text: OJ L 295, 21.11.2018, p. 39. 2 COM(2022) 134 final. 3 COM(2022) 134 final/2, p. 2. 4 COM(2022) 134 final/2, p. 4. COM(2022) 134 final/2, p. 10. 4

text: See Recital (6),

text: Article 14

text: Article 19

text: and Article 24 of the Proposal. 7 Article 17 of the Proposal. 8 Article 19 of the Proposal. 9 Recital 39 of the Proposal. 10 Recital 56 and Article 23(7) of the Proposal. 11

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1–88). 5

text: Recital 39 and Article 17(5) of the Proposal. 13 Article 19 (10) of the Proposal. 14 Judgment of the Court of Justice of the European Union of 5 June 2018, Wirtschaftsakademie Schleswig-Holstein,

text: , , paragraph 29. See also the EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: , 7 November 2019, p. 11. 15 EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR, 2 September 2020, paragraph 50. For further guidance, see also EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: , 7 November 2019. 6

text: See to that effect, Court of Justice of European Union, judgment of 17 December 2015, WebMindLicenses,

text: , EU:C:2015:832, paragraph 81. 21 Court of Justice of European Union, judgments of 16 December 2008, Satakunnan Markkinapörssi and Satamedia,

text: , EU:C:2008:727, paragraph 56; of 8 April 2014, Digital Rights Ireland and Others,

text: and

text: , EU:C:2014:238, paragraphs 51 and 52; of 6 October 2015, Schrems,

text: , EU:C:2015:650, paragraph 92; and of 21 December 2016, Tele2 Sverige and Watson and Others,

text: and

text: , EU:C:2016:970, paragraphs 96 and 103.

text: See also EDPS Opinion 20/2022 of 2 June 2022 on the Proposal for a Regulation on geographical indication protection for craft and industrial products, at paragraph 15. 9

identifier: EDPS yttrande 15/2022

title: EDPS Opinion on the Proposal for a Regulation on EU geographical indications for wine, spirit drinks and agricultural products, and quality schemes for agricultural products

text: 18 July 2022

text: Opinion 15/2022

text: on the Proposal for a Regulation on European Union geographical indications for wine, spirit drinks and agricultural products, and quality schemes for agricultural products

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and the Council on European Union geographical indications for wine, spirit drinks and agricultural products, and quality schemes for agricultural products, amending Regulations

text: (EU) No 1308/2013

text: (EU) 2017/1001

text: and

text: (EU) 2019/787

text: and repealing

text: Regulation (EU) No 1151/2012

text: . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the draft Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 2 May 2022, the European Commission adopted a Proposal for a Regulation on European Union geographical indications for wine, spirit drinks and agricultural products, and quality schemes for agricultural products, amending Regulations

text: (EU) No 1308/2013

text: (EU) 2017/1001

text: and

text: (EU) 2019/787

text: and repealing

text: Regulation (EU) No 1151/2012

text: (‘the Proposal’).

text: The general goals of the Proposal are twofold: to ensure effective protection of intellectual property rights (IPR) in the Union - including efficient registration processes- to reward fairly producers for their efforts and to facilitate the take up of Geographical Indications (GIs) across the Union.

text: The EDPS positively notes that the Proposal determines the roles of the Commission and the competent authorities of Member States with regard to the processing of personal data in the procedures under this Proposal.

text: At the same time, the EDPS recommends explicitly indicating the role of the European Union Intellectual Property Office (EUIPO) as joint controller together with the European Commission. In addition, the EDPS recommends providing for an arrangement as envisaged by

text: Articles 28 of Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (EUDPR) and/or

text: Article 26 of Regulation (EU) 2016/679

text: (General Data Protection Regulation) (GDPR). In this regard, the EDPS recommends including an empowerement to the Commission to adopt an implementing act to cover detailed arrangements to ensure compliance with data protection requirements.

text: The EDPS recommends identifying in the Proposal itself the different categories of personal data to be included in the supporting documentation accompanying the applications for registration, oppositions and official comments, extracts from the Union register and the single document. The Proposal should also indicate in which circumstances and/or conditions it is necessary to make which categories of personal data publicly available and clearly define for which objectives. Furthermore, to limit the exposure of personal data to the public, the EDPS recommends assessing whether it would be appropriate to put in place a procedure whereby only individuals who demonstrate a legitimate interest have access to additional categories of personal data, such as contact details.

text: Finally, the EDPS considers that the chosen data retention period for the documentation related to the cancellation of geographical indications should be further justified or reduced.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 2 May 2022, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on European Union geographical indications for wine, spirit drinks and agricultural products, and quality schemes for agricultural products, amending Regulations

text: (EU) No 1308/2013

text: (EU) 2017/1001

text: and

text: (EU) 2019/787

text: and repealing

text: Regulation (EU) No 1151/2012

text: (‘the Proposal’).

text: 2. The general objectives of the Proposal are: a) to ensure the effective protection of Intellectual Property Rights (‘IPR’) in the Union, including efficient registration processes and, b) to increase the uptake of Geographical Indications (‘GIs’) across the Union to benefit the rural economy .

text: 3. The Proposal would modify the current legislative framework for GIs to harmonise those rules that are common to all sectors, notably the procedures to register a name or amend the product specification, protection of the names, and checks and enforcement . It also introduces the involvement of the European Union Intellectual Property Office (‘EUIPO’) in the registration procedure. More specifically, while the national level assessment would remain with the Member States, EUIPO would provide technical assistance to the Commission during the EU-level scrutiny of applications and oppositions .

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 23 May 2022, pursuant to Article 42(1) of EUDPR. In this regard, the EDPS invites the co-legislators to include an explicit reference to this consultation in one of the Recitals of the Proposal.

text: 2. General remarks

text: 5. The EDPS notes that the Proposal would provide for the processing of personal data, in particular where it is necessary to identify and contact individuals in the course of the procedures for registration, amendments to the product specification and cancellation of registration in respect of geographical indications, including scrutiny and opposition procedures .

text: 6. Each procedure would consist of a ‘two-stage system’ at national and EU level. The Member States would be responsible for the first stage of the procedure, which would consist of receiving the application from the producer group, assessing it, including running a national opposition procedure and following the results of the assessment submitting the application to the Commission. The second stage would be at EU level, with the EUIPO providing assistance to the Commission for scrutinising the applications including running opposition procedures . The Commission would remain responsible for taking a decision on granting the traditional specialities guaranteed protection or not, as well as for approving Union amendments to the product specification of a registered geographical indication and cancelation of the registration of a geographical indication .

text: 7. With regard to the involvement of the Agency, EUIPO would also be responsible for the operation of the Union register of geographical indications for wines, spirit drinks and agricultural products .

text: 8. The EDPS welcomes the reference to the right to protection of personal data in recitals 6, 7 and 8 of the Proposal, as well as to the need for the Member States to comply with

text: Regulation (EU) 2016/679

text: (‘GDPR’), and for the Commission to comply with the EUDPR. At the same time, the EDPS notes that no reference is made to EUIPO, although the tasks assigned to this agency would appear to also require the processing of personal data. Consequently, the EDPS recommends including an explicit reference to the roles and responsibilities of EUIPO with regard to the processing of personal data in the enacting terms of the Proposal, as well as in the relevant recital, as further elaborated in Section 3.1 below.

text: 9. In addition, the EDPS notes that recital 7 refers to ‘owners of personal data’ while the intention is presumably to refer to the term ‘data subjects’ as defined in

text: Article 4(1)

text: GDPR and

text: Article 3(1)

text: EUDPR. The EDPS thus recommends replacing the term ‘owners of personal data’ by ‘data subjects’.

text: 10. The EDPS also notes that the Proposal introduces the concept of ‘protected personal data’ in Articles

text: and

text: , without further defining it. The EDPS highlights, in this regard, that the GDPR and the EUPDR do not define the term ‘protected personal data’. As a consequence, there is a risk that the use of such term would create a confusion on the scope of the relevant provisions and, more generally, on the interplay with the applicable data protection legal framework. The EDPS, therefore, recommends replacing the term ‘protected personal data’ by ‘personal data’, so as to enhance legal certainty and consistency of the applicable legal framework.

text: 3. Specific remarks 3.1.Determination of roles and responsibilities

text: 11. The EDPS positively notes that Article 3 of the Proposal aims to determine the roles of the Commission and the competent authorities of Member States under EU data protection law.

text: Article 3(2)

text: designates the Commission as ‘controller’ within the meaning of Article 3(9) of the EUDPR , while

text: Article 3(3)

text: designates the competent authorities of Member States as ‘controllers’ within the meaning of Article 4(7) of the GDPR. Each entity must be considered a controller in relation to the processing of personal data in the procedures for which they would be competent in accordance with the Proposal.

text: 12. At the same time, the EDPS notes that the above-mentioned Article makes no reference to EUIPO, although it is apparent from the wording of recital 6, as well as Articles

text: and

text: , that the tasks assigned by the Proposal to this agency are likely to require the processing of personal data. In particular, this would appear to be the case where EUIPO 12 13 would provide assistance to the Commission with regard to the scrutiny and opposition procedures.

text: 13. The EDPS recalls that the concepts of controller, joint controller and processor play a crucial role in the application of data protection law, since they determine who is responsible for compliance with different data protection rules, and how data subjects can exercise their rights in practice. Furthermore, in line with Articles 28 of the EUDPR and 26 of the GDPR, where two or more controllers together determine the purposes and means of the processing, they are considered to be joint controllers. In addition, the concept of controllership does not necessarily refer to one single entity, but can also involve multiple parties playing a role in a processing operation. As a result, and as confirmed by the Court of Justice of the European Union (CJEU) , each of the actors involved would have obligations under data protection law. In case of joint controllers, the distribution of tasks between them has to be specified by means of an arrangement between them.

text: 14. Against this background, the EDPS is of the opinion that EUIPO would likely qualify as joint controller and thus recommends explicitly identifying the role of EUIPO as ‘joint controller’ together with the European Commission in Article 3 of the Proposal. Indeed, the overarching criterion to determine whether such joint controllership exists is the joint participation of two or more entities (in this case EUIPO and the Commission) in the determination of the purposes and means of a processing operation . This joint participation can take the form of a common decision, but also result from converging decisions by two or more entities, regarding the purposes and the essential means. Decisions can be considered as converging on purposes and means if they complement each other and are necessary for the processing to take place in such a manner that they have a tangible impact on the determination of the purposes and means of the processing. In this regard, a key element is whether the processing would not be possible without both parties’ participation. As a result, the EDPS considers that the Commission and EUIPO would be acting as joint controllers, given that the tasks that would be entrusted to EUIPO are inextricably linked with those falling within the responsibility of the Commission.

text: 15. Furthermore, the EDPS also recommends providing for an arrangement as envisaged by Articles 28 of the EUDPR and/or Article 26 of the GDPR. In this regard, the EDPS invites the co-legislator to include an empowerment to the Commission to adopt an implementing act to cover detailed arrangements to ensure compliance with data protection requirements.

text: 3.2.Categories of personal data

text: 16. The EDPS recognises the need to process personal data of applicants, opponents, beneficiaries and natural persons delegated for certain official control tasks, for the correct management of the procedures of registration, amendment or cancellation of geographical indications and traditional specialities guaranteed, as outlined in recital 6 of the Proposal. In this context, the EDPS takes note of the attempt to minimise the exposure of personal data by introducing the possibility for the Commission to adopt implementing acts on the exclusion or anonymisation of protected personal data in relation to the documentation 16 17 accompanying the applications for registration , oppositions and official comments , 18 19 extracts from the Union register , and the single document .

text: 17. At the same time, the EDPS recalls that, in line with the data minimisation principle laid down in

text: Article 5(1)

text: (c) of the GDPR and

text: Article 4(1)

text: (c) of the EUDPR, the collection of personal data should be limited to what is necessary to fulfil the purposes for which they are processed. Consequently, the EDPS considers that the different categories of personal data that are necessary to achieve the purposes of the processing as set out in the Proposal should be laid down in the Proposal itself, and not relegated to implementing provisions. The same consideration applies to the possibility of excluding or anonymising personal data, which would be of fundamental importance to ensuring compliance of the processing of personal data pursuant to the Proposal with the applicable EU framework, and should therefore be addressed directly in the Proposal.

text: 18. Furthermore, the EDPS notes that pursuant to Article 3 of the Proposal the Commission and the Member States “[...] shall process and make public the personal data received in the course of the procedures for registration, approval of amendments, cancellation, opposition, granting of transitional period and control”. Recital 6 clarifies that “[...] the Commission and the Member States should be allowed to process such personal data and to disclose or make it public when this is needed to identify applicants [...], opponents [...], beneficiaries of a transitional period granted [...] and bodies delegated to carry out the verification on compliance with product specification”. The same recital generically mentions “public interest” and “transparency” to justify the disclosure and publication of personal data, such as personal names and contact details.

text: 19. In accordance with Article 52(1) of the Charter, the CJEU has clarified that the legal basis which enables an interference to the rights recognised by the Charter must itself define the scope of the limitation on the exercise of the right concerned . In accordance with the principle of proportionality, any derogations from and limitations on the protection of personal data should apply only in so far as it is strictly necessary . Against this background, while the EDPS understands that it might be necessary to make certain categories of personal data public to achieve specific and clearly defined objectives of public interest, he underlines that the specific reasons of public interest that would justify such publication as necessary and proportionate should be clearly spelled out in the Proposal. Furthermore, the EDPS underlines that the objective of transparency cannot be invoked as an end in itself. In addition, the categories of personal data to be made publicly available should be clearly and exhaustively defined as well, taking into account the principle of necessity and proportionality . Therefore, the EDPS invites the co-legislators to define in the Proposal which are the necessary category(ies) of personal data that could be made publicly available for which specific objectives. Moreover, the EDPS is of the opinion that a procedure should be put in place to ensure that only individuals who demonstrate a legitimate interest have access to certain categories of personal data, such as contact details.

text: 20. Finally, the EDPS notes that pursuant to Article 23(3) of the Proposal, the Union register of geographical indications would include the registered names and the geographical indication of the products and that the Commission may adopt implementing acts defining its content and presentation . In this context, the EDPS wishes to recall the need to be consulted on such implementing acts where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data, in accordance with

text: Article 42(1)

text: EUDPR.

text: 3.3.Storage duration

text: 21. Article 23(6) of the Proposal would provide for the retention of documentation related to the registration of geographical indications for the period of validity of the geographical indication and, in case of cancellation, for 10 years thereafter.

text: 22. The EDPS recalls that pursuant to the principle of storage limitation, personal data can be kept ‘for no longer than is necessary for the purposes for which the personal data are processed’. The EDPS considers that a justification is needed to substantiate the proportionality of the chosen retention period, in particular as regards the retention of documentation related to the cancellation of the registration in respect of GIs. Absent further justification, the envisaged retention period of 10 years does not seem to comply with the requirement of storage limitation and should be reduced as far as the processing of personal data is concerned .

text: 4. Conclusions

text: 23. In light of the above, the EDPS: (1) welcomes the explicit designation of controllers in relation to the processing of personal data in the procedures laid down by the Proposal. (2) recommends defining explicitly the role of EUIPO as ‘joint controller’ together with the European Commission under

text: Article 3

text: within the meaning of

text: Articles 28

text: EUDPR and 26 GDPR. (3) recommends specifying in the Proposal the categories of personal data that are necessary for the correct management of the procedures of registration, amendment or cancellation of geographical indications and traditional specialities guaranteed so as to ensure that the processing of personal data is limited to what is directly relevant and necessary to accomplish the specified purposes of the Proposal. (4) recommends identifying in the Proposal which categories of personal data should be made publicly available and clearly define for which purposes and whether a procedure should be envisaged to ensure that only individuals who demonstrate a legitimate interest have access to additional categories of personal data, such as contact details. (5) absent further justification, recommends reducing the envisaged retention period for documentation related to the cancellation of GIs registration insofar as it concerns personal data. Brussels, 18 July 2022 (e-signed) Wojciech Rafał WIEWIÓROWSKI

type: vagledning

utgivare: edps


text: COM(2023) 131 final 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2023) 131 final. 4 See page 2 of the Explanatory Memorandum to the Proposal. 5 European Union Serious and Organised Crime Threat Assessment: A corrupt Influence: The infiltration and undermining of Europe’s economy and society by organised crime, page 12. Europol and the global cocaine trade, available at https://www.emcdda.europa.eu/publications/eu-drug-markets/cocaine/europeand-global-cocaine-trade_en.

text: Europol and the global cocaine trade, available at https://www.emcdda.europa.eu/publications/eu-drug-markets/cocaine/europeand-global-cocaine-trade_en.

text: EU Drug Market: Methamphetamine, EMCDDA, available at www.emcdda.europa.eu. 9 EU Drug Market: Cocaine, available at EU Drug Market: Cocaine, www.emcdda.europa.eu.

text: idem. 11

text: Regulation (EU) 2016/794

text: of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA, OJ L 135, 24.5.2016, p. 53. 12 See EDPS Opinion 2/2018 on eight negotiating mandates to conclude international agreements allowing the exchange of data between Europol and third countries, adopted on 14 March 2018, https://edps.europa.eu/sites/edp/files/publication/18-03- 19_opinion_international_agreements_europol_en.pdf and EDPS Opinion 1/2020 on the negotiating mandate to conclude an international agreement on the exchange of personal data between Europol and New Zealand law enforcement authorities, issued on 31 January 2020 https://edps.europa.eu/sites/default/files/publication/20-01-31_opinion_recommendation_europol_en.docx.pdf 6

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89. 14 See Judgment of the Court of Justice of 30 April 1974,

text: Case C-181/73

text: , R. & V. Haegeman a.o., ECLI:EU:C:1974:41, par. 5. 15 See Judgment of the Court of Justice of 3 June 2008,

text: Case C-308/06

text: , Intertanko a.o., ECLI:EU:C:2008:312, par. 42. 16 See Judgment of the Court of Justice of 3 September 2008, joined cases

text: P and

text: P, Kadi a.o., ECLI:EU:C:2008:461, par. 285.

text: For further details see the EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data. 18 See Judgment of the Court of Justice of 8 April 2014, joined cases

text: and

text: , Digital Rights Ireland Ltd, ECLI:EU:C:2014:238, paragraph 52..

text: Regulation (EU) 2022/991

text: of the European Parliament and of the Council of 8 June 2022 amending

text: Regulation (EU) 2016/794

text: , as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role in research and innovation, OJ L 169, 27.6.2022, p. 1.

text: See Opinion 1/15 of the Court of Justice of 26 July 2017, EU-Canada PNR Agreement, ECLI:EU:C:2017:592, paragraph 141. 23 Idem.

text: Article 5(1)

text: (f) GDPR and

text: Article 4(1)

text: (f) LED and EUDPR. 25 See Judgment of the Court of Justice of 8 April 2014, in joined cases

text: and

text: , Digital Rights Ireland Ltd, ECLI:EU:C:2014:238, paragraph 40. 26 See Judgment of the Court of Justice of 1 October 2015,

text: Case C-201/14

text: , Smaranda Bara a.o., ECLI:EU:C:2015:638, in particular para. 32 and 33 where the Court found that “the requirement to inform the data subjects about the processing of their personal data is all the more important since it affects the exercise by the data subjects of their right of access to, and right to rectify, the data being processed, and their right to object to the processing of those data” and that “That information concerns the identity of the data controller, the purposes of the processing and any further information necessary to guarantee fair processing of the data”. 11

text: See more at https://home.inai.org.mx/ 28 https://globalprivacyassembly.org/participation-in-the-assembly/list-of-accredited-members/ 12

identifier: EDPS yttrande 15/2023

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 15/2023 on the negotiating mandate to conclude an international agreement on the exchange of personal data between Europol and Mexican law enforcement authorities

serie: yttranden

text: 3 May 2023

type: rubrik

text: Opinion 15/2023

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Recommendation for a Council decision authorising the opening of negotiations for an agreement between the European Union and the United Mexican States on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Mexican authorities competent for fighting serious crime and terrorism .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Recommendation that are relevant from a data protection perspective.

text: Executive Summary

text: On 9 March 2023 the European Commission issued a Recommendation for a Council decision authorising the opening of negotiations for an agreement between the European Union and the United Mexican States on the exchange of personal data between Europol and the Mexican authorities competent for fighting serious crime and terrorism.

text: The objective of the Recommendation is to open negotiations with the United Mexican States with the purpose of signing and concluding an international agreement enabling the exchange of personal data between Europol and the Mexican authorities competent for fighting serious crime and terrorism. The Annex to the Recommendation lays down the Council’s negotiating directives to the Commission, i.e. the objectives the latter should aim to achieve on behalf of the EU in the course of these negotiations.

text: Transfers of personal data gathered in the context of criminal investigations and further processed by Europol to produce criminal intelligence are liable to have a significant impact on the lives of the individuals concerned. For that reason, the international agreement must ensure that the limitations to the rights to privacy and data protection in relation to the fight against serious crime and terrorism apply only in so far as is strictly necessary.

text: The EDPS positively notes that the Commission has established by now, based also on recommendations from previous EDPS Opinions on this matter, a well-structured set of objectives (negotiating directives), incorporating fundamental data protection principles, which the Commission aims to achieve on behalf of the EU in the course of international negotiations to conclude agreements on the exchange of personal data between Europol and third country law enforcement authorities.

text: In this regard, the recommendations in this Opinion are aimed at clarifying and, where necessary, further developing the safeguards and controls in the future Agreement between the EU and Mexico with respect to the protection of personal data. In this context, the EDPS recommends that the future Agreement explicitly lays down the list of the criminal offences regarding which personal data could be exchanged; provides for a periodic review of the need for storage of the transferred personal data as well as other appropriate measures ensuring that the time limits are observed; adduces additional safeguards as regards the transfer of special categories of data; ensures that no automated decision based on the received data under the Agreement would take place without effective and meaningful human intervention; and lays down clear and detailed rules regarding the information that should be made available to the data subjects.

text: The EDPS recalls that, pursuant to Article 8(3) of the Charter, the control by an independent authority is an essential element of the right to the protection of personal data. The EDPS therefore positively notes the existence of an independent data protection authority in Mexico, the National Institute for Transparency, Access to Information and Personal Data Protection (INAI), which is an accredited member of the Global Privacy Assembly. At the same time, the EDPS invites the Commission to examine in details the role of INAI in the supervision of data processing performed for the purposes of public safety or investigation and prosecution of criminal offenses, in view of

text: the specific objective of the Agreement. In addition, in order to ensure proper implementation of the Agreement, the EDPS also suggests that the Parties exchange on a regular basis information on the exercise of rights by data subjects as well as relevant information about the use of the oversight and redress mechanisms related to the application of the Agreement.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 9 March 2023 the European Commission issued a Recommendation for a Council decision authorising the opening of negotiations for an agreement between the European Union and the United Mexican States on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Mexican authorities competent for fighting serious crime and terrorism (‘the Recommendation’). The Recommendation is accompanied by its respective Annex.

text: 2. The objective of the Recommendation is to open negotiations with the United Mexican States (hereinafter ‘Mexico’) with the purpose of signing and concluding an international agreement enabling the exchange of personal data between Europol and the Mexican authorities competent for fighting serious crime and terrorism. The Annex to the Recommendation lays down the Council’s negotiating directives to the Commission, i.e. the objectives the latter should aim to achieve on behalf of the EU in the course of these negotiations.

text: 3. In the Explanatory Memorandum of the Recommendation the Commission assesses that Latin America’s organised crime groups pose a serious threat to the EU internal security as their actions are increasingly linked to a series of crimes within the Union, particularly in the realm of drug trafficking . The 2021 EU Serious and Organised Crime Threat Assessment (‘SOCTA’) by Europol highlights that unprecedented quantities of illicit drugs are trafficked to the EU from Latin America, generating multi-billion-euro profits, which are used to finance a diverse range of criminal organisations (international and EU-based) and to weaken the rule of law in the EU .

text: 4. Most of the drugs seized in the EU is transported by sea, primarily in maritime shipping containers , and shipped to the EU directly from the countries of production, including 5 Mexico, as well as from neighbouring countries of departure in Latin America . Mexican cartels are multinational poly-criminal organisations and have intensified their criminal activities in the EU, developing a tailor-made criminal business by using numerous legal business structures to support other crimes, such as drug trafficking (including synthetic drugs). The Mexican involvement in methamphetamine production and trafficking in Europe can be assessed from the seizures of such substance in the EU (most likely in transit to non-EU markets). For instance, in 2019, Spain reported seizing 1.6 tonnes and, in 2020, Slovakia reported seizing 1.5 tonnes of methamphetamine originating from Mexico .

text: 5. In its Programming Document 2022-2024, Europol has flagged that, among others, the growing demand for drugs and increased drug trafficking routes into the EU justify the need for enhanced cooperation with Latin American countries. Moreover, due to their longstanding capacity to procure large amounts of cocaine directly from producers in Latin America, Mexican criminal networks have been reported as a threat for Europe by the European Monitoring Centre for Drugs and Drug Addiction (EMCDDA) and Europol.

text: 6. Mexico has been committed to contributing to the dismantling of organised crime groups involved in drug production and trafficking. Consequently, the country has been identified as a key international partner to reduce the global supply of cocaine by the EMCDDA

text: 7. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 9 March 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes that he has been consulted on the Recommendation and expects a reference to this Opinion to be included in the preamble of the Council Decision. In addition, the EDPS welcomes the reference, in Recital 4 of the Recommendation, to Recital 35 of the

text: Regulation (EU) 2016/794

text: (‘Europol Regulation’), which provides that the Commission should be able to consult the EDPS also during the negotiations of the Agreement and, in any event, before the Agreement is concluded.

text: 8. The EDPS also recalls that he has already had the opportunity to comment in 2018 and in 2020 on the exchange of personal data between Europol and the law enforcement authorities of third countries on the basis of Europol Regulation .

text: 9. The EDPS positively notes that the Commission has established by now, based also on a number of the recommendations from the previous EDPS Opinions on this matter, a wellstructured set of objectives (negotiating directives), incorporating fundamental data protection principles, which the Commission aims to achieve on behalf of the EU in the course of international negotiations to conclude agreements on the exchange of personal data between Europol and third country law enforcement authorities.

text: 10. In this context, the recommendations in this Opinion are aimed at clarifying and, where necessary, further developing the safeguards and controls in the future Agreement between the EU and Mexico with respect to the protection of personal data. They are without prejudice to any additional recommendations that the EDPS could make on the basis of further available information and the provisions of the draft agreement during the negotiations.

text: 2. General remarks

text: 11. The Europol Regulation lays down specific rules regarding transfers of data by Europol outside of the EU.

text: Article 25(1)

text: thereof lists a number of legal grounds based on which Europol could lawfully transfer data to authorities of third countries. One possibility would be an adequacy decision of the Commission in accordance with

text: Article 36 of Directive (EU) 2016/680

text: (‘LED’) finding that the third country to which Europol transfers data ensures an adequate level of protection. Since there is no such adequacy decision for Mexico at the moment, the other alternative for Europol to regularly transfer data would be the conclusion of a binding international agreement between the EU and the United Mexican States, adducing adequate safeguards with respect to the protection of privacy and other fundamental rights and freedoms of individuals.

text: 12. Pursuant to

text: Article 216(2)

text: TFEU, international agreements concluded by the European Union ‛are binding upon the institutions of the Union and on the Member States’. Moreover, according to the settled case law of the Court of Justice of the European Union (‛CJEU’), international agreements become from their coming into force ‛an integral part of [Union] 14 15 law’ , and they have primacy over acts of secondary Union legislation .

text: 13. Since the proposed Agreement would be a binding international instrument, the EDPS notes that, in line with the case law of the CJEU, the ‛obligations imposed by an international agreement cannot have the effect of prejudicing the constitutional principles of the EC Treaty, which include the principle that all Community acts must respect fundamental rights, that respect constituting a condition of their lawfulness’ . It is therefore essential to ensure that the obligations stemming from the Agreement would not prejudice these principles as far as data protection is concerned.

text: 14. Transfers of personal data gathered in the context of criminal investigations and further processing by Europol to produce criminal intelligence envisaged under the future Agreement are liable to have a significant impact on the lives of the individuals concerned, as they may potentially be used as incriminating evidence in prosecution cases in the receiving country under its national law. 7

text: 15. As transfers of personal data to third countries constitute an interference with individuals’ right to data protection guaranteed by Article 8 of the Charter, requirements of necessity and proportionality of the envisaged processing need to be assessed in accordance with Article 52(1) of the Charter . As a result, the international agreement must ensure that the limitations to the right to data protection in relation to the fight against serious crime and terrorism apply only in so far as is strictly necessary .

text: 16. Following the amendments to the Europol Regulation in 2022 , Chapter IX of EUDPR applies to the processing of operational personal data by Europol. According to Recital 10 of EUDPR, the rules for the protection of operational personal data processed by Union bodies, offices or agencies, when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part Three TFEU, such as Europol, should be consistent with the LED. In this regard, Article 35(3) of the LED lays down the general principle that the level of protection of natural persons applicable in the EU must not be undermined by the transfer of their personal data to third countries or international organisations.

text: 17. In this context, the EDPS recalls that Recital 68 of the LED lists among the various factors, which should be taken into account in the context of assessing of transfers of personal data to law enforcement authorities in third countries, their “international commitments”. Therefore, the EDPS positively notes the ratification by Mexico of the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS No. 108) as well as its Additional Protocol on transborder data flows and supervisory authorities . The EDPS also encourages the future accession of Mexico to the Protocol amending the Convention (CETS No. 223) (Convention 108+).

text: 18. The EDPS furthermore considers that the proposed Agreement should also take into account the potential risks to data subjects in case of a transfer of personal data from a third country to Europol. The Europol Regulation explicitly prohibits processing by Europol of “any information which has clearly been obtained in obvious violation of human rights” . This safeguard is even more valid in the context of the extended powers of Europol pursuant to

text: Article 18

text: a(6) of the amended Europol Regulation. Europol may process personal data that do not relate to the categories of data subjects listed in Annex II of the same Regulation, provided by a third country on the basis of an international agreement like the envisaged one, or pursuant to

text: Article 4(1)

text: (t) thereof, which mandates Europol to propose to Member States to enter information alerts in the Schengen Information System, based on data provided by third countries on persons involved in terrorism or serious crime. Therefore, the EDPS recommends the future Agreement to exclude explicitly transfers of personal data obtained in a manifest violation of human rights.

text: 3. Purpose limitation and data minimisation

text: 19. Purpose limitation is among the key principles of the EU data protection framework. It requires, on the one hand, that personal data are collected for specified, explicit and legitimate purposes and, on the other hand, that personal data are not further processed in a manner that is incompatible with those purposes. Article 18 of the Europol Regulation lays down an exhaustive list of purposes for data processing activities by Europol that are considered legitimate.

text: 20. In that regard, the EDPS notes that directive 2 of the Annex limits the exchange of data under the future Agreement only to crimes and related criminal offences falling within Europol's competence in accordance with Article 3 of Europol Regulation, in particular, preventing and combating terrorism, disrupting organised crime and fighting drug trafficking and cybercrime. It also envisages that the Agreement should specify its scope and the purposes for which Europol may transfer personal data to the competent authorities of Mexico. Furthermore, directive 3(b) of the Annex underlines the principle of specificity, according to which the data should not be processed for other purposes than for the purposes of the transfer. In addition, directive 3(c) aims to ensure that personal data would be adequate, relevant and limited to what is necessary in relation to that purpose. The EDPS considers that all these requirements should also apply to any sharing or onward transfer, in accordance with directives 3(i) and (j).

text: 21. Given the strong emphasis placed on purpose limitation in the Europol Regulation and for additional legal certainty, the EDPS recommends that the future Agreement explicitly lays down the list of the criminal offences regarding which personal data could be exchanged. Moreover, the personal data exchanged must be related to individual cases.

text: 22. In addition, the EDPS welcomes that the Agreement will oblige competent Mexican authorities to respect any restrictions Europol may impose on access or use of transferred personal data and specify how compliance with these restrictions will be enforced in practice.

text: 4. Storage limitation

text: 23. The EDPS notes that directive 3(c) of the Annex provides that personal data “will not be retained for longer than is necessary for the purposes for which they have been transferred”. Directive 3(f) further requires that the agreements should lay down rules on storage, review, correction and deletion of personal data. In that regard, the EDPS would like to point out that the Europol Regulation contains an elaborate regime for data storage with technical and procedural safeguards, which ensures that storage and erasure obligations are complied with in practice.

text: Article 31

text: thereof requires Europol to conduct reviews of the necessity and proportionality of storing the data every three years. This is without prejudice to different retention periods communicated by data providers when sending the data to Europol, which are binding for Europol. Any decision to store the data after the first three years must be duly justified and the motivation must be recorded. Europol is also bound to erase the data that have been erased in the systems of the data provider as soon as it is informed thereof. The EDPS considers these rules as fully applicable also for data received by Europol in the context of international cooperation. 9

text: 24. Therefore, the EDPS recommends that the future Agreement provides for a periodic review of the need for storage of the transferred personal data as well as other appropriate measures ensuring that the time limits are observed.

text: 5. Special categories of personal data and different categories of data subjects

text: 25. According to the CJEU case law, the need for safeguards applies particularly where the protection of the particular category of personal data that is sensitive data is at stake .

text: 26. In this regard, the EDPS welcomes directive 3(d) aiming to align the special categories of data and their processing with Article 30 of the Europol Regulation, as well as to ensure specific safeguards relating to the transfer of personal data on minors, victims of criminal offence, witnesses or other persons who can provide information concerning criminal offences. However, given the sensitivity of special categories of personal data, the EDPS recommends that the future Agreement adduces the safeguards provided in Article 30 of the Europol Regulation, such as the prohibition of the selection of a particular group of persons solely on the basis of such personal data.

text: 6. Automated decisions

text: 27. The EDPS welcomes directive 3(f) aiming to provide for safeguards in respect to automated processing of personal data. According to the case law of the CJEU, ‛the need for [...] safeguards is all the greater where personal data is subject to automated processing. Those considerations apply particularly where the protection of the particular category of personal data that is sensitive data is at stake’ .

text: 28. In that regard, the EDPS recalls that in line with Article 77 (1) of the EUDPR and Article 11(1) of the LED, such safeguards should include at least the right to obtain human intervention. This would ensure that no automated decision based on the received data under the Agreement would take place without the possibility for a human being to intervene in an effective and meaningful way. This is especially important in the area of law enforcement, where the consequences of profiling on individuals are potentially even more severe. Therefore, the EDPS recommends including specifically this safeguard in the future Agreement. 10

text: 7. Data security

text: 29. The EDPS wishes to stress that ensuring the security of personal data is not only a clear requirement under EU law , but it is also considered by the CJEU as essential requirement in relation to the fundamental right to data protection . Data security is also essential for ensuring the confidentiality of criminal investigations.

text: 30. The EDPS therefore welcomes directive 3(h) of the Annex, the obligation to ensure security of personal data through appropriate technical and organisational measures, including by allowing only authorised persons to have access to personal data as well as an obligation of notification in the event of a personal data breach affecting data transferred under the Agreement. The EDPS considers it essential that security measures should cover data processed in the place of destination, as well as in transit.

text: 8. Right to information

text: 31. The EDPS welcomes the fact that directive 3(e) of the Annex requires that the future international agreement ensures “enforceable rights of individuals whose personal data are processed by laying down rules on the right of access, rectification and erasure, including the specific grounds which may allow any necessary and proportionate restrictions”. Furthermore, directive 3(f) provides for that the Agreement should lay down rules, inter alia, “on information to be made available to individuals”.

text: 32. The EDPS recalls that data subjects usually have no knowledge of the fact that their data are processed and transferred for law enforcement purposes. At the same time, the right to information is of utmost importance as it allows the exercise of the other data protection rights, including the right to remedies, and ensures fair processing of the data .

text: 33. The EDPS recommends that the future Agreement lays down clear and detailed rules regarding the information that should be made available to the data subjects, in line with

text: Article 79

text: EUDPR. Such rules should also include information about the applicable regime for EU data subjects to exercise their rights of access, rectification and erasure in Mexico. In the same vein, the future Agreement should also lay down mechanisms to facilitate the exercise of such rights in practice, e.g. consultations between the competent law enforcement authorities and Europol.

text: 9. Supervision

text: 34. Pursuant to Article 8(3) of the Charter, the control by an independent authority is an essential element of the right to the protection of personal data. Therefore, the EDPS welcomes directive 3(k) of the Annex, according to which the Agreement should ensure “a system of oversight by one or more independent public authorities responsible for data protection with effective powers of investigation and intervention to exercise oversight over those public authorities of Mexico that use personal data/exchanged information”.

text: 35. In this context, the EDPS positively notes the existence of an independent data protection authority in Mexico, the National Institute for Transparency, Access to Information and Personal Data Protection (Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales - INAI) , which is an accredited member of the Global Privacy Assembly . At the same time, though the role of the Mexican data protection authority is highly appreciated, the EDPS invites the Commission to examine in details the role of INAI in the supervision of data processing performed for the purposes of public safety or investigation and prosecution of criminal offenses, in view of the specific objective of the Agreement.

text: 10. Review of the Agreement

text: 36. The EDPS welcomes Article 5 of the Annex providing that the Agreement will include provisions on the monitoring and periodic evaluation of the Agreement.

text: 37. For the purposes of this review, the EDPS suggests that the Parties exchange on a regular basis information on the exercise of rights by data subjects, including statistics on the number of requests and their outcome, notably the number of cases where the right was restricted. In addition, the Parties could agree to exchange relevant information about the use of the oversight and redress mechanisms related to the application of the Agreement, including the decisions taken on that account.

text: 11. Conclusions

text: 38. In light of the above, the EDPS recommends: (1) that the future Agreement excludes explicitly transfers of personal data obtained in a manifest violation of human rights, (2) that the future Agreement explicitly lay down the list of the criminal offences regarding which personal data could be exchanged and that the transferred personal data must be related to individual cases, (3) that the future Agreement provide for a periodic review of the need for storage of the transferred personal data as well as other appropriate measures ensuring that the time limits are observed, (4) to ensure the future Agreement adduce the safeguards provided for in Article 30 of the Europol Regulation, (5) to ensure that security measures cover data processed in the place of destination, as well as in transit, (6) to ensure that no automated decision based on the received data under the Agreement would take place without the possibility for a human being to intervene in an effective and meaningful way, (7) that the future Agreement lays down clear and detailed rules regarding the information that should be made available to the data subjects, (8) for the purposes of this review of the Agreement, that the Parties exchange on a regular basis information on the exercise of rights by data subjects and relevant information about the use of the oversight and redress mechanisms related to the application of the Agreement. Brussels, 3 May 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 13


text: COM(2024) 94 final. COM(2024) 95 final. 1

text: OJ L 295, 21.11.2018, p. 39. 4 COM(2024) 94 final and COM(2024) 95 final. See p. 1. of the Explanatory Memorandum of the Proposals. 6 See p. 4. of the Explanatory Memorandum of the Proposals.

text: Commission Decision 2002/2/EC of 20 December 2001

text: pursuant to Directive

text: of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act, OJ L 2, 4.1.2002, p. 13. 8 Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ L 281, 23.11.1995, p. 31. 9 COM(2024) 7 final. 10 See https://www.icao.int/safety/airnavigation/nationalitymarks/annexes_booklet_en.pdf 11 OJ L 82, 21.3.2006, p. 15. 12 OJ L 91, 29.3.2006, p. 49–60. 13 See https://www.edps.europa.eu/sites/default/files/publication/13-09-30_canada_en.pdf 14 European Parliament, Resolution on seeking an opinion from the Court of Justice on the compatibility with the Treaties of the Agreement between Canada and the European Union on the transfer and processing of passenger name record (PNR) data, 25 November 2014.

text: Opinion 1/15 of the Court of Justice (Grand Chamber) of 26 July 2017, EU:C:2017:592. 16 It should also be noted that the validity of the Union legal framework on processing of PNR data, namely

text: Directive (EU) 2016/681

text: , has also been challenged before the CJEU in case

text: . The Court judgment in 2022 confirmed the validity of the PNR Directive and provided important clarifications and further specific limitations on the processing of personal data to ensure compliance with Articles 7 and 8 of the Charter. 17 Opinion 1/15 of the Court of Justice (Grand Chamber) of 26 July 2017, EU:C:2017:592, paragraph 232(1). 18 Opinion 1/15 of the Court of Justice (Grand Chamber) of 26 July 2017, EU:C:2017:592, paragraph 232(2).

text: 20 sex life , is explicitly prohibited, without any exceptions . Moreover, if the Canadian Competent Authority would nevertheless receive such data, it is obliged to delete it .

text: See the definition in

text: Article 2

text: (f) of the draft Agreement in the Annex to the Council Decisions COM(2024) 94 final and COM(2024) 95 final. 20 Similarly, Article 13(4) of the EU PNR Directive prohibits processing of PNR data revealing a person's race or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, health, sexual life or sexual orientation. 21 See Article 8 of the draft Agreement in the Annex to the Council Decisions COM(2024) 94 final and COM(2024) 95 final. 22 Opinion 1/15 of the Court of Justice (Grand Chamber) of 26 July 2017, EU:C:2017:592, paragraph 155. 23 Idem, paragraph 163. 24 Idem, paragraph 160. 25 Judgment of the Court of Justice (Grand Chamber) of 21 June 2022, Ligue des droits humains v. Counseil des ministres,

text: , ECLI:EU:C:2022:491, paragraph 194. 26 Idem, paragraph 195.

text: Judgment of the Court of Justice (Grand Chamber) of 21 June 2022, Ligue des droits humains v. Conseil des ministres,

text: , ECLI:EU:C:2022:491, paragraphs 197-201. 28 Opinion 1/15 of the Court of Justice (Grand Chamber) of 26 July 2017, EU:C:2017:592, paragraphs 168-174. 29 Judgment of the Court of Justice (Grand Chamber) of 21 June 2022, Ligue des droits humains v. Conseil des ministres,

text: , ECLI:EU:C:2022:491,v paragraph 201. 30 Opinion 1/15 of the Court of Justice (Grand Chamber) of 26 July 2017, EU:C:2017:592, paragraphs 196-203. 31 Idem, paragraphs 204-211. 32 It should be noted that the CJEU in its judgment in

text: Case C-817/19

text: Ligue des Droits humains did not make such distinction between arriving/staying and departing air passengers as regards the retention of PNR data under the PNR Directive. 33 Opinion 1/15 of the Court of Justice (Grand Chamber) of 26 July 2017, EU:C:2017:592, paragraph 209. 34 Idem, paragraph 232(3)(d). 8

text: Opinion 1/15 of the Court of Justice (Grand Chamber) of 26 July 2017, EU:C:2017:592, paragraph 206. 9

text: See to that effect Judgments of the Court of Justice of 21 June 2021, Ligue des droits humains,

text: , ECLI:EU:C:2022:491, paragraph 223 and of 5 April 2022, Commissioner of An Garda Síochána and Others,

text: , EU:C:2022:258, paragraph 110 . 37 Opinion 1/15 of the Court of Justice (Grand Chamber) of 26 July 2017, EU:C:2017:592, paragraph 232(3)(e). 10

text: Opinion 1/15 of the Court of Justice (Grand Chamber) of 26 July 2017, EU:C:2017:592, paragraph 225. 11

text: See Opinion 1/15 of the Court of Justice (Grand Chamber) of 26 July 2017, EU:C:2017:592, paragraphs 228-229 as well as judgments of the Court of Justice of 9 March 2010, Commission v Germany,

text: , EU:C:2010:125, paragraph 25; of 8 April 2014, Commission v Hungary,

text: , EU:C:2014:237, paragraph 48; and of 6 October 2015, Schrems,

text: , EU:C:2015:650, paragraph 41). 40 See Opinion 1/15 of the Court of Justice (Grand Chamber) of 26 July 2017, EU:C:2017:592, paragraphs 228-229.

text: See Opinion 1/15 of the Court of Justice (Grand Chamber) of 26 July 2017, EU:C:2017:592, paragraph 227. 13

identifier: EDPS yttrande 15/2024

amnesord:
Transfers of data
EU Passengers Name Record

title: EDPS Opinion 15/2024 on the signing and conclusion of an Agreement between the EU and Canada on the transfer of Passenger Name Record (PNR) data

text: 29 April 2024

text: Opinion 15/2024

text: on the signing and conclusion of an Agreement between the EU and Canada on the transfer of Passenger Name Record (PNR) data

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Council Decision on the signing, on behalf of the European Union, of an agreement between Canada and the European Union on the transfer and processing of Passenger Name Record (PNR) data and the Proposal for a Council Decision on the conclusion, on behalf of the European Union, of an agreement between Canada and the European Union on the transfer and processing of Passenger Name Record (PNR) data .

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposals that are relevant from a data protection perspective.

text: Executive Summary

text: On 4 March 2024, the European Commission issued two Proposals for Council Decisions on the signing and on the conclusion, on behalf of the European Union, of an Agreement between Canada and the European Union on the transfer and processing of Passenger Name Record (PNR) data.

text: The European Parliament requested the Opinion of the Court of Justice of the EU on the previous PNR Agreement with Canada from 2014 as to its compatibility with the EU Treaties and the Charter of Fundamental Rights of the European Union. The CJEU delivered Opinion 1/15 on 26 July 2017, in which it found that the envisaged PNR Agreement between Canada and the EU could not be concluded in its form because several of its provisions were incompatible with the fundamental rights recognised by the EU, notably the right to data protection and respect for private life. Moreover, the EDPS recalls that the validity of the Union legal framework on processing of PNR data, namely

text: Directive (EU) 2016/681

text: . The Court in its judgment from 2022, while confirming the validity of the PNR Directive, provided important clarifications and added further specific limitations on the processing of personal data to ensure compliance with Articles 7 and 8 of the Charter.

text: The EDPS considers Opinion 1/15 of the CJEU as the main point of reference for the assessment of the current draft Agreement on the transfer of PNR data from the EU to Canada, and has reached the conclusion that the draft Agreement contains the necessary safeguards required in order for it to be compatible with the Charter of Fundamental Rights.

text: At the same time, the EDPS makes several specific recommendations with the aim to ensure that the Agreement would be interpreted and applied in compliance with the case law of the CJEU. In particular, the EDPS recommends that the provision of Article 16(3) of the draft Agreement, which allows for the retention of PNR data beyond the passenger’s date of departure in connection with the purposes set out in

text: Article 3

text: , is interpreted strictly and applied in a way that does not lead in practice to the retention in bulk of PNR data of departing passengers. Furthermore, the EDPS clarifies that any use of PNR data for the purposes of security and border control checks should be possible only when those checks pursue one of the purposes laid down in Article 3 of the draft Agreement, namely preventing, detecting, investigation or prosecuting terrorist offences or serious transnational crime, and not for other purposes, such as immigration control. Moreover, the EDPS underlines that access to retained PNR data without a prior review by a court or by an independent administrative body in cases of urgency, as described in

text: Article 17(1)

text: (a) of the draft Agreement, should be allowed only in exceptional and duly justified cases. The EDPS therefore invites the Commission to pay special attention to these aspects, as well as to the exercise of data subject rights, during the joint reviews envisaged in Article 27(3) of the draft Agreement, including by collecting the relevant statistics.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 4 March 2024, the European Commission issued two Proposals for Council Decisions on the signing and on the conclusion, on behalf of the European Union, of an Agreement between Canada and the European Union on the transfer and processing of Passenger Name Record (PNR) data (‘the Proposals’).

text: 2. The objective of the Proposals is to sign and conclude an Agreement between Canada and the European Union on the transfer and processing of Passenger Name Record (PNR) data to the Canadian Competent Authority. The collection and analysis of PNR data can provide the authorities with important elements allowing them to detect suspicious travel patterns and identify associates of criminals and terrorists, in particular those previously unknown to law enforcement authorities . The future Agreement should also provide adequate data protection safeguards for the personal data transferred to Canada, in line with EU law, notably Articles 7, 8, 47 and 52 of the Charter of Fundamental Rights of the EU .

text: 3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 4 March 2024, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 6 of the Proposals.

text: 2. General remarks

text: 4. PNR data is information provided by passengers, and collected by and held in the air carriers’ reservation and departure control systems for their own commercial purposes. While useful for combating terrorism and serious crime, the transfer of PNR data to third countries and the subsequent processing by their authorities constitutes an interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter of Fundamental Rights (the Charter). For this reason, it requires a legal basis under EU law and must be necessary, proportionate and subject to strict limitations and effective safeguards. 4

text: 5. With regard to data protection in general, the EDPS recalls that in 2002 Canada has been recognised as providing an adequate level of protection for personal data transferred from the EU under Directive

text: . In 2024, after a review, the Commission concluded that Canada continues to provide an adequate level of protection under the GDPR for personal data transferred from the EU to recipients subject to Personal Information Protection and Electronic Documents Act (PIPEDA) .

text: 6. The EDPS also recalls that PNR data is subject to international rules and standards. The United Nations Security Council Resolution 2396 (2017) on threats to international peace and security caused by returning foreign terrorist fighters, adopted on 21 December 2017, and the subsequent UN Security Council Resolution 2482 (2019) of 19 July 2019, called on UN Member States to develop the capability to collect and use PNR data, based on Standards and Recommended Practices on PNR (SARPs) of the International Civil Aviation Organization (ICAO) from 2020, adopted by means of Amendment 28 to Annex 9 to the Convention on International Civil Aviation (Chicago Convention) . All EU Member States, as well as Canada, are Parties to the Chicago Convention.

text: 7. The European Community signed in 2005 an Agreement with Canada on the transfer and processing of PNR data . The Agreement entered into force on 22 March 2006 and included an adequacy decision issued by the European Commission that considered the commitments of the Canada Border Services Agency (CBSA) sufficient to provide an adequate protection of personal data. The Commitments of the CBSA and the adequacy decision expired on 22 September 2009.

text: 8. In 2010, the EU opened negotiations with Canada for the purpose of concluding a new Agreement on the transfer of PNR data of passengers flying between the EU and Canada. The draft Agreement with Canada was signed on 25 June 2014. The EDPS issued an Opinion on the draft Agreement on 30 September 2013 , in which he expressed a series of serious concerns, related, among others, to the transfer of sensitive data of the passengers, the retention period, the categories of PNR data, the redress and the oversight mechanisms and the legal basis of the Agreement.

text: 9. The draft Agreement with Canada was submitted by the Council to the European Parliament for consent in July 2014. On 30 January 2015, the European Parliament requested the Opinion of the Court of Justice of the EU (CJEU) as to whether the envisaged PNR Agreement with Canada was compatible with the Treaties and the Charter of Fundamental Rights of the European Union . 5

text: 10. The CJEU delivered Opinion 1/15 on 26 July 2017, in which it found that the envisaged PNR Agreement between Canada and the EU could not be concluded in its form because several of its provisions were incompatible with the fundamental rights recognised by the EU, notably the right to data protection and respect for private life .

text: 11. The EDPS considers the Opinion 1/15 as the main point of reference for the assessment of current draft Agreement on the transfer of PNR data from the EU to Canada. In this context, the EDPS makes the following specific comments and recommendations.

text: 3. Legal basis

text: 12. The substantive legal basis of the 2014 draft EU-Canada PNR Agreement was

text: Article 87(2)

text: (a) TFEU on police cooperation, in addition to the procedural legal basis of

text: Article 218(5)

text: TFEU. Given the fact that the Agreement was directly linked to the objective pursued by

text: Article 16(2)

text: TFEU, the choice of substantive legal basis was questioned by the EDPS in his 2013 Opinion and subsequently the European Parliament decided to seek the opinion of the CJEU. The CJEU in its Opinion 1/15 ruled that the Council decision on the conclusion of the envisaged agreement must be based jointly on

text: Article 16(2)

text: and

text: Article 87(2)

text: (a) TFEU .

text: 13. In the light of this, the EDPS positively notes that the proposed Council Decisions on the signing and on the conclusion of the current Agreement are based on both

text: Articles 16(2)

text: and

text: Article 87(2)

text: (a) of the TFEU, in conjunction with

text: Article 218(5)

text: thereof.

text: 4. Sensitive data

text: 14. One of the main points of criticism of the 2014 draft EU-Canada PNR Agreement, which led the CJEU to the conclusion that the envisaged agreement was incompatible with Articles

text: and

text: and Article 52(1) of the Charter, was the possibility to transfer sensitive data from the EU to Canada and the subsequent use and retention of that data by the Canadian authorities .

text: 15. The EDPS welcomes that in the current draft Agreement the processing of sensitive data, i.e. any information that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or information about a person's health or 6

text: 5. Categories of PNR data

text: 16. The EDPS notes the efforts made to define in a clear a precise manner the PNR data categories to be processed in the Annex to the draft Agreement. The requirement of clarity and precision was set out by the CJEU in its Opinion 1/15 , leading the Court to conclude that headings 5, 7 and 17 of the Annex to the draft 2014 EU-Canada PNR Agreement did not delimit in a sufficiently clear and precise manner the scope of the interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter .

text: 17. In particular, with regard to heading 17, the EDPS notes that the draft Agreement limits the nature and scope of the information to be provided therein by referring to “Other Supplementary Information (OSI), Special Service Information (SSI) and Special Service Request (SSR)”, instead of referring to “General information, including Other Supplementary Information (OSI)”, Special Service Information (SSI).

text: 6. Automated processing of PNR data

text: 18. Article 15 of the draft Agreement obliges Canada to ensure that any automated processing of PNR data is based on non-discriminatory, specific and reliable pre-established models and criteria. The EDPS recalls that the CJEU in its judgment in

text: Case C-817/19

text: Ligue des droits humains has clarified that reliance on pre-established criteria precludes the use of artificial intelligence technology in self-learning systems (‘machine learning’), capable of modifying without human intervention or review, the assessment process, the assessment criteria as well as the weighting of those criteria. The Court has expressed concerns that the use of such technology may pose challenges for data subjects in understanding why a given program arrives at a positive match and in challenging the non-discriminatory nature of the results. This is due to the opacity of the way in which artificial intelligence works, which could potentially deprive data subjects of their rights, notably the right to an effective judicial remedy, enshrined in Article 47 of the Charter. 7

text: 19. In addition, in the same judgment , the CJEU further detailed the necessary measures that should be taken to address issues related to the prohibition of direct and indirect discrimination, thus giving practical effect to the requirements set out in Opinion 1/15 .

text: 20. According to the CJEU, to avoid direct or indirect discrimination, the pre-determined criteria must be defined in such a way that “[...] while worded in a neutral fashion, their application does not place persons having the protected characteristics at a particular disadvantage”. Second, to comply with the requirements relating to the targeted, proportionate and specific nature of pre-determined criteria, the said criteria must be determined in such a way as to target specifically individuals who might be reasonably suspected of involvement in terrorist offences or serious crime covered by the Proposal. Third, in order to enhance the reliability and proportionality of the criteria both incriminating and exonerating circumstances should be taken into account. Forth, the predetermined criteria must be reviewed regularly. This review entails updating the criteria in light of the circumstances that warrant their consideration, while also factoring in the experience gained to reduce the occurrence of 'false positives'.

text: 21. The EDPS considers these elements relevant for the implementation of the future Agreement and recommends to take them into account when carrying out the joint reviews referred to in Article 27(3) of the draft Agreement.

text: 7. Retention of PNR data

text: 22. The 2014 draft EU-Canada PNR Agreement provided for a general retention period of five years from the date the Canadian Competent Authority would have received the PNR data. The PNR data would have been depersonalised through masking certain categories of data, some categories already after the expiry of 30 days and some after 2 years. The CJEU, in its Opinion 1/15, when assessing the necessity and proportionality of the retention period, made a distinction between the retention of PNR data before the arrival of air passengers and during their stay in Canada , on the one hand, and after the air passengers’ departure 31 32 from Canada , on the other .

text: 23. While concluding that the five-year retention period does not exceed the limits of what is strictly necessary for the purposes of combating terrorism and serious transnational crime , the CJEU emphasised that the retention of PNR data after the air passengers’ departure should be limited to that of passengers in respect of whom there is objective evidence from which it may be inferred that they may present a risk in terms of the fight against terrorism and serious transnational crime .

text: 24. The EDPS notes that the current draft Agreement in

text: Article 16

text: maintains the general fiveyear retention period. At the same time, the EDPS positively notes the new obligation of Canada to review the PNR data retention period every two years and determine whether it remains commensurate with the level of risk of terrorism and serious transnational crime originating from and transiting through the EU. Moreover, Canada should provide a classified report to the EU outlining the outcome of the review, including the level of risk identified, factors considered in minimizing the data retention period, and the related retention decision.

text: 25. Regarding the retention of PNR data of departing air passengers, Article 16(3) of the new draft Agreement provides that “PNR data may be retained under this Agreement beyond the passenger’s date of departure, where Canada considers that there is a connection with the purposes set in

text: Article 3

text: , based on objective elements from which it may be inferred that the PNR data might make an effective contribution to address such purposes” (emphasis added). It therefore seems that, in line with

text: Article 3(1)

text: , the retention of PNR data beyond the passenger’s date of departure would be allowed: (a) in connection with the purposes of fighting terrorist offences or serious transnational crime, but also (b) in connection with the purposes of overseeing the processing of PNR data within the terms of the Agreement, including for analytical operations.

text: 26. Although the CJEU did not specifically address the purposes mentioned in the paragraph above under (b), the EDPS is of the opinion that same principles should apply in the latter case too. In that regard, the EDPS positively notes that, in line with Art 16(3), retention of PNR data beyond the passenger’s date of departure in connection with the purposes set in

text: Article 3

text: is only permissible under certain limited circumstances. The EDPS, however, emphasises that, in line with Opinion 1/15 , these circumstances should in no way be interpreted broadly and should not lead in practice to the retention in bulk of PNR data of departed passengers.

text: 8. Purposes and conditions for use of PNR data

text: 27. Purpose limitation is one of the fundamental principles of the EU legal framework on data protection and a key prerequisite for ensuring the proportionality of any interference with the rights enshrined in Articles 7 and 8 of the Charter. It is even more important in the context of PNR which involves processing by law enforcement authorities of personal data of a very large number of individuals not implicated in a criminal activity.

text: 28. The EDPS welcomes that, pursuant to Article 3 of the draft Agreement, PNR data received by the Canadian authorities should only be processed for the purposes of preventing, detecting, investigation or prosecuting terrorist offences or serious transnational crime, and to oversee the processing of PNR data, including for analytical operations.

text: 29. However, the EDPS notes that the draft Agreement in

text: Article 17

text: , which regulates the conditions for the use of the retained PNR data by the Canadian Competent Authority, provides that ”the Canadian Competent Authority may only use PNR data retained in

text: accordance with

text: Article 16

text: for purposes other than security and border control checks

text: where new circumstances based on objective grounds indicate that the PNR data of one or more passengers might make an effective contribution to the purposes set out in

text: Article 3

text: ” (emphasis added).

text: 30. While the EDPS welcomes that the draft Agreement tries to envisage clear conditions for the use of the retained PNR data, he reminds that the purposes of the use of PNR data are clearly circumscribed in Article 3 of the draft Agreement (preventing, detecting, investigating or prosecuting terrorist offences or serious transnational crime and overseeing the processing of PNR data within the terms of the draft Agreement). Having that in mind, the EDPS underlines that PNR data could be used in the context of “security and border control checks” only when those checks pursue one of the purposes laid down in Article 3 of the draft Agreement, and not for other purposes, such as immigration control. This should be assessed specifically by the Commission during the joint review.

text: 31. Further on, the EDPS positively notes that

text: Article 17

text: subjects any use of PNR data, including any disclosure, to a prior review by a court or by an independent administrative body based on a reasoned request by the competent authorities within the framework of procedures for the prevention, detection or prosecution of crime. This rule has, however, two exceptions, one of them being cases of validly established urgency. While it is customary, due to time constraints, to limit the prior review in situations of valid emergency, the EDPS would like to remind that these kinds of situations should not, in principle, pass entirely without a review, in order to avoid possible abuses. As also clarified by the CJEU in other contexts , even in cases where the prior (judicial) review was not possible ex ante, the review should still take place within a short time.

text: 32. The EDPS therefore recommends that, during the joint reviews, the Parties assure that such urgent access without prior review by a court or by an independent administrative body is indeed performed only in duly justified exceptional cases.

text: 9. Disclosure outside Canada

text: 33. In Opinion 1/15, the CJEU has set out a specific requirement for the Canadian Competent Authority to disclose PNR data to government authorities of a third country. This is subject to the condition that there is either an agreement between the EU and that third country equivalent to the envisaged agreement, or an adequacy decision of the Commission, covering the authorities to which it is intended that PNR data be disclosed .

text: 34. The EDPS positively notes that Article 20 of the current draft Agreement lays down a number of specific conditions concerning disclosure of PNR data by Canada to third countries, including the requirement in

text: Article 20(1)

text: (e) that “the country to which the data is disclosed has either concluded an Agreement with the European Union that provides for the protection of personal data comparable to this Agreement or is subject to a decision of the European Commission pursuant to European Union law, finding that said country ensures an adequate level of data protection within the meaning of European Union law”.

text: 35. The EDPS furthermore notes Article 20(2) of the current draft Agreement provides for an exception to the above-mentioned requirement if “the disclosure is necessary for the prevention or investigation of a serious and imminent threat to public security and if that country provides a written assurance, pursuant to an arrangement, agreement or otherwise that the information will be protected in line with the protections set out in this Agreement”. The EDPS considers that this exception is generally in line with the corresponding provision of the Union legal framework, namely

text: Article 11

text: “Transfer of data to third countries” of

text: Directive (EU) 2016/681

text: 10. Access to PNR data by Europol and Eurojust

text: 36. The EDPS notes that according to Article 6 of the draft Agreement, Canada has an obligation to share, subject to certain conditions, (1) proactively ‘analytical information containing PNR data’, and (2) reactively (on request) both PNR data or analytical information containing PNR data, with Europol, Eurojust and/or the police or judicial authorities of Member States.

text: 37. In this context, the EDPS reminds that, in as far as the data concerns extra-EU flights between the EU and Canada, this information is already processed under the EU PNR Directive by the Member States' Passenger Information Units (PIU). The EU PNR Directive does not foresee access to this data for Eurojust, and very strictly defines the conditions under which Europol is able to access it. The EDPS therefore underlines that the EU-Canada PNR Agreement should not lead to situations where Union Agencies request data from Canada which they would not be able to request from an EU Member State, thus circumventing the conditions and the limitations provided for in the EU law.

text: 11. Data subjects rights

text: 38. The EDPS positively notes that the draft Agreement includes provisions that aim to protect the individual rights of air passengers. In particular,

text: Article 11(3)

text: stipulates that Canada is required to inform passengers in writing, individually and within a reasonable timeframe, about the processing of their PNR data by the Canadian Competent Authority and other government authorities whose functions are directly related to the purposes set out in

text: Article 3

text: . This notification must be provided once it no longer poses a risk to the investigations by the relevant government authorities.

text: 39. The EDPS acknowledges the efforts made to address one of the key requirements set out by the Court in its Opinion 1/15. Specifically, it is important to ensure that the Agreement provides individuals with the right to be notified individually about the processing of their PNR data by the Canadian Competent Authority as well as by other government authorities or individuals. This is a key prerequisite to ensure that the rights to access to data and to correction (rectification) are complied with in practice.

text: 40. The EDPS therefore recommends that special attention be given to this aspect in the joint reviews referred to in Article 27(3) of the draft Agreement. This includes collecting and sharing relevant statistics.

text: 12. Oversight

text: 41. Under Article 8(3) of the Charter, compliance with the data protection requirements stemming from

text: Article 8(1)

text: and (2) thereof is subject to control by an independent authority. In accordance with the settled case-law of the CJEU, the guarantee of the independence of such a supervisory authority, the establishment of which is also provided for in

text: Article 16(2)

text: TFEU, is intended to ensure the effectiveness and reliability of the monitoring of compliance with the rules concerning protection of individuals with regard to the processing of personal data and must be interpreted in the light of that aim. The establishment of an independent supervisory authority is therefore an essential component of the protection of individuals with regard to the processing of personal data .

text: 42. Furthermore, in its Opinion 1/15, when deciding on the previous draft Agreement, the CJEU stressed that the formulation in that Agreement seemed to permit the oversight to be carried out, partly or wholly, by an authority which does not carry out its tasks with complete independence, but which is subordinate to a further supervisory authority, from which it may receive instructions, and which is therefore not free from any external influence liable to have an effect on its decisions. In those circumstances, Article 10 of the previous draft Agreement did not guarantee in a sufficiently clear and precise manner that the oversight of compliance with the rules laid down in that agreement relating to the protection of individuals with regard to the processing of PNR data would have been carried out by an independent authority, within the meaning of Article 8(3) of the Charter .

text: 43. In that regard, the EDPS welcomes that Article 10 of this draft Agreement lays down that the data protection safeguards for the processing of PNR data under the draft Agreement must be subject to oversight by one or more independent public authorities and that Canada must ensure that these authorities have effective powers to investigate compliance with the rules related to the collection, use, disclosure, retention, or disposal of PNR data.

text: 13. Legal remedies

text: 44. The EDPS welcomes Article 14 of the draft Agreement obliging Canada to ensure that an independent public authority receives, investigates and responds to complaints lodged by an individual concerning their request for access, correction or annotation of their PNR 12 data, as well as effective judicial redress for any individual who is of the view that their rights have been infringed by a decision or action in relation to their PNR data.

text: 45. As already elaborated by the CJEU , this obligation covers all air passengers, regardless of their nationality, their residence, their domicile or their presence in Canada. Furthermore, it must be understood as meaning that air passengers have a legal remedy before a tribunal, as required by the first paragraph of Article 47 of the Charter.

text: 14. Conclusions

text: 46. In light of the above, the EDPS concludes that the draft Agreement between the EU and Canada on the transfer of PNR data contains the necessary safeguards required in order for it to be compatible with the Charter of Fundamental Rights, as specified by CJEU in its Opinion 1/15 of 26 July 2017.

text: 47. The EDPS furthermore makes the following specific recommendations with the aim to ensure that the Agreement would be interpreted and applied in compliance with the requirements of the CJEU: (1) to interpret and apply strictly the provision of Article 16(3) of the draft Agreement, allowing the retention of PNR data beyond the passenger’s date of departure in connection with the purposes set in

text: Article 3

text: , in a way that does not lead in practice to the retention in bulk of PNR data of departing passengers; (2) to use PNR data in the context of “security and border control checks” pursuant to Article 17 of the draft Agreement only when those checks pursue one of the purposes laid down in

text: Article 3

text: , i.e. preventing, detecting, investigation or prosecuting terrorist offences or serious transnational crime, and not for other purposes, such as immigration control; (3) to ensure that in cases of urgency, as described in

text: Article 17(1)

text: (a) of the draft Agreement, access to retained PNR data without a prior review by a court or by an independent administrative body is allowed only in duly justified exceptional cases; (4) to take into account the requirements of the CJEU regarding automated processing of PNR data when carrying out the joint reviews referred to in Art 27(3) of the draft Agreement; (5) to examine during the joint reviews referred to in Art 27(3) also the exercise of data subject rights, including by collecting the relevant statistics. Brussels, 29 April 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI