text: COM(2022) 336 final, https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1681472401391&uri=COM%3A2023%3A230%3AFIN 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2022) 336 final, https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1681472401391&uri=COM%3A2023%3A230%3AFIN 4 Recital 1 of the Recommendation. Recital 2 of the Recommendation. 4

text: EDPS Opinion 03/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, issued on 22 February 2021, paragraph 14. 7 Section 2(3)(d) of the Annex. 8 https://ec.europa.eu/newsroom/just/items/627665/en. 9 EDPS Opinion 03/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, issued on 22 February 2021, paragraph 15. 10 EDPS Opinion 03/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, issued on 22 February 2021, paragraphs 16-22 and 38. 11 Section (2)(6) of the Annex. 12 COM(2022) 336 final, Recital 4, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52022PC0336&from=FR. 13 Commission Implementing Decision

text: (EU) 2022/254

text: of 17 December 2021 pursuant to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council on the adequate protection of personal data by the Republic of Korea under the Personal Information Protection Act (notified under document C(2021) 9316) (Text with EEA relevance), OJ L 44, 21.2.2022, p. 1. 5

text: Article 45(1)

text: GDPR and Recital 5 of the Adequacy Decision. 15 Section 2(4) of the Annex. 16 Section 2(6) of the Annex. 17 Section 2(9) of the Annex. 6

text: EDPB-EDPS Joint Opinion 03/2022 on the Recommendation for a Regulation on the European Health Data Space, issued on 12 July 2022, paragraph 111. 19 EDPS Opinion 17/2022 on the Recommendation for a Council Decision authorising the opening of negotiations for the inclusion of provisions on cross-border data flows in the Agreement between the European Union and Japan for an Economic Partnership, issued on 9 August 2022, paragraph 15. 7

identifier: EDPS yttrande 18/2023

title: EDPS Opinion 18/2023, on the Recommendation for a Council Decision authorising the opening of negotiations for digital trade disciplines with the Republic of Korea and with Singapore

text: 15 May 2023

text: Opinion 18/2023

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Commission Recommendation for a Council Decision authorising the opening of negotiations for digital trade disciplines with the Republic of Korea and with Singapore . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 14 April 2023, the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for digital trade disciplines with the Republic of Korea and with Singapore

text: The objective of this recommendation is to authorise the Commission to open negotiations with the Republic of Korea and with Singapore to establish binding disciplines on trade in goods and services enabled by electronic means. These negotiations may cover cross-border data flows with trust, data localisation requirements and personal data protection.

text: The EDPS recalls that, as the protection of personal data is a fundamental right in the Union, it cannot be subject to negotiations in the context of EU trade agreements. Dialogues on data protection and trade negotiations with third countries can complement each other but must follow separate tracks. Personal data flows between the EU and third countries should be enabled by using the mechanisms provided under the EU data protection legislation. The EDPS recalls that in 2018, the Commission endorsed horizontal provisions for cross-border data flows and personal data protection in trade negotiations. The EDPS considers that these provisions reach a balanced compromise between public and private interests as they allow the EU to tackle protectionist practices in third countries in relation to digital trade, while ensuring that trade agreements cannot be used to challenge the high level of protection guaranteed by the Charter of fundamental rights of the EU and the EU legislation on the protection of personal data. The EDPS understands from the recommendation that the negotiations on data flows and data protection should be opened with a view to agree on provisions that are coherent with these horizontal provisions. For the sake of clarity, the EDPS recommends to make an express reference to these horizontal provisions.

text: In addition, as regards more specifically the Republic of Korea, the EDPS notes that this country has already been granted an adequacy finding by the Commission in 2021. Consequently, transfers of personal data from a controller or a processor in the European Economic Area (EEA) to organisations in the Republic of Korea covered by the adequacy decision may take place without the need to obtain any further authorisation. Therefore, the EDPS recommends to further explain why, despite the adequacy decision, further negotiations on cross-border data flows and data protection are considered to be necessary in the case of the Republic of Korea.

text: Furthermore, the EDPS understands the negotiating directives and the horizontal provisions as allowing, in duly justified cases, measures that would require controllers or processors to store personal data in the EU/EEA. The EDPS recalls that, together with the EDPB, he recently recommended that controllers and processors, established in the EU/EEA and processing personal electronic health data within the scope of the Commission’s proposal for a Regulation on the European Health Data Space, should be required to store this data in the EU/EEA, without prejudice to the possibility to transfer personal electronic health data in compliance with Chapter V GDPR. For the avoidance of doubt, the EDPS recommends to expressly clarify in the negotiating directives that the negotiated rules should not prevent the EU or the Member States from adopting, in duly justified cases, measures that would require controllers or processors to store personal data in the EU/EEA.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 14 April 2023, the European Commission (‘the Commission’) issued a Recommendation for a Council Decision authorising the opening of negotiations for digital trade disciplines with the Republic of Korea and with Singapore (‘the Recommendation’). An annex to the Recommendation details the directives for the negotiation of digital trade disciplines with the Republic of Korea and with Singapore and the proposed content of the rules and commitments (‘the Annex’).

text: 2. The European Union (‘the EU’) has had a free trade agreement with the Republic of Korea since 2011 and a free trade agreement with Singapore since 2019. These free trade agreements provide for substantial commitments for trade in goods and services between the parties, but they do not include comprehensive rules on digital trade .

text: 3. The EU and the Republic of Korea entered into a Digital Partnership on 28 November 2022 and in that context agreed non-binding Digital Trade Principles on 30 November 2022. The EU and Singapore entered into a Digital Partnership on 1 February 2023, and agreed nonbinding Digital Trade Principles on 31 January 2023 .

text: 4. The objective of the Recommendation is to authorise the Commission to open negotiations with the Republic of Korea and with Singapore to establish binding disciplines on trade in goods and services enabled by electronic means, in accordance with

text: Article 218(3)

text: and (4) TFEU.

text: 2. General remarks

text: 6. The EDPS has long taken the view that, as the protection of personal data is a fundamental right in the Union, it cannot be subject to negotiations in the context of EU trade agreements. It is for the EU alone to decide how to implement fundamental rights protections in Union law. The Union cannot and should not embark on any international trade commitments that are incompatible with its domestic data protection legislation. Dialogues on data protection and trade negotiations with third countries can complement each other but must follow separate tracks. Personal data flows between the EU and third countries should be enabled by using the mechanisms provided under the EU data protection legislation .

text: 7. In this context, the EDPS notes that the negotiating directives, included in the Annex, provide that ‘the negotiations may cover cross-border data flows with trust, data localisation requirements and personal data protection’ .

text: 8. The EDPS recalls that in 2018, the Commission endorsed horizontal provisions for crossborder data flows and personal data protection in trade negotiations (‘the Horizontal Provisions’) .

text: 9. The EDPS recalls that he supports the legal wording of the Horizontal Provisions as the best outcome achievable to preserve individual’s fundamental rights to data protection and privacy. The Horizontal Provisions reach a balanced compromise between public and private interests as they allow the EU to tackle protectionist practices in third countries in relation to digital trade, while ensuring that trade agreements cannot be used to challenge the high level of protection guaranteed by the Charter of fundamental rights of the EU and the EU legislation on the protection of personal data .

text: 10. In his Opinion 3/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, the EDPS recommended that the wording agreed with the UK on data protection and privacy (which modified the Horizontal Provisions) remained an exception and would not be the basis for future trade agreements with other third countries .

text: 11. The EDPS understands from the Recommendation that the negotiations on data flows and data protection should be opened with a view to agree on provisions that are coherent with the Horizontal Provisions . For the sake of clarity, the EDPS recommends to make an express reference to the Horizontal Provisions, as was done for instance in the Commission’s Recommendation for a Council Decision authorising the opening of negotiations for the inclusion of provisions on cross-border data flows in the Agreement between the European Union and Japan for an Economic Partnership .

text: 12. In addition, as regards more specifically the Republic of Korea, the EDPS notes that this country has already been granted an adequacy finding by the Commission on 17 December 2021 (‘the Adequacy Decision) . Consequently, transfers of personal data from a controller or a processor in the European Economic Area (EEA) to entities in the Republic of Korea covered by the Adequacy Decision may take place without the need to obtain any further authorisation .

text: 13. In view of the Adequacy Decision, the need for having additional rules covering crossborder data flows and data protection as regards the Republic of Korea is unclear. In other words, the EDPS recommends to explain why, despite the Adequacy Decision, further negotiations on cross-border data flows and data protection are considered to be necessary in the case of the Republic of Korea.

text: 3. Negotiations on cross-border data flows and data protection

text: 14. The negotiating directives, included in the Annex, provide that:  The negotiated rules and commitments ʽshould be in line with the EU legal framework and should preserve the regulatory autonomy required to implement and develop the EU data and digital policies’ .  The ʽnegotiations should result in rules covering cross-border data flows addressing unjustified data localisation requirements, while neither negotiating nor affecting the EU’s personal data protection rules and should, notably be in line with the EU legal framework on the protection of personal and non-personal dataʼ .  The ʽrules and commitments should not prevent the European Union, its Member States and their national, regional and local authorities from regulating economic activity in the public interest, to achieve legitimate public policy objectives such as [...] privacy and personal data protectionʼ .

text: 15. The EDPS welcomes the directives, which are in line with Article 2(2) of the Horizontal Provisions, according to which ‘[e]ach Party may adopt and maintain the safeguards it deems appropriate to ensure the protection of personal data and privacy, including through the adoption and application of rules for the cross-border transfer of personal data. Nothing in this agreement shall affect the protection of personal data and privacy afforded by the Parties’ respective safeguards.’

text: 16. The EDPS understands the negotiating directives and the Horizontal Provisions as allowing, in duly justified cases, measures that would require controllers or processors to store personal data in the EU/EEA. The EDPS recalls that, together with the EDPB, he recently recommended the co-legislators to require that controllers and processors, established in the EU/EEA and processing personal electronic health data within the scope of the Commission’s proposal for a Regulation on the European Health Data Space, should be required to store this data in the EU/EEA, without prejudice to the possibility to transfer personal electronic health data in compliance with Chapter V GDPR . For the avoidance of doubt, the EDPS recommends to expressly clarify in the negotiating directives that the negotiated rules should not prevent the EU or the Member States from adopting, in duly justified cases, measures that would require controllers or processors to store personal data in the EU/EEA .

text: 4. Reference to this Opinion

text: 17. The EDPS notes that the Recommendation does not refer to the EDPS consultation. Therefore, the EDPS recommends inserting a reference to the EDPS consultation in a recital of the Council decision.

text: 5. Conclusions

text: 18. In light of the above, the EDPS makes the following recommendations: (1) to make an express reference to the fact that the negotiations on data flows and data protection should be opened with a view to agree on provisions that are coherent with the horizontal provisions for cross-border data flows and personal data protection in trade negotiations endorsed by the Commission in 2018. (2) to explain in a recital why, despite the adequacy decision granted to the Republic of Korea, further negotiations on cross-border data flows and data protection are considered to be necessary with this country. (3) to clarify, in the negotiating directives included in the annex to the Recommendation, that the negotiated rules should not prevent the EU or the Member States from imposing on controllers and processors, in duly justified cases, to store personal data in the EU/EEA. (4) to insert a reference to the EDPS consultation in a recital of the Council decision. Brussels, 15 May 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI p.o. Leonardo CERVERA NAVAS Acting Head of EDPS Secretariat


text: OJ L 295, 21.11.2018, p. 39. 2 COM(2024) 286 final. 3 COM(2024) 285 final. 4 Article 1 of the Signing Proposal. Article 2 of the Signing Proposal. 6 Article 1 of the Conclusion Proposal. 7 Recital 4 of the Signing Proposal and Recital 2 of the Conclusion Proposal 4

text: Explanatory memorandum of each Proposal, page 1. 9 Proposal for a Council Decision on the signing, on behalf of the European Union, and provisional application of the Protocol (2024-2029) implementing the Fisheries Partnership Agreement between the European Community and the Republic of Cabo Verde, COM/2024/237 final, and Proposal for a Council Decision on the conclusion, on behalf of the Union, of the Protocol (2024- 2029) implementing the Fisheries Partnership Agreement between the European Community and the Republic of Cabo Verde COM/2024/236 final.

text: Appendix 3. 5

text: Council Decision of 4 December 2007 concerning the conclusion of the Agreement in the form of an Exchange of Letters on the provisional application of the Protocol setting out the fishing opportunities and financial contribution provided for in the Fisheries Partnership Agreement between the European Community and the Republic of Guinea-Bissau for the period 16 June 2007 to 15 June 2011, OJ L 342, 27.12.2007, p. 1–37. 12 European Data Protection Board (EDPB) Guidelines 2/2020 on

text: articles 46 (2)

text: (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, issued on 15 December 2020. The same guidance also clarifies the safeguards required to be put in place by provisions to be inserted into administrative arrangements between public bodies, subject to authorisation from the competent supervisory authority. 13 Chapter VII ‘Infringements’ 6

identifier: EDPS yttrande 18/2024

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 18/2024 on the signing, provisional application and conclusion of the Implementing Protocol (2024-2029) to the Fisheries Partnership Agreement between the European Community and the Republic of Guinea-Bissau

serie: yttranden

text: 27 August 2024

type: rubrik

text: Opinion 18/2024

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to (i) the Proposal for a Council Decision on the signing, on behalf of the European Union, and provisional application of the Implementing Protocol (2024-2029) to the Fisheries Partnership Agreement between the European Community on the one hand, and the Republic of Guinea-Bissau on the other and (ii) the Proposal for a Council Decision on the conclusion, on behalf of the Union, of the Implementing Protocol (2024-2029) to the Fisheries Partnership Agreement between the European Community, on the one hand, and the Republic of Guinea-Bissau, on the other. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposals that are relevant from a data protection perspective.

text: Executive Summary

text: The EDPS is consulted on the Commission proposals to sign, provisionally apply and conclude the new Implementing Protocol to the Fisheries Partnership Agreement between the EU and the Republic of Guinea-Bissau.

text: The EDPS welcomes the inclusion of an Article dedicated to data protection, which is supplemented by an appendix to the Annex to the Protocol, expanding the data protection provisions and detailing the conditions and safeguards relating to the processing of personal data.

text: For the purpose of transferring data, the EDPS invites nevertheless the Commission to specify what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies.

text: The EDPS also recommends adding a provision that would refer to the specific safeguards to be provided in case of processing of personal data relating to criminal convictions and offences.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 9 July 2024, the European Commission issued:  a proposal for a Council Decision on the signing, on behalf of the European Union, and provisional application of the Implementing Protocol (2024-2029) to the Fisheries Partnership Agreement between the European Community and the Republic of Guinea- Bissau (‘the Signing Proposal’) ; and  a proposal for a Council Decision on the conclusion, on behalf of the Union, of the Implementing Protocol (2024-2029) implementing the Fisheries Partnership Agreement between the European Community and the Republic of Guinea-Bissau (‘the Conclusion Proposal’) .

text: 2. The objective of the Signing Proposal is (i) to authorize the signing, on behalf of the Union, of the new Protocol implementing the Fisheries Partnership Agreement between the European Community and the Republic of Guinea-Bissau (‘the Protocol’) and (ii) to provide for the provisional application of the Protocol .

text: 3. The objective of the Conclusion Proposal is to approve the Protocol .

text: 4. The purposes of the new Protocol are to enable Union vessels to fish in the fishing zones located in Guinea-Bissau’s waters and to enable the Union and the Republic of Guinea- Bissau to work closely together to further promote the development of a sustainable fisheries policy and the responsible exploitation of fishery resources in those fishing zones. This cooperation also aims at contributing to decent working conditions in the fisheries sector . These fishing opportunities are granted to Union vessels in accordance with scientific advice and the recommendations of the Joint Scientific Committee and the relevant regional fisheries management organisations (RFMOs), in particular the International Commission for the Conservation of Atlantic Tunas (ICCAT) .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 9 July 2024, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 10 of the Signing Proposal and in Recital 7 of the Conclusion Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 6. The EDPS welcomes the inclusion in the Protocol of a specific article on data protection:

text: Article 14

text: provides that the data shall be processed by the competent authorities solely for the purposes of implementing the Agreement, and in particular for the purposes of fisheries management, monitoring, control and surveillance. It also specifies that personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject.

text: 7. The EDPS notes however that

text: Article 14

text: is entitled ‘Confidentiality of data’, whereas its provisions encompass principles other than that of confidentiality. Therefore, for sake of clarity, the EDPS suggests to use instead the title ‘Data protection’, as it is the case for example in a similar Protocol implementing the Fisheries Partnership Agreement between the European Community and the Republic of Cabo-Verde .

text: 8. Moreover,

text: Article 14

text: is supplemented by an appendix to the Annex to the Protocol, which develops the provisions on the processing of personal data. The EDPS notes with satisfaction that these provisions lay down the definitions of ‘personal data’ and ‘processing’, the categories of personal data to be processed, the designation of authorities responsible for the processing of data, the principles relating to processing of personal data including the retention periods, the modalities of onward transfers, the rights of the persons concerned, the right to redress and the designation of independent supervisory authorities.

text: 3. International transfers of personal data

text: 9. The EDPS recalls that in absence of an adequacy decision, transfers of personal data to a third country may be based on a legally binding and enforceable instrument between public authorities or bodies. In such a case, such instrument should provide appropriate safeguards and ensure that enforceable data subject rights and effective legal remedies for data subjects are available.

text: 10. The EDPS notes that Article 14(4) of the Protocol foresees that further safeguards and legal remedies in relation to personal data and data subjects’ rights may be established by the Joint Committee provided for in Article 10 of the Agreement between the European Community and the Republic of Guinea-Bissau. In this respect, the EDPS recommends the Joint Committee to specify in par. 2.7 of Appendix 3 what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies .

text: 4. Personal data relating to criminal convictions and offences

text: 11. The EDPS notes that the annex to the Protocol entitled ‘Conditions governing fishing activities by Union Vessels in Guinea-Bissau’s fishing zone’ includes a chapter on infringements committed by a Union vessel holding a fishing authorization. The EDPS recalls that in case data processed to prevent and fight against illegal fishing would constitute personal data relating to criminal convictions and offences, appropriate safeguards for the rights and freedoms of data subjects should be provided, in accordance with

text: Article 10

text: GDPR and/or

text: Article 11

text: EUDPR. The EDPS recommends the Joint Committee to also add in Appendix 3 to the Annex a provision that would mention these specific safeguards.

text: 5. Conclusions

text: 12. In light of the above, the EDPS makes the following recommendations: (1) to title Article 14 of the Protocol ‘Data protection’, (2) to make use of the Joint Committee to specify in par. 2.7 of Appendix 3 what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, (3) to make also use of the Joint Committee to add in Appendix 3 to the Annex a provision that would specify the safeguards to be provided in the context of the processing of data relating to criminal convictions and offences. Brussels, 27 August 2024 7

type: vagledning

utgivare: edps


text: COM(2025) 377 final. COM(2025) 376 final. 1

text: OJ L 295, 21.11.2018, p. 39. 4 COM(2025) 377 final. COM(2025) 376 final. 6 Conclusion Proposal,

text: Article 1

text: . 4

text: RS 235.1. 8 RS 235.11 9 Signing Proposal and Conclusion Proposal, Explanatory Memorandum, page 1, 2, and 3. 10 OJ L359 of 16.12.2014, p. 1 to 29. 11 OJ L, 24.10.2023. 12 OJ L, 24.10.2023. 13 EDPS Opinion 9/2023 on the Proposal for a Council Directive amending Directive

text: on administrative cooperation in the field of taxation. 5

text: EDPS Opinion 54/2023 on the on the Proposals for a Council Decision on the conclusion and signing on behalf of the Union of the amendment of the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, combating fraud and recovery of claims in the field of value added tax. 15 Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ EU L 281, 28.11.1995, p. 31). 16

text: Commission Decision 2000/518/EC of 26 July 2000

text: pursuant to Directive

text: of the European Parliament and of the Council on the adequate protection of personal data provided in Switzerland (OJ L 215, 25.08.2000, p. 1). 17 REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the first review of the functioning of the adequacy decisions adopted pursuant to

text: Article 25(6) of Directive 95/46/EC

text: , COM(2024) 7 final, p. 13. 6

identifier: EDPS yttrande 18/2025

amnesord:
Finance
General Data Protection Regulation
International Cooperation

title: EDPS Opinion the Proposal on the signing and conclusion of the provisional application of the Amending Protocol between the EU and Switzerland on the automatic exchange of financial account information to improve international tax compliance

text: Opinion 18/2025

text: on the Proposal for a Council Decision on the signing and conclusion of the provisional application of the Amending Protocol to the Agreement between the EU and the Swiss Confederation on the automatic exchange of financial account information to improve international tax compliance

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to (i) the Proposal for a Council Decision on the signing, on behalf of the Union, and provisional application of the Amending Protocol to the Agreement between the European Union and the Swiss Confederation on the automatic exchange of financial account information to improve international tax compliance ; and to (ii) the Proposal for a Council Decision on the conclusion, on behalf of the Union, of the Amending Protocol to the Agreement between the European Union and the Swiss Confederation on the automatic exchange of financial account information to improve international tax compliance .

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposals that are relevant from a data protection perspective.

text: Executive Summary

text: The EDPS is consulted on the Proposals for Council Decisions to sign, provisionally apply, on behalf of the Union, and to conclude the Amending Protocol to the Agreement between the European Union and the Swiss Confederation on the automatic exchange of financial account information to improve international tax compliance.

text: The Amending Protocol aims to ensure that the automatic exchange of financial account information between EU Member States and Switzerland is aligned with the updated Common Reporting Standard developed by the Organisation for Economic Co-operation and Development. In addition, the Amending Protocol aims to align the text of the Agreement with the new data protection framework (i.e. the GDPR for EU Members States and the Federal Act on Data Protection of 25 September 2020 and its ordinance of 31 August 2022 for Switzerland).

text: The Amending Protocol would ensure that the existing agreement between the European Union and Switzerland remains aligned with Union legislation in the same field. It also aims to establish a framework for recovery assistance between the EU Member States and Switzerland, in order to enable the authorities responsible for the application of VAT legislation to assist each other in ensuring compliance with that legislation and in protecting VAT revenue.

text: Any transfer of information containing personal data from the European Union to Switzerland constitutes an international transfer of personal data in the meaning of Chapter V of the GDPR. The international transfer of personal data from Member States to Switzerland does not require specific authorisations nor safeguards under Chapter V of Regulation 2016/679, by virtue of

text: Commission Decision 2000/518/EC

text: . The EDPS recommends including a reference to the EU adequacy decision concerning Switzerland in a recital of both the Signing and the Conclusion Proposals.

text: Contents

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 10 July, the European Commission issued: - a Proposal for a Council Decision on the signing, on behalf of the Union, and provisional application of the Amending Protocol to the Agreement between the European Union and the Swiss Confederation on the automatic exchange of financial account information to improve international tax compliance (‘the Signing Proposal’) ; - a Proposal for a Council Decision on the conclusion, of the Amending Protocol to the Agreement between the European Union and the Swiss Confederation on the automatic exchange of financial account information to improve international tax compliance (‘the Conclusion Proposal’) .

text: 2. The objective of the Signing Proposal is to authorise the signing, on behalf of the Union, and the provisional application of the Amending Protocol to the Agreement between the European Union and the Swiss Confederation (Switzerland) on the automatic exchange of financial account information to improve international tax compliance (‘the Agreement’).

text: 3. The objective of the Conclusion Proposal is to approve the Amending Protocol .

text: 4. The Agreement provides the legal basis for the reciprocal automatic exchange of financial account information between the EU Member States and Switzerland, in accordance with the Common Reporting Standard (CRS) developed by the Organisation for Economic Cooperation and Development (OECD).

text: 5. The Amending Protocol aims to (i) ensure that the automatic exchange of financial account information between EU Member States and Switzerland is aligned with, and continues to take place in accordance with, the updated CRS from 1 January 2026; to (ii) align the text of the Agreement with the new data protection framework (i.e.

text: Regulation (EU) 2016/679

text: on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General data protection regulation, GDPR) for EU Members States; and the Federal Act on Data Protection of 25 7 8 September 2020 and its ordinance of 31 August 2022 for Switzerland); and to (iii) establish a legislative framework for mutual assistance between the EU and Switzerland for the recovery of VAT claims .

text: 6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 10 July 2025, pursuant to Article 42(1) of the EUDPR. The EDPS welcomes the reference to this consultation in Recital 7 of the Signing Proposal and in Recital 7 of the Conclusion Proposal.

text: 2. General Remarks

text: 7. The EDPS welcomes the objectives pursued by the Proposals, notably to improve administrative cooperation in the area of direct taxation, and to improve international tax compliance. The EDPS acknowledges that the negotiated Amending Protocol ensures that the existing agreement between the European Union and Switzerland remains aligned with Union legislation in the same field, notably

text: Council Directive 2014/107/EU

text: amending Directive

text: on administrative cooperation in the field of taxation (DAC 2) as amended by

text: Council Directive (EU) 2023/2226 of 17 October 2023

text: amending Directive

text: on administrative cooperation in the field of taxation (DAC8) . The EDPS has already issued an opinion on DAC8 . The EDPS has already issued an opinion on DAC8 on 3 April 2023 .

text: 8. The EDPS regrets not having been consulted on the Council Decision authorising the opening of negotiations for the amendment of the Agreement in line with

text: Article 42(1)

text: EUDPR.

text: 9. The EDPS notes that the Proposals’ objective is also to establish a legal legislative framework for mutual assistance between the EU and Switzerland for the recovery of VAT claims. This would enable the authorities responsible for the application of VAT legislation to assist each other in ensuring compliance with that legislation and in protecting VAT revenue. Simultaneously, the negotiated agreement contains a commitment to explore mutual assistance in recovering other tax claims within a four-year period following the first day of January after the signature of this Amending Protocol. The negotiated provisions would ensure the recovery of VAT claims, to avoid non-taxation and combat tax fraud in such a manner that closely aligns with the related provisions of the agreement between the European Union and Norway on administrative cooperation, combatting fraud and recovery of claims in the field of VAT (the EU-Norway agreement), on which the EDPS issued an opinion on 13 December 2023 .

text: 10. Any transfer of information containing personal data from the European Union to Switzerland constitutes an international transfer of personal data in the meaning of Chapter V of the GDPR.

text: 11. On 26 July 2000, the Commission adopted a decision recognising that the Swiss Confederation ensures an adequate level of protection for personal data transferred within the scope of the Directive

text: of the European Parliament and of the Council (Data 15 16 Protection Directive) from the European Union to Switzerland (the ‘Adequacy Decision’) .

text: 12. With the entry into application of the GDPR, the adequacy decisions adopted under the Data Protection Directive (including the one concerning Switzerland) remained in force. Pursuant to

text: Article 97

text: GDPR, the Commission shall periodically review adequacy decisions, every four years, in order to determine whether the countries and territories that received an adequacy finding continue to provide an adequate level of protection for personal data.

text: 13. On 15 January 2024, the Commission confirmed that Switzerland continues to provide an adequate level of protection for personal data transferred within the scope of the GDPR from the EU to Switzerland . As a result, data transfers from the EU to Switzerland can take place without additional requirements.

text: 14. The EDPS welcomes that the preamble of the Agreement and the Explanatory Memoranda of both Signing and Conclusion Proposals refer to the Adequacy Decision. As the Adequacy Decision would cover the transfer of personal data regulated by the Agreement, the EDPS recommends including a reference to it in a recital of both the Signing and the Conclusion Proposals.

text: 3. Conclusions

text: 15. In light of the above, the EDPS recommends to include a reference to

text: Commission Decision 2000/518/EC

text: in a recital of both the Signing and the Conclusion Proposals. Brussels, 20 August 2025 (e-signed) p.o. Leonardo CERVERA NAVAS