylum in another country. All EU countries, Iceland, Norway, Liechtenstein and Switzerland use it. The primary objective of the Eurodac database is to serve the implementation of Regulation (EU) No. 604/20133 (“the Dublin Regulation”) and together these two instruments make up what is commonly referred to as the “Dublin system”.

text: 12. In 2016 the European Commission presented proposals to reform the Common European Asylum System (CEAS), including also a recast of the Eurodac Regulation. The main change is the extension of the scope and the purpose of Eurodac, in particular facilitating returns and helping tackling of irregular migration. 7 | P a g e

text: 13. The amended Proposal for a Eurodac Regulationcomplements the changes already proposed by the Commission in 2016, such as the enlarged scope of Eurodac, new categories of persons for whom data should be stored, its use to identify irregular migrants, lowering the age for fingerprinting, allowing the collection of identity information together with the biometric data, and the extension the data storage period.

text: 14. The EDPS issued Opinion 07/2016 on the first reform package on the Common European Asylum System (Eurodac, EASO and Dublin regulations) where he made a number of recommendations concerning in particular the Eurodac system. Taking into account the fact that the amended Proposal for a Eurodac Regulationbuilds upon the one presented in 2016, the EDPS considers that his initial recommendations remain fully valid, including those concerning the need to: - conduct a full data protection impact assessment in order to measure the privacy impact of the extension of the scope of Eurodac; - conduct a detailed assessment of the situation of minors and finding a balance between the risks and harms of the procedure of taking biometric data from minors and the advantages from which they can benefit.

text: 3.2. Linking all data sets belonging to one person in a sequence

text: 15. One of the most substantial changes in the amended Proposal for a Eurodac Regulationis that all data sets registered in Eurodac, corresponding to the same third-country national or stateless person, should be linked in a sequence. The linking would be done automatically by the Central System where there is a hit against at least one other data set in that sequence.

text: 16. The EDPS understands the added value of the measure in the context of better policymaking in the field of migration and asylum. However, he does not share the conclusion of the Commission that “[s]uch a linking process would not have an impact from a data protection perspective [...]” . The proposed change, combined with the new categories of personal data processed in Eurodac and the largely extended list of authorities with access to the data in the context of the interoperability of the large-scale IT systems, is liable to have a substantial impact on the concerned individuals.

text: 17. In order to mitigate the additional risks and ensure the proportionality of the measure, there is a need for a detailed data protection impact assessment and introduction of appropriate and effective safeguards. In particular, in line with the principles of purpose limitation and data minimisation, it is important to ensure that the authorities of Member States and the Union bodies should continue to be able to see only the data that is relevant for the performance of their specific tasks, even if the data sets are linked in a sequence.

text: 3.3. Coordinated supervision of Eurodac

text: 18. The indipendent supervision of the data processing activities in Eurodac, both at central and national level, is one of the key guarantees for the effective protection of the fundamental rights of the data subjects, in line with Article 8(3) of the Charter of Fundamental Rights.

text: 19. The 2016 proposal for the recast of Eurodac Regulation has envisaged specific rules for the cooperation between national supervisory authorities and the European Data Protection Supervisor in the context of Eurodac. Subsequently, in December 2018, the EUDPR 8 | P a g e entered into application, introducing a single model of coordinated supervision of the Union large-scale IT systems. In particular, pursuant to

text: Article 62

text: , the EDPS and the national supervisory authorities, each acting within the scope of their respective competences, should cooperate within the framework of the European Data Protection Board (EDPB). To that end, the EDPB has established in 2019 a dedicated Coordinated Supervision Committee.

text: 20. The alignment of the coordinated supervision of Eurodac with the model applied by the other large-scale IT systems is particularly important in light of the interoperability of the various systems in the JHA area. To this end, the EDPS recommends that the amended Proposal for a Eurodac Regulation explicitly introduces the single model of coordinated supervision, e.g. by making a reference to

text: Article 62

text: EUDPR.

text: 3.4. Security, data storage and statistics

text: 21. Article 4 of the amended Proposal for a Eurodac Regulation (“System architecture and basic principles") indicates that part of Eurodac data would be stored in the common identity repository (CIR), while the remaining data will be stored in the Eurodac Central System. Article 4(2) of the amended Proposal for a Eurodac Regulation indicates that the CIR would contain some of the data referred to in Articles

text: 14 and 14a, whereas the remaining data shall be stored in the Eurodac Central System. The EDPS understands this to mean that the data referred to would be stored only once in the CIR and not stored a second time in the Central System.

text: 22. On the other hand, the proposal indicates for example in

text: Article 13(2)

text: that : “[...] The Member State concerned shall [...] transmit to the Central System and to the CIR as appropriate the following data [...]”. The EDPS recommends to be clarified exactly what data and in which systems would be stored, taking into account the principles of data minimisation and storage limitation.

text: 23. Another novelty, envisaged in the amended proposal for a Eurodac Regulation, is the provision in

text: Article 9

text: on cross-system statistics in Eurodac. According to Article 9(3) of the proposal, its purpose is to support the objective referred to in

text: Article 1

text: (c), i.e. control of irregular immigration and detection of secondary movements within the Union.

text: 24. The EDPS believes that cross-system statistics could play a wider role, inter alia in the field of the supervision. To this end, the EDPS recommends that this objective is also considered when deciding on the exact type and content of the statistics to be drawn up by eu-LISA.

text: 25. Finally, the EDPS would like to draw the attention on the fact that the extended scope of Eurodac and the storing of biometric data, together with other identification data and colour copies of identity documents, increases significantly the risks in case of data breach or other security incident. In this regard, the EDPS recommends that before the start of the operational use of the modified system, the security framework for the Eurodac’s business and technical environment is properly updated, in line with Article 33 of the EUDPR. 9 | P a g e

text: 4. COMMENTS ON OTHER LEGISLATIVE PROPOSALS

text: 26. The EDPS notes that two of the new legislative proposals, namely the proposal for a Screening Regulation and the Proposal for a Crisis and Force Majeure Regulation, lack entirely any substantive legal provisions on personal data protection or at least a reference to the applicable Union legal framework. In the absence of a formal consultation on these proposals pursuant to

text: Article 42(1)

text: EUDPR, the EDPS wishes to make the following observations.

text: 27. The proposal for an Asylum and Migration Management Regulation contains a specific provision -

text: Article 62

text: “Data security and data protection”. However, it also does not refer to the relevant Union legislation on data protection. In addition, paragraph 3 of the proposed

text: Article 62

text: lays down that “t]he processing of personal data by the Asylum Agency shall be subject to Regulation (EU) XXX/XXX [European Union Asylum Agency], in particular as regards the monitoring of the European Data Protection Supervisor.”. (emphasis added). The proposed wording could thus be interpreted that the only rules on data protection applicable to EASO are contained in its basic act. Moreover, the proposed drafting appears to suggest that EASO might be monitoring the EDPS, not the other way round.

text: 28. The management of migration and asylum is innately related to processing of personal data, including special categories (sensitive) data. Therefore, the EDPS recommends that the legislative proposals as a minimum refer explicitly to the relevant Union legal framework on data protection, i.e. GDPR, EUDPR and, if relevant,

text: Directive (EU) 2016/680

text: . Where appropriate, these general rules could be further specified and particularised in the legal acts of the Migration and Asylum Package. In the same context, the EDPS invites the legislator to correct the current wording of Article 62 of the proposal for an Asylum and Migration Management Regulation, in particular paragraph 3 thereof.

text: 29. One of the initiatives with the greatest impact on the right to protection of personal data is the ‘pre-entry screening’ procedure at the external borders of the Union, envisaged in the Proposal for a Screening Regulation. This screening would apply to all non-EU citizens (i) who cross an external border without authorisation, (ii) who apply for asylum while being checked at the border (without meeting the conditions for legal entry), or (iii) who are disembarked after a search and rescue operation. Furthermore, the objectives of the screening procedure are manifold: identification, health and security checks, vulnerability assessment, as well as registration of biometric data (fingerprints and facial images) in the new version of the Eurodac database.

text: 30. The Commission’s proposal acknowledges that the envisaged screening activities would affect the right to the protection of personal data but considers it as strictly necessary and proportionate to reaching the objectives pursued. The EDPS regrets that the legislative proposal for a Screening Regulation is not accompanied by a detailed impact assessment that could substantiate this conclusion.

text: 31. In addition, the EDPS considers that the proposal remains very general when it comes to the methods that can be used to gather datafrom the third-country nationals for their identification. This approach has the potential to seriously interfere with the rights to data protection and privacy of third country nationals, especially taking into account the wide range of methods used by Member States to support identification and identity verification 10 | P a g e processes in the absence of documentary evidence of identity. The EDPS also considers that the proposal should clarify the modalities related to the processing of personal data for verifying whether the third country nationals constitute a risk to security (

text: Article 11

text: 32. With regard to the outcome of the screening procedure, the EDPS notes that it will end with a debriefing form to be completed by the authorities responsible for the screening (

text: Article 13

text: ) and then transmitted to asylum or return authorities (

text: Article 14(1)

text: ). In the case of applicants for international protection, the authorities responsible for the screening would also provide any elements that may seem to be relevant for determining whether the competent authorities should submit the application of the third-country national concerned to an accelerated examination procedure or to the border procedure (

text: Article 14(2)

text: ). In this regard, the EDPS underlines that the accuracy of the information is crucial as it will to great extent determine the situation of the data subject, including their procedural rights.

text: 33. Furthermore, the EDPS notes that according to the Commission, the envisaged screening constitutes “[...] mere information-gathering stage which prolongs or complements the checks at the external border crossing point and which does not entail any decision affecting the rights of the person concerned” and that for this reason no judicial review is foreseen regarding the outcome of the screening. In this context, the EDPS believes that the right of the third country national subject to the screening, to rectify and/or supplement the personal data about them, should be ensured in all cases.

text: 34. The EDPS further notes that the proposal remains silent with regard to the data retention period of the debriefing form and invites the legislator to introduce a provision addressing this.

text: 35. Finally, the EDPS welcomes the requirement of an independent monitoring mechanism for fundamental rights in relation to the screening that the Member States are required to establish (

text: Article 7

text: ). To ensure that this monitoring goes hand in hand with supervision stemming from other legislative acts, the EDPS believes that, where relevant, a close cooperation should be established between the monitoring bodies and the respective data protection authorities.

text: 5. CONCLUSIONS

text: The EDPS understands the need for a more coherent and effective management of migration and asylum. At the same time, as already stated in the EDPS Strategy 2020-2024, “[d]ata protection is one of the last lines of defence for vulnerable individuals, such as migrants and asylum seekers approaching EU external borders.” . Therefore, the proposed comprehensive approach must be based on full respect to the fundamental rights of persons who seek international protection and other migrants, including their right to data protection and privacy.

text: 36. To this end, the EDPS, in his advisory role, provides in this Opinion some specific recommendations in terms of data protection and privacy. While the primary focus of this Opinion is the amended Proposal for a Eurodac Regulation, it also contains a number of comments and recommendations on the other legislative proposals. The comprehensive approach envisaged by the New Pact on Migration and Asylum, together with the 11 | P a g e potential impact of such framework on fundamental rights, including on privacy and data protection, call for an in-depth fundamental rights and data protection impact assessment.

text: 37. In addition, the integrated approach of the New Pact on Migration and Asylum assigns specific tasks to a variety of actors at national and Union level, including EU agencies, such as the European Border and Coast Guard (Frontex) and the European Asylum Support Office (EASO). Based on his experience of supervising the EU large-scale IT systems, the EDPS considers that the legislative proposals should clearly allocate the respective responsibilities for processing personal data, which is essential for the attribution of controllership pursuant to the EUDPR and the GDPR. Regarding the amended Proposal for a Eurodac Regulation, the EDPS considers that that the recommendations made in his Opinion 07/2016 on the first reform package on the Common European Asylum System , in particular those on Eurodac, remain fully valid. In addition, with regard to the novelties introduced by the amended Proposal for a Eurodac Regulation, the EDPS considers important to ensure that the authorities of the Member States and the Union bodies continue to be able to see only the data that is relevant for the performance of their specific tasks, even if the data sets are linked in a sequence. Furthermore, the EDPS recommends to explictly introduce the single model of coordinated supervision in line with Article 62 of the EUDPR. The EDPS also recommends that before the start of the operational use of the modified system, the security framework for the Eurodac’s business and technical environment is properly updated and that the proposal clarifies what data would be stored in the Common Identity Repository (CIR) and in the Eurodac Central System, respectively.

text: 38. Regarding the other proposals, and in particular the Proposal for a Screening Regulation, the EDPS underlines that accuracy of the information processed is key and that the right to rectify and/or supplement the personal data of third country nationals should be ensured in all cases. Furthermore, the EDPS considers that the proposal remains very general when it comes to the methods that can be used to gather data from the third-country nationals for their identification, especially taking into account the wide range of practices used at national level, with different degrees of intrusiveness and efficacy. The EDPS also recommends clarifying the purpose and modalities related to the processing of personal data for verifying whether the third country nationals constitute a risk to security

text: 39. Finally, the EDPS notes that the new legislative proposals either lack entirely any substantive legal provisions on personal data protection, or the proposed texts are not fully in line with the relevant Union law. Therefore, the EDPS recommends that the legislative proposals as a minimum refer explicitly to the relevant Union legal framework on data protection, i.e. GDPR, EUDPR and, if relevant,

text: Directive (EU) 2018/680

text: . Brussels, 30 November 2020 Wojciech Rafał WIEWIÓROWSKI (e-signed) 12 | P a g e

text: Notes

text: 13 | P a g e

type: vagledning

utgivare: edps


text: OJ L 295, 21.11.2018, p. 39.

text: See the UN Member States here: https://www.un.org/en/about-us/member-states

text: See Preamble of the Charter of the United Nations, San Francisco, 26 June 1945: https://www.un.org/en/about-us/un-charter/full-text

text: United Nations General Assembly Resolution of 17 December 2018, A/RES/73/187.

text: United Nations General Assembly Resolution of 27 December 2019, A/RES/74/247. See page 1 of the Resolution.

text: The open-ended intergovernmental Expert Group to Conduct a Comprehensive Study on Cybercrime was established by the Viennabased Commission on Crime Prevention and Criminal Justice (CCPCJ) on the request of the UN General Assembly Resolution 65/230, and is a subsidiary body of CCPCJ. The Expert Group is separate from the Ad Hoc Committee negotiating the Convention, which is a subsidiary body of the General Assembly with a different mandate.

text: Members of the Ad Hoc Committee are as follows: Algeria (Chair), Egypt, Nigeria, China, Japan, Estonia, Poland, Russian Federation, Dominican Republic, Nicaragua, Brazil, Australia, Portugal, United States (Vice-Chairs), Indonesia (rapporteur).

text: United Nations General Assembly Resolution of 26 May 2021, A/RES/75/282.

text: See point 11 of the Resolution.

text: Submisssions to this first session are available here: https://www.unodc.org/unodc/en/cybercrime/ad_hoc_committee/ahc-firstsession.html.

text: Recommendation for a Council Decision authorising the negotiations for a comprehensive international convention on countering the use of information and communications technologies for criminal purposes (COM(2022)132 final).

text: See Explanatory Memorandum, p. 2 and Article 1 of the Recommendation.

text: See Explanatory Memorandum, p. 3.

text: Idem.

text: Idem, p. 4.

text: See Recital 3. 7

text: See Explanatory Memorandum, p. 1. 8

text: All except Ireland, which has signed but not ratified the Convention, but nevertheless committed to pursuing accession.

text: See the Chart of signatures and ratification of the Cybercrime Convention for a complete and updated list of countries parties to the Cybercrime Convention, available at: https://www.coe.int/en/web/conventions/full-list?module=signatures-by-treaty&treatynum=185

text: On 5 April 2022, the Council of the European Union adopted a decision authorising Member States to sign, in the interest of the EU, the Second Additional Protocol. On the same day, the Council also decided to send to the Parliament for its approval the decision to authorise member states to ratify the Protocol.

text: Emphasis added.

text: Emphasis added.

text: See for instance Council decision authorising the opening of negotiations to amend the Agreement between the European Union and Japan on mutual legal assistance in criminal matters (12141/21) and Council decision authorising the opening of negotiations with a view to concluding an agreement between the European Union and the United States of America on cross-border access to electronic evidence for judicial cooperation in criminal matters (9114/19). 9

text: Emphasis added.

text: EDPS Opinion 3/2019 regarding the participation in the negotiations in view of a second additional Protocol to the Budapest Cybercrime Convention, paragraphs 18 and 19. 10

text: The EDPS recalls that, pursuant to

text: Article 216(2)

text: TFEU, international agreements concluded by the European Union ‛are binding upon the institutions of the Union and on the Member States’. Moreover, according to the settled case law of the CJEU, international agreements become from their coming into force ‛an integral part of Community law’ , and they have primacy over acts of secondary Union legislation .

text: Judgment of the Court of Justice of 30 April 1974,

text: , R.&V. Haegeman v. Belgian State, ECLI:EU:C:1974:41, paragraph 5.

text: Judgment of the Court of Justice of 3 June 2008,

text: , Intertanko and Others, ECLI:EU:C:2008:312, paragraph 42.

text: See point 25 of the Annex.

text: Judgment of the Court of Justice of 30 April 1974, Joined cases

text: P and

text: P, Kadi v. Council, ECLI:EU:C:2008:461, paragraph 285. 11

text: Judgment of the Court of Justice of 2 October 2018, Ministerio fiscal,

text: , ECLI:EU:C:2018:788, par. 54, see also par. 56.

text: Ibid par. 62. [Emphasis added].

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89.

text: Emphasis added. 12

text: See point 24 of the Annex

text: Such as the suspension from the UN Human Rights Committee. 13

text: See for instance the Hague Convention on the recognition and enforcement of foreign judgments in civil or commercial matters, The Hague, 2 July 2019,

text: Article 29

text: . 14

identifier: EDPS yttrande 09/2022

publisher: Europeiska datatillsynsmannen

sprak: en

title: Opinion on the Recommendation for a Council Decision authorising the negotiations for a comprehensive international convention on countering the use of information and communications technologies for criminal purposes

serie: yttranden

text: 18 May 2022

type: rubrik

text: Opinion 9/2022

text: on the Recommendation for a Council Decision authorising the negotiations for a comprehensive international convention on countering the use of information and communications technologies for criminal purposes

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under

text: Article 52(2) of Regulation (EU) 2018/1725

text: ‘[w]ith respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ’…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under

text: Article 42(1) of Regulation (EU) 2018/1725

text: , the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’ and under

text: Article 57(1)

text: (g), the EDPS shall ‘advise on his or her own initiative or on request, all Union institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the EDPS' mission to advise the EU institutions on coherently and consistently applying the EU data protection principles, including when negotiating agreements with third countries in the law enforcement sector. It builds on the general obligation that international agreements must comply with the provisions of TFEU and the respect for fundamental rights that stands at the core of EU law. In particular, compliance with Articles 7 and 8 of the Charter of Fundamental Rights of the EU and

text: Article 16

text: TFEU must be ensured.

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Recommendation that are relevant from a data protection perspective.

text: Executive Summary

text: On 29 March 2022, the European Commission issued a Recommendation for a Council Decision authorising the participation of the Commission, on behalf of the European Union, in the United Nations (UN) negotiations for a comprehensive international convention on countering the use of information and communications technologies for criminal purposes.

text: The EDPS understands the need for law enforcement authorities to secure and obtain electronic evidence quickly and effectively. He underlines however, that there is already a similar international instrument in force i.e. the Budapest Convention and its Second Additional Protocolwhich is now open for signature.

text: The EDPS notes that negotiations in the UN for another convention aiming to address cybercrime and cross-border cooperation in criminal matters have already started. He therefore supports the recommendation for the Commission to be authorised to negotiate on behalf of the EU, as it would contribute to better preserving the level of protection guaranteed by the EU data protection framework. The EDPS notes, however, the vast numbers of countries within the UN, with highly heterogeneous legal systems. Against this background, the EDPS considers that there is a substantial risk that the final text of the Convention could lead to a weakening of the fundamental rights and freedoms of natural persons provided for by EU law, in particular their rights to data protection and privacy. Therefore, it has to be underlined that should the Council authorise the Commission to negotiate in this framework on behalf of the EU, such authorisation would not require the EU to become party to the Convention, should it be adopted. The EDPS considers that the EU should not seek to be party to such a Convention, should the level of data protection of natural persons guaranteed by EU law be undermined.

text: This Opinion aims to provide constructive and objective advice to the EU institutions with a view to ensuring that the level of data protection as guaranteed by EU law is not undermined. The EDPS welcomes that the mandate aims at ensuring from the outset that the Convention provides strict conditions and strong safeguards to ensure that EU Member States can respect and protect fundamental rights, freedoms and general principles of EU law as enshrined in the EU Treaties and the Charter of Fundamental Rights of the EU.

text: In this context, the EDPS stresses the need to ensure in particular full respect for the fundamental rights to privacy and to the protection of personal data. The EU data protection law regime provides, in principle, that data transfers to a third country can take place without additional requirements only when that third country ensures an adequate level of protection. When the third country has not been declared as adequate, exceptions apply for specific transfers, as long as appropriate safeguards are provided. While the EDPS recognises that it may not be feasible to replicate the terminology and definitions of EU law in an agreement with a large number of third countries, the safeguards for individuals must be clear and effective in order to fully comply with EU law. The Court of Justice of the European Union in recent years has reaffirmed data protection principles including judicial redress and individual rights of individuals. These principles become all the more important considering the sensitivity of the data required for criminal investigations.

text: Against this background, the EDPS considers that, while many negotiating directives already envisaged are welcome, they should be reinforced. In particular, to ensure compliance with the EU Charter and

text: Article 16

text: TFEU, the EDPS makes four main recommendations on the negotiating directives:

text: -to limit the international cooperation provisions to the crimes defined in the Convention;

text: -direct access to data by third country law enforcement authorities and cross-border direct cooperation with service providers should be excluded;

text: -to ensure that future bilateral and multilateral agreements with third countries should apply in lieu of the Convention should these future agreements ensure higher standards with regard to the protection of fundamental rights, in particular the right to privacy and data protection;

text: -to ensure that the Convention shall not have effect between two Contracting States if one of them makes the notification that the ratification, acceptance, approval or accession of another Contracting State will not have the effect of establishing relations between those two Contracting States pursuant to this Convention.

text: Additionally, the Opinion offers further recommendations for improvements and clarifications of the negotiating directives. The comments in this Opinion are without prejudice to any additional comments that the EDPS could make as further issues may arise and would then be addressed once further information is available. He expects to be consulted later on the provisions of the draft Convention before its finalisation.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘the EUDPR’), and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. The United Nations (UN) is an intergovernmental organisation, currently made up of 193 Member States . The UN and its work are guided by the purposes and principles contained in its founding Charter. Pursuant to the UN Charter, the organisation's objectives include maintaining international peace and security, protecting human rights, delivering humanitarian aid, promoting sustainable development, and upholding international law .

text: 2. On 17 December 2018, the UN General Assembly adopted Resolution 73/187 on ‘Countering the use of information and communications technologies for criminal purposes’ . Subsequently, on 27 December 2019, it adopted Resolution 74/247 through which it decided to establish an open-ended ad hoc Intergovernmental committee of experts (‘the Ad Hoc Committee’), to elaborate a comprehensive international convention on countering the use of information and communications technologies for criminal purposes. Resolution 74/247 stresses the need to enhance coordination and cooperation among States in combating the use of information and communications technologies for criminal purposes, including by providing technical assistance to developing countries, upon their request. The Resolution also stresses the need to improve national legislation and frameworks and build the capacity of national authorities to deal with such use in all its forms, including its prevention, detection, investigation and prosecution , taking into full consideration existing international instruments and efforts at the national, regional and international levels on combating the use of information and communications technologies for criminal purposes, in particular the work and outcomes of the openended intergovernmental Expert Group to Conduct a Comprehensive Study on 5 Cybercrime . Three EU Member States (Estonia, Poland and Portugal) are Vice-Chairs within the Ad Hoc Committee .

text: 3. On 26 May 2021, by Resolution 75/282 , the UN General Assembly further reaffirmed that the Ad Hoc Committee shall take into full consideration existing international instruments and efforts at the national, regional and international levels on combating the use of information and communications technologies for criminal purposes . It decided that this Ad Hoc Committee shall convene at least six sessions, and conclude its work in order to provide a draft Convention to the General Assembly at its seventy-eighth session, which should start in September 2023 and end in September 2024.

text: 4. The first negotiating session was held from 28 February until 11 March 2022. At that occasion the objectives, scope, structure and key elements of the Convention were discussed . According to the draft report of this first negotiating session, it was agreed that the following elements should form the structure of the Convention : Preamble 1. General provisions 2. Criminalization 3. Procedural measures and law enforcement 4. International cooperation 5. Technical assistance, including exchange of experience 6. Preventive measures 7. Mechanism of implementation

text: 8. Final provisions.

text: 5. The European Commission took part in the meetings of the Ad Hoc Committee as an observer. An intersessional session took place on 24 and 25 March 2022 to solicit inputs from a diverse range of stakeholders on the elaboration of the draft Convention . The next negotiating session should start on 30 May 2022 .

text: 6. On 29 March 2022, the European Commission issued a Recommendation for a Council Decision authorising the participation of the Commission, on behalf of the European Union, in the United Nations negotiations for a comprehensive international Convention on countering the use of information and communications technologies for criminal purposes 6 (‘the Recommendation’) . The Recommendation is accompanied by an Annex (‘the Annex’), which sets out the proposed Council directives to negotiate the Convention.

text: 7. The Commission recommends the adoption of a Council Decision on the basis of the procedure laid down in Article 218 of the Treaty on the Functioning of the European Union (TFEU) for agreements concluded between the EU and third countries. With this Recommendation, the Commission seeks to obtain authorisation from the Council to be appointed as the main negotiator on behalf of the EU in order to ensure the appropriate participation of the EU in the UN negotiations which are expected to touch upon elements that relate to EU legislation and competence, notably in the area of cybercrime .

text: 8. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 29 March 2022, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 5 of the Recommendation.

text: 2. General remarks

text: 9. According to the Explanatory Memorandum, negotiations on the Convention are expected to relate to common EU rules to fight cybercrime, such as Directive

text: on combating the sexual exploitation of children online and child pornography, Directive

text: on attacks against information systems, and

text: Directive (EU) 2019/713

text: on combating fraud and counterfeiting of non-cash means of payment . Other EU instruments provide common rules for fighting crimes that may be enabled by the use of information systems, such as terrorism, trafficking in human beings, illicit drug trafficking, illicit arms trafficking, money laundering, corruption and organised crime . The negotiations are also expected to cover criminal procedural and cooperation measures. The Union has adopted several instruments in this area .

text: 10. The EDPS notes that the negotiations within the UN are already engaged in accordance with the previously mentioned Resolution 74/247 and Resolution 75/282 of the UN General Assembly. Given the relevance of these negotiations for EU policy in the area of cybercrime and collecting electronic evidence in criminal matters, in particular for the protection of personal data and privacy, the EDPS supports the adoption of a Council Decision giving a clear mandate to the European Commission to participate in these negotiations on behalf of the EU.

text: 11. As underlined by the Recommendation , a new international convention on countering the use of information and communications technologies for criminal purposes may affect common Union rules or alter their scope. The EDPS stressed the need to ensure that the Convention is compatible with EU law, including compliance with the Charter, in particular the rights to privacy and to protection of personal data, and with

text: Article 16

text: TFEU.

text: 12. The EDPS understands the need for law enforcement authorities to secure and obtain electronic evidence quickly and effectively. He recalls, however, the vast number of countries within the UN, with highly heterogeneous legal systems. Against this background, the EDPS considers that there is a substantial risk that the Convention could lead to a weakening of the protection of fundamental rights and freedoms of natural persons guaranteed under EU law in particular their rights to data protection and privacy.

text: 13. The EDPS also underlines that there is already a similar international instrument in force i.e. the Budapest Convention and its Second Additional Protocol which has recently been negotiated and is now open for signature.

text: 14. Against this background, the EDPS wishes to stress that the Council authorisation of the Commission to negotiate on behalf of the EU should not be construed as a requirement for the EU to become party to the Convention, should it be adopted, and in particular, that the EU should not seek to become a party to such a Convention if it could undermine the level of data protection of natural persons guaranteed by EU law.

text: 15. While the EDPS recognises that it may not be feasible to replicate the terminology and definitions of EU law in an agreement with a vast number of third countries, the safeguards for individuals must be clear and effective in order to fully comply with EU law. The Court of Justice of the European Union in recent years has reaffirmed data protection principles including judicial redress and individual rights of individuals. These principles become all the more important considering the sensitivity of the data required for criminal investigations.

text: 16. This Opinion aims to provide constructive and objective advice with a view of ensuring the level of data protection as guaranteed by EU law is not undermined. It provides further recommendations on the following topics: - the relationship between the Convention and other instruments; - the scope of the Convention; - the safeguards regarding the international transfers of personal data; - the final clauses of the Convention (suspension, review and establishment of relations).

text: 17. The EDPS remains at the disposal of the Commission, the Council and the European Parliament to provide advice at further stages of this process.

text: 3. Relationship with other instruments

text: 18. The Recommendation recalls that a binding international instrument requiring its parties to lay down specific criminal offences committed against or by means of electronic networks in their national law, entailing minimum requirements on investigative powers available in a criminal investigation and fostering international co-operation between the Parties, already exists, namely, the Council of Europe Convention on Cybercrime (ETS No. 185) (‘the Budapest Convention’), which is open for signature by Member States of the Council of Europe and by non - members which have participated in its elaboration or for accession (upon invitation), for those non-members which have not participated to its elaboration. Currently, 66 countries are Parties to the Budapest Convention, including 26 European Union Member States and other third countries members of the Council of Europe such as Armenia, Azerbaijan or Turkey as well as countries who are not members of the Council of Europe, such as Australia, Canada, Ghana, Israel, Japan, Morocco, Paraguay, Philippines, Senegal, Sri Lanka, Tonga or the United States . In addition, on 17 November 2021, the Committee of Ministers of the Council of Europe adopted a Second Additional Protocol to the Budapest Convention which has been opened for signature since 12 May 2022. The Protocol aims to provide for additional tools for international cooperation, including for co- operation in emergency situations.

text: 19. The EDPS welcomes point 6 of the Annex recommending the Union to achieve that the future UN Convention “is compatible with and complement[s] existing international instruments, in particular the 2001 Council of Europe Budapest Convention on Cybercrime and its protocols, the 2000 United Nations Convention against Transnational Organized Crime and its protocols, but also other relevant international and regional instruments” and that the future UN Convention “avoids any impact on their application or the further accession of any country to them and, to the extent possible, avoid unnecessary duplication” .

text: 20. The EDPS also welcomes point 17 of the Annex according to which the Union should achieve that the “cooperation measures [...] are compatible with such conventions and with international human rights standards” and point 23 of the Annex, where it is made clear that the Union should aim to achieve that the Convention preserves existing global and regional instruments.

text: 21. The EDPS however recommends including in the Annex that the Union should aim to achieve that future agreements with third countries should apply in lieu of the Convention should these future agreements ensure higher standards with regard to the protection of fundamental rights, in particular the right to privacy and data protection .

text: 22. Finally, the EDPS welcomes and strongly supports the inclusion of a “disconnection clause” in point 23 of the Annex to ensure that between EU Member States, EU secondary law still applies in order to preserve the EU legal order.

text: 4. Scope of the Convention

text: 4.1. Criminal offences covered by the Convention

text: 23. The EDPS welcomes the objective of clearly and narrowly defining offences that would be subject to the Convention, i.e. “offences that can only be committed using information systems” (point 9 of the Annex) and “offences that can be committed without using information systems but that can be enabled by the use of information systems in certain circumstances, but only in cases where the involvement of information systems substantially changes the characteristics or impact of the offences (point 10 of the Annex) [emphasis added]. He also welcomes that the definitions should be “compatible with those in other relevant international or regional conventions in particular in the area of organised crime or cybercrime, and international human rights standards” (point 11 of the Annex).

text: 24. Under point 16 of the Annex, it is recommended that the Convention provides for “cooperation measures that allow authorities in different States that are party to the instrument to cooperate effectively for the purpose of criminal investigations or proceedings concerning offences defined in the instrument or to cooperate to preserve or obtain electronic evidence of any criminal offence as part of a criminal investigation or proceeding” [emphasis added] . The EDPS observes that the recommended directives encompass cooperation to preserve or obtain electronic evidence of any criminal offence as part of criminal investigations or proceedings. He considers that limiting the scope of the international cooperation under the Convention only to the crimes defined by the Convention would constitute an important guarantee of the necessity and proportionality of the proposed solutions, having in mind highly heterogeneous legal systems of the possible future parties to the Convention. Therefore, the EDPS considers that the scope of the future provisions on cooperation should also be limited to the crimes defined in the Convention.

text: 4.2. Excluding direct access to data and direct cooperation with service providers by law enforcement authorities

text: 25. At this early stage of the negotiations, the scope of the Convention still remains unclear, in particular as far as the modalities of cooperation are concerned.

text: 26. However, as the EDPS already stated in the framework of the negotiations of the Second Additional Protocol to the Budapest Convention , he considers cross-border direct access to data by law enforcement authorities of third countries as a particularly intrusive measure and consequently having a bigger impact on the fundamental rights to privacy and data protection. Hence, he considers that the such provisions should not be introduced in the Convention and a directive to this effect should be introduced in the Annex.

text: 27. Given the number of countries likely to become parties to the Convention, with highly heterogeneous legal systems as regard the respect of fundamental rights and freedoms, including the fundamental rights to privacy and data protection, the EDPS also recommends opposing any attempt to introduce in the Convention of provisions on direct cooperation by third countries authorities with service providers under EU jurisdiction. In this regard, it should be clarified that point 15 of the Annex concerns only the cooperation between the law enforcement authorities and service providers in the same country and does not concern cross-border cooperation between law enforcement authorities and service providers in another country. This need for clarification is all the more important as point 19 of the Annex states that the Convention should ensure that EU Member States are able to comply with requirements for the international transfers of personal data within the meaning of the GDPR, which seems to imply that direct cooperation between service providers in the EU and third countries authorities parties to the Convention is in fact not excluded at this stage.

text: 5. Need for appropriate safeguards regarding international data transfers and the respect of fundamental rights

text: 29. Since the Convention would be a binding international instrument to which the Union would be a party , the EDPS notes that, in line with the case law of the CJEU, the ‛obligations imposed by an international agreement cannot have the effect of prejudicing the constitutional principles of the EC Treaty, which include the principle that all Community acts must respect fundamental rights, that respect constituting a condition of their lawfulness’ . It is therefore essential to ensure that the obligations stemming from the Convention fully respect the fundamental right to data protection.

text: 30. The EDPS therefore welcomes point 8 of the Annex stipulating that the Union should achieve that the provisions of the Convention achieve the highest possible protection of human rights and that EU Member States should be able to comply with EU law, including the fundamental rights, freedoms and general principles of EU law as enshrined in the European Union Treaties and the Charter. The EDPS also welcomes in this regard the clear reference to the principle of proportionality in point 13 of the Annex.

text: 31. In addition, the EDPS notes and supports point 18 of the Annex which aims to achieve that cooperation measures are subject to the conditions provided for by the law of the requested party and provide for broad grounds for refusal such as to ensure the protection of fundamental rights, including the right to the protection of personal data, including in the context of personal data transfers, and, where appropriate, the existence of double criminality.

text: 32. The EDPS recalls that according to the CJEU case law, only the objective of fighting serious crime is capable of justifying access by public authorities to personal data retained by service providers “which taken as a whole, allows very precise conclusions to be drawn concerning the private lives of the persons concerned” . Where such conclusions cannot be drawn and therefore access could not “be defined as a serious interference with the fundamental rights of the persons whose data is concerned”, the Court further held that “the interference that access to such data entails is capable of being justified by the objective of (...) preventing, investigating, detecting and prosecuting ‘criminal offences’ generally without it being necessary that those offences be defined as ‘serious’” .

text: 33. Therefore, to comply with Article 52(1) of the Charter, the EDPS considers that the categories of data for which the production and transfer of personal data could be ordered must be proportionate to the types of offences concerned. In particular, it should be ensured that only serious crimes could justify the exchange of data entailing a serious interference with the fundamental rights to data protection and privacy.

text: 34. In addition, the EDPS welcomes point 15 of the Annex, recommending that the Union should aim to achieve that the procedural measures to preserve or obtain electronic evidence contain a clear and narrow definition of the type of information covered and stresses the importance of laying down clear and straightforward definitions of data categories in the UN Convention in order to ensure legal certainty for all stakeholders involved. The EDPS recommends ensuring a clear delineation between data categories; such a delineation would contribute to ensuring legal certainty.

text: 35. The EDPS welcomes and underlines the importance of point 19 of the Annex. This point states first that the Convention should provide for strict conditions and strong safeguards to ensure that EU Member States can respect and protect the fundamental rights, freedoms and general principles of EU law as enshrined in the European Union Treaties and the Charter including, in particular, the principle of proportionality, the right to effective judicial redress, the right to privacy, the right to the protection of personal data and of electronic communications data when such data is processed, including for transfers to authorities in countries outside the European Union. Second, it specifies that the Convention should ensure that EU Member States are able to comply with requirements for the international transfers of personal data within, in particular, the meaning of the

text: Directive (EU) 2016/680

text: (‘the LED’) and Directive

text: 36. In the specific context of transfers of personal data for law enforcement purposes by EU law enforcement authorities, the EDPS recalls that pursuant to

text: Article 37

text: and Recital 71 of the LED that transfers not based on an adequacy decision should be allowed only where appropriate safeguards have been provided in a legally binding instrument which ensures the protection of personal data or where the controller has assessed all the circumstances surrounding the data transfer and, on the basis of that assessment, considers that appropriate safeguards exist. Such legally binding instruments could be legally binding agreements which could be enforced by the data subjects, ensuring compliance with data protection requirements and the rights of the data subjects, including the right to obtain effective administrative or judicial redress. The controller should be able to also take into account the fact that the transfer of personal data will be subject to confidentiality obligations and the principle of specificity, ensuring that the data will not be processed for other purposes than for the purposes of the transfer. In addition, the controller should take into account that the personal data will not be used to request, hand down or execute a death penalty or any form of cruel and inhuman treatment. The controller should be able to require additional safeguards.

text: 37. In this regard, the EDPS expresses strong doubts whether the future Convention could provide a stand-alone basis for transfers of personal data in accordance with EU law and therefore recommends making sure that Member States are able to invoke and impose additional safeguards so that transfers taking place in the context of this Convention would only be those in line with EU law, including EU secondary law.

text: 38. Finally, the EDPS would like to further stress that the specific authorities in the third countries to which data would be transferred and which would process these data should be clearly defined in order to ensure that they are also competent for the purposes of the transfer. In that sense, therefore, the EDPS recommends that the Convention be accompanied by an exhaustive list of the competent authorities in the receiving countries to which data would be transferred as well as a short description of their competences. This should also be reflected in one of the directives of the Annex.

text: 6. Suspension, review of the Convention and establishment of relations pursuant to the Convention

text: 39. The EDPS welcomes the insertion of a specific provision allowing for suspension of the Convention modelled where possible and appropriate along the provisions of other relevant international or regional conventions in particular in the area of organised crime or cybercrime” . The EDPS recommends in this regard to further specify that the Union should aim to achieve that a Contracting State may at the time of signature, ratification or accession, declare that it will not execute a request for the transfers of personal data to another party, should there be indications that an essential level of protection of the data is no longer ensured in the requesting State.

text: 40. The EDPS also recommends that the Annex provide for requesting the introduction of a clause setting out the mandatory periodical review of the practical operation of the Convention. To ensure a meaningful review, it should be provided for at the latest five years after its entry into force and then at regular intervals, specifying the frequency of these additional reviews. The content of the review should be specified. The review should focus not only on the implementation of the Convention but also assess the necessity and proportionality. The review teams should include data protection experts including representatives of national data protection authorities.

text: 41. Finally, given the highly heterogeneous nature of the countries likely to be party to the Convention, the EDPS recommends including in the mandate that the Union should aim at ensuring that the Convention shall not have effect between two Contracting States if one of them makes the notification that the ratification, acceptance, approval or accession of another Contracting State shall not have the effect of establishing relations between those two Contracting States pursuant to this Convention .

text: 7. Conclusions

text: 42. The EDPS supports the adoption of a Council Decision giving a clear mandate to the European Commission to participate in the UN ongoing negotiations for this Convention, on behalf of the EU. However, he stresses that an authorisation to participate to the negotiations should not require the EU to be party to the Convention should it be adopted, and in particular, the EU should not seek to be party to such Convention should the level of data protection of natural persons guaranteed by EU law be undermined.

text: 43. The EDPS welcomes and underlines the importance of points 6, 17 and 23 of the Annex aiming at preserving existing global and regional instruments, and of the safeguards included in points 8, 9, 10, 11, 13, 18, 19 and 24 of the Annex.

text: 44. In light of the above, the EDPS makes the following recommendations:

text: Concerning the relationship between the Convention and other instruments

text:  including in the mandate that the Union should aim to achieve that future agreements with third countries should apply in lieu of the Convention, should these future agreements ensure higher standards with regard to the protection of fundamental rights, in particular the right to privacy and data protection.

text: Concerning the scope of the Convention

text:  limiting the cooperation provisions to the crimes defined in the Convention.

text:  making clear in the mandate that the Union should oppose any provisions on cross-border direct access to data and cross-border direct cooperation with service providers.

text:  clarifying that the directives under point 15 of the Annex do not concern cross-border cooperation.

text: Concerning the need for appropriate safeguards and the respect of fundamental rights

text:  making clear in the mandate that the Union should ensure a clear delineation between data categories.

text:  including a directive in the mandate to aiming at achieving that the Convention is accompanied by an exhaustive list of the competent authorities in the receiving countries to which data would be transferred as well as a short description of their competences.

text: Concerning the final clauses of the Convention:

text:  further specifying in the mandate that the Union should aim to achieve that a Contracting State may at the time of signature, ratification or accession, declare that it will not execute a request for the transfers of personal data to another party, should there be indications that an essential level of protection of the data is no longer ensured in the requesting State.

text:  including in the mandate that the Union should aim at achieving the introduction of a clause setting out the mandatory periodical review of the practical operation of the Convention. It should be provided for at the latest five years after its entry into force and then at regular intervals, specifying the frequency of these additional reviews. The content of the review should be specified. The review should focus not only on the implementation of the Convention but assess the necessity and proportionality. The review teams should include data protection experts, including representatives of national data protection authorities.

text:  including in the mandate that the Union should aim at ensuring that the Convention shall not have effect between two Contracting States if one of them makes the notification that the ratification, acceptance, approval or accession of another Contracting State will not have the effect of establishing relations between those two Contracting States pursuant to this Convention.

text: 45. Finally, the EDPS remains at the disposal of the Commission, the Council and the European Parliament to provide advice at further stages of this process. The comments in this Opinion are without prejudice to any additional comments that the EDPS could make as further issues may arise and would then be addressed once further information is available. He expects to be consulted on the provisions of the draft Convention before its finalisation. Brussels, 18 May 2022 (e-signed) Wojciech Rafał Wiewiórowski 15