text: OJ L 295, 21.11.2018, p. 39. 2 Article 1 of the Signing Proposal. 3 Article 1 of the Conclusion Proposal. 4 Article 1 of the Agreement.

text: The EDPS notes that Recital 8 of the Signing Proposal refers to the ‘advice’ of the EDPS while Recital 5 of the Conclusion Proposal refers to the ‘opinion’ of the EDPS. The correct wording is ‘opinion’.

text: Council Decision 2015/238/EU of 10 February 2015

text: on the conclusion of the Fisheries Partnership Agreement between the European Union and the Republic of Seychelles (OJ L 40, 16.2.2015, p. 1). 7 Recital 2 of the Signing Proposal. 8 Recital 3 of the Signing Proposal. 9 Recital 4 of the Signing Proposal. 10

text: Regulation (EU) 2017/2403

text: of the European Parliament and of the Council of 12 December 2017 on the sustainable management of external fishing fleets, and repealing

text: Council Regulation (EC) No 1006/2008

text: , OJ L 347, 28.12.2017, p. 81.

text: Article 43 of the SMEFF Regulation: ‘1. When a Member State receives information from a third country or an RFMO which is relevant for the effective application of this Regulation, it shall communicate that information to the Commission or the body designated by it, and, where appropriate, to other Member States concerned, provided that it is permitted to do so under bilateral agreements with that third country or the rules of the RFMO concerned. 2.The Commission or the body designated by it may, in the framework of fisheries agreements concluded between the Union and third countries, under the auspices of RFMOs to which the Union is a contracting party, communicate relevant information concerning non-compliance with the rules of this Regulation, or serious infringements, to other parties to those agreements or organisations subject to the consent of the Member State that supplied the information and in accordance with

text: Regulation (EC) No 45/2001

text: Article 13(1) of the Agreement. 13 Article 13(2) of the Agreement. 14 Article 13(3) of the Agreement. 15 Article 13(3) of the Agreement. 16 See for instance Article 17 of the Protocol implementing the Sustainable Fisheries Partnership Agreement between the European Union and the Islamic Republic of Mauritania (OJ L 439, 8.12.2021, p. 3).

text: Article 13(4) of the Agreement: ‘Appropriate safeguards and legal remedies may be established by the Joint Committee in accordance with the relevant Union legislation on the protection of personal data’. 18

text: Article 48(2)

text: (a) EUDPR and

text: Article 46(2)

text: (a) GDPR. 19

text: Article 48(1)

text: EUDPR and

text: Article 46(1)

text: GDPR. 20 European Data Protection Board (EDPB) Guidelines 2/2020 on

text: articles 46 (2)

text: (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, issued on 15 December 2020. The same guidance also clarifies the safeguards required to be put in place by provisions to be inserted into administrative arrangements between public bodies, subject to authorisation from the competent supervisory authority.

identifier: EDPS yttrande 25/2022

amnesord:
Privacy in the EU Institutions
Transparency

title: Opinion on the signing, provisional application and conclusion of the Agreement between the EU and the Republic of Seychelles on access for Seychelles fishing vessels to the waters of Mayotte

text: 12 December 2022 Opinion 25/2022 on the signing, provisional application and conclusion of the Agreement between the European Union and the Republic of Seychelles on access for Seychelles fishing vessels to the waters of Mayotte

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to (i) the Proposal for a Council Decision on the signing, on behalf of the European Union, and provisional application of an Agreement between the European Union and the Republic of Seychelles on access for Seychelles fishing vessels to the waters of Mayotte and (ii) on the conclusion of an Agreement between the European Union and the Republic of Seychelles on access for Seychelles fishing vessels to the waters of Mayotte. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the draft Proposals that are relevant from a data protection perspective.

text: Executive Summary

text: On 24 October 2019, the Council authorised the Commission to open negotiations with the Republic of Seychelles in order to conclude a new agreement between the European Union and the Republic of Seychelles on access for Seychelles fishing vessels to the waters of Mayotte.

text: The EDPS is now consulted on the Commission proposals to sign and conclude this agreement. The EDPS welcomes the inclusion of

text: Article 13

text: on data protection in the agreement, which reinforces the level of protection for data subjects. In particular, the EDPS welcomes the clarification that the data shall be used by the competent authorities exclusively for the implementation of the Agreement and for the purpose of fisheries management, monitoring, control and surveillance and that personal data shall not be kept beyond the time necessary for which they were exchanged. The EDPS nevertheless recommends to make use of the joint committee (made of representatives of the EU and of the Republic of Seychelles) to further detail these data protection safeguards and to establish appropriate safeguards, enforceable data subject rights and effective legal remedies, allowing for personal data to be transferred in compliance with the GDPR/EUDPR.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of natural persons with regard to the processing of personal data by the EU institutions, bodies, offices and agencies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 10 November 2022, the European Commission (‘the Commission’) issued: - a Proposal for a Council Decision on the signing, on behalf of the European Union, and provisional application of an Agreement between the European Union and the Republic of Seychelles on access for Seychelles fishing vessels to the waters of Mayotte (‘the Signing Proposal’); and - a Proposal for a Council Decision on the conclusion of an Agreement between the European Union and the Republic of Seychelles on access for Seychelles fishing vessels to the waters of Mayotte (‘the Conclusion Proposal’).

text: 2. The objective of the Signing Proposal is to approve on behalf of the Union, the signing of the Agreement between the European Union and the Republic of Seychelles on access for Seychelles fishing vessels to the waters of Mayotte (‘the Agreement’), in accordance with

text: Article 43(2)

text: in conjunction with

text: Article 218(5)

text: TFEU .

text: 3. The objective of the Conclusion Proposal is to approve the Agreement on behalf of the Union, in accordance with

text: Article 43(2)

text: in conjunction with

text: Article 218(6)

text: (a)(v) and (7) TFEU .

text: 4. The objective of the Agreement is to establish :  economic, financial, technical and scientific co-operation in the fisheries sector with a view to promote sustainable fishing in Union waters to guarantee the conservation and sustainable exploitation of fisheries resources, and develop the Mayotte's fisheries sector; 4  the conditions governing access by Seychelles' fishing vessels to Union waters;  the arrangements for the management, control and surveillance measures of fishing activities in Union waters with a view to ensuring that the above rules and conditions are complied with; that the measures for the conservation and sustainable exploitation of fish stocks and management of fishing activities are effective; and that illegal, unreported and unregulated fishing is prevented.

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the Commission of 10 November 2022, pursuant to Article 42(1) of the EUDPR and relating to the Signing Proposal and the Conclusion Proposal. The EDPS welcomes the reference to this consultation in Recital 8 of the Signing Proposal and Recital 5 of the Conclusion Proposal.

text: 2. General remarks

text: 6. On 10 February 2015, the Council adopted a decision on the conclusion, on behalf of the European Union, of the Agreement between the European Union and the Republic of the Seychelles on access for fishing vessels flying the flag of the Seychelles to the waters and marine biological resources of Mayotte, under the jurisdiction of the European Union (‘the 2015 Agreement’). The period of application of the 2015 Agreement expired on 7 8 20 May 2020 . The 2015 Agreement was tacitly renewed for an additional period of 6 years .

text: 7. On 24 October 2019, the Council authorised the Commission to open negotiations with Seychelles in order to conclude a new agreement. Those negotiations were successfully concluded and a new agreement was initialled on 10 June 2022 .

text: 8. The Agreement should now be signed and approved on behalf of the EU.

text: 9. In this context, the EDPS understands that the roles and responsibilities of the EU and of the Member States for issuing and managing fishing authorisations are laid down in

text: Regulation (EU) 2017/2403

text: Council Regulation (EC) No 1006/2008

text: (‘the SMEFF Regulation) . In this respect, the EDPS takes note that Title IV and in particular Article 43 of the SMEFF Regulation on relations with third countries and Regional Fisheries Management Organisations (RFMOs) clarify, to a 5 certain extent, the roles and responsibilities of the Commission and the Member States regarding the exchange of information with third countries and RFMOs .

text: 3. Data protection safeguards

text: 10. The EDPS welcomes the inclusion of a specific provision on data protection in Article 13 of the Agreement. This article reinforces the level of protection for data subjects. In particular, the EDPS welcomes the clarification that:  the ‘nominative data’ relating to fishing activities in Union waters under the Agreement will be processed in accordance with confidentiality and data protection principles under the applicable law of the respective parties ;  the data shall be used by the competent authorities exclusively for the implementation of the Agreement and for the purpose of fisheries management, monitoring, control and surveillance ;  personal data shall be processed in an appropriate manner to ensure their protection, including against unauthorised or unlawful processing ;  personal data shall not be kept beyond the time necessary for which they were exchanged .

text: 11. The EDPS notes that Article 13(3) of the Agreement does not identify a specific storage retention period and the obligation to anonymise the remaining personal data after a certain period, although this provision was successfully negotiated in the case of some protocols implementing fisheries agreements .

text: 12. In this context, the EDPS notes that Article 13(4) of the Agreement provides that appropriate safeguards and legal remedies with regard to personal data may be established 6 by a joint committee i.e. a committee made up of representatives of the EU and the Republic of Seychelles (‘the Joint Committee’) .

text: 13. Therefore, the EDPS recommends making use of this possibility so that the data protection safeguards of Article 13 of the Agreement be further detailed. This should aim, in particular, to identify a specific storage retention period and to lay down an obligation to anonymise the remaining personal data after a certain period.

text: 4. International transfers of personal data

text: 14. The EDPS recalls that in the absence of an adequacy decision, transfers of personal data to a third country may be based on a legally binding and enforceable instrument between public authorities or bodies . In such case, such instrument should provide appropriate safeguards and ensure that enforceable data subject rights and effective legal remedies for data subjects are available .

text: 15. The EDPB has clarified what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies .

text: 16. Among those requirements, the EDPS points out in particular to the obligation to provide for redress mechanisms, supervision mechanisms, data subjects rights or restrictions on onward transfers and sharing of data.

text: 17. In view of the above, it is apparent that the Agreement does not meet all the requirements to be considered, within the meaning of the GDPR/EUDPR, as a legally binding and enforceable instrument between public authorities or bodies on which the transfer of personal data could be based.

text: 18. However, the EDPS notes that Article 13(4) of the Agreement provides that further safeguards and legal remedies may be established by the Joint Committee. In this respect, the EDPS recommends that the Joint Committee indeed establishes appropriate safeguards, enforceable data subject rights and effective legal remedies, allowing thus for personal data to be transferred in compliance with the GDPR/EUDPR. In doing so, the EDPS recommends the Commission to take due account of the EDPB Guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 7

text: 5. Conclusions

text: 19. In light of the above, the EDPS makes the following recommendations: (1) to make use of the Joint Committee to further detail the data protection requirements of Article 13 of the Agreement. This should aim, in particular, to identify a specific storage retention period and lay down an obligation to anonymise the remaining personal data after a certain period. (2) to make use of the Joint Committee to establish appropriate safeguards, enforceable data subject rights and effective legal remedies, allowing for personal data to be transferred in compliance with the GDPR/EUDPR. In doing so, the EDPS recommends the Commission to take due account of the EDPB Guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies. Brussels, 12 December 2022 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8


text: COM (2023) 192 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 COM (2023) 192 final. 4 COM (2023) 192 Final, p. 2. COM (2023) 192 Final, p. 2. 4

text: COM (2023) 192 Final, p. 2. 7 See in particular recital 97 of the Proposal. 8

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: , OJ L 119, 4.5.2016, p. 1–88. 9 See in particular recitals 97, 128, 131 together with Articles 25, 104 and 200 of the Proposal. 5

text: p.o. Leonardo CRVERA NAVAS Acting Head of EDPS Secretariat

text: See further EDPS Guidelines on the concepts of controller, processor and joint controllership under

text: Regulation (EU) 2018/1725

text: , 7 November 2019, p.8. 7

identifier: EDPS yttrande 25/2023

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 25/2023 on the Proposal for a Directive on the Union code relating to medicinal products for human use and repealing Directive 2001/83/EC and Directive 2009/35/EC

serie: yttranden

text: 19 June 2023

type: rubrik

text: Opinion 25/2023

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Directive of the European Parliament and of the Council on the Union code relating to medicinal products for human use and repealing Directive

text: and Directive

text: .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: and Directive

text: Exceptions to the prohibition on processing of personal data concerning health may be provided for by Union law where it is necessary for reasons of public interest in the area of public health and/or for scientific research purposes. When doing so, however, the legal basis provided by Union law must provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. The EDPS therefore considers that the Proposal should at least specify all relevant sources of personal health data, together with other relevant safeguards, such as pseudonymisation.

text: On the repository of active substance master files, the EDPS acknowledges that its establishment will also involve processing of personal data (and possibly personal health data). In this regard, the EDPS considers that the Proposal should clarify the respective roles and responsibilities of EMA and the Member States within the meaning of data protection law.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 26 April 2023, the European Commission issued the Proposal for a Directive of the European Parliament and of the Council on the Union code relating to medicinal products for human use and repealing Directive

text: and Directive

text: (‘the Proposal’).

text: 2. According to its Explanatory Memorandum , the main objectives of the Proposal are to: • guarantee a high level of public health by ensuring the quality, safety and efficacy of medicinal products for EU patients, including for paediatric patients and patients suffering from rare diseases throughout the Union and; • harmonise the internal market for the supervision and control of medicinal products and the rights and duties incumbent upon the competent authorities of the Member States.

text: 3. The specific objectives of the Proposal are to : • ensure that all patients across the EU have timely and equitable access to safe, effective, and affordable medicines; • enhance security of supply and ensure medicines are always available to patients, regardless of where they live in the EU; • offer an attractive innovation-and competitiveness friendly environment for research, development, and production of medicines in Europe; • make medicines more environmentally sustainable.

text: 4. As explained in recital 3, the Proposal is part of the implementation of the Pharmaceutical strategy for Europe. The Proposal aims to promote innovation, in particular for unmet medical needs, while reducing regulatory burden and the environmental impact of medicines. It also aims to ensure access to innovative and established medicines for patients, with special attention to enhancing security of supply and addressing risks of shortages.

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 27 April 2023, pursuant to Article 42(1) of EUDPR.

text: 2. General remarks

text: 6. The EDPS welcomes the objectives of the Proposal, namely achieving an internal market as regards medicinal products for human use and, at the same time, setting high standards of quality and safety for medicinal products in order to meet common safety concerns with regard to such products.

text: 7. The EDPS considers that both the Explanatory Memorandum and the Preamble to the Proposal clearly set out its objectives, in support of the necessity of the foreseen processing of personal data, including special categories of personal data (in particular health data).

text: 8. The EDPS welcomes the provisions of the Proposal recalling that the EUDPR and the

text: Regulation (EU) 2016/679

text: (‘GDPR’) will apply to the various processing of personal data taking place under the Proposal . In this regard, the EDPS highlights that the protection of the fundamental rights, and the protection of personal data and privacy, in the context of the Proposal are inextricably linked with the protection of human dignity and integrity of the person, particularly where special categories of personal data within the meaning of

text: Article 9

text: GDPR and 10 EUDPR are involved.

text: 9. In the chapters below, the Opinion provides specific comments and recommendations on the processing and use of health data by the competent authorities as set out in recital 30 and Article 200 of the Proposal. It will also make specific recommendations on the processing of personal data and the roles and responsibilities within the meaning of data protection law in the context of the repository of active substance master files, which is provided for in the Proposal.

text: 10. Lastly, the EDPS notes that the Proposal does not contain any recital referring to this consultation. Therefore, the EDPS recommends that a recital be added to the Proposal containing specific reference to the consultation of the EDPS under

text: Article 42(1)

text: EUDPR.

text: 3. Processing and use of personal health data by competent authorities

text: 11. The EDPS notes that Article 200(4) of the Proposal states that “[t]he competent authority of the Member State may process personal health data from sources other than clinical studies to support their public health tasks and, in particular, the evaluation and monitoring to medicinal products, for the purpose of improving the robustness of the scientific assessment or verifying claims of the applicant or marketing authorisation holder” and that “[p]rocessing of personal data under this Directive shall be subject to Regulations

text: (EU) 2016/679

text: and

text: (EU) 2018/1725

text: , as applicable.”

text: 12. In line with

text: Article 9

text: GDPR, processing of personal data concerning health shall be prohibited, unless one of the exceptions under

text: Article 9(2)

text: GDPR applies. Reasons of substantial public interest in the area of public health and scientific research can justify the processing of personal data concerning health provided that appropriate safeguards for the fundamental rights and interests of the data subject are identified on the basis of Union or Member State law .

text: 13. In this regard, the EDPS notes that, while the Proposal outlines the purposes for which processing of personal data would be carried out, it does not specify the categories of personal health data to be processed or the sources from which such personal health data would be collected.

text: 14. As regards the categories of data to be processed, the EDPS understands that providing further details in the legislative act of each specific category to be processed by Member States could be complex to achieve in practice. Article 200(4) of the Proposal makes clear, however, that competent authorities may only personal health data which is necessary to support to support the public health tasks and, in particular, the evaluation and monitoring to medicinal products, for the purpose of improving the robustness of the scientific assessment or verifying claims of the applicant or marketing authorisation holder.

text: 15. As regards the sources from which such personal health data would be collected, the EDPS notes that Article 200(4) of the Proposal indicates that personal health data to be processed by Member States could be health data generated outside of clinical studies. Recital 30 of the Proposal indicates that competent authorities should be able to use such data, including via the European Health Data Space interoperable infrastructure.

text: 16. In accordance with

text: Article 9(2)

text: GDPR, the prohibition on processing of personal data concerning health shall not apply in the cases of

text: Article 9(2)

text: (i) (public health) and

text: Article 9(2)

text: (g) (scientific research). Both these provisions require, however, that the relevant legal basis provided by Union or Member State law “provides for suitable and specific measures” to safeguard the rights of the data subject.

text: 17. The EDPS understands that, in cases of use of health data via the forthcoming European Health Data Space (‘EHDS’), the safeguards required by

text: Articles 9

text: GDPR will be those included in the forthcoming EHDS Regulation. In all other cases, however, in line with

text: Articles 9

text: GDPR, safeguards would need to be specified in another instrument of Union or Member State law. In the light of the considerations, the EDPS considers it necessary that at least the sources from which personal health data would be collected be identified in the enacting terms of the Proposal, together with any other relevant safeguards, such as pseudonymisation.

text: 4. Repository of active substance master files

text: 18. The EDPS notes that

text: Article 4(1)

text: (36) of the Proposal defines 'active substance master file’ as “(...) a document that contains a detailed description of the manufacturing process, quality control during manufacture and process validation prepared in a separate document by the manufacturer of the active substance;”. Moreover, Article 25(2) of the Proposal adds that “[t]he Agency shall establish a repository of active substance master files, their assessments reports and their certificates and ensure that personal data is protected. The Agency shall ensure that the competent authorities of the Member State have access to this repository”.

text: 19. Given the wording of Article 25(2) of the Proposal, the EDPS understands that the establishment of the repository of active substance master files will also involve processing of personal data. In this regard, the EDPS notes that the Proposal does not specify the respective roles and responsibilities of EMA and the Member States within the meaning of data protection legislation. A clear allocation of roles and responsibilities between EU institutions and the national authorities is important, however, in particular with a view of ensuring transparency and the exercise of data subject rights. The EDPS therefore recommends specifying the roles and responsibilities of EMA and the Member States within the meaning of data protection law in relation to the processing operations carried out within the repository.

text: 5. Conclusions

text: 20. In light of the above, the EDPS makes the following recommendations: (2) to clarify in Article 200(4) of the Proposal at least the sources from which personal health data would be collected by Member States, together with other relevant safeguards, such as pseudonymisation; (3) to specify the roles and responsibilities of EMA and the Member States within the meaning of data protection law in relation to the processing operations carried out within the repository of active substance master files. Brussels, 19 June 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI

type: vagledning

utgivare: edps


text: OJ L 295, 21.11.2018, p. 39. 2 COM(2024) 479 final. 3 Recital 4 of the Signing Proposal. 4

text: Appendix 6. 5 Court of Justice of European Union, Judgment of the Court of 22 November 2022, WM and Sovim SA v Luxembourg Business Registers, ECLI:EU:C:2022:912, paragraph 65 5

text: EDPS Opinion 17/2024 on the signing, provisional application and conclusion of the Protocol (2024-2029) implementing the Fisheries Partnership Agreement between the European Community and the Republic of Cabo Verde, 5 July 2024, and EDPS Opinion 18/2024 on the signing, provisional application and conclusion of the Implementing Protocol (2024-2029) to the Fisheries Partnership Agreement between the European Community and the Republic of Guinea-Bissau, 27 August 2024. Sustainable Fisheries Partnership Agreement between the European Union, of the one part, and the Government of Greenland and the Government of Denmark, of the other part, ST/6380/2021/INIT, OJ L 175, 18.5.2021, p. 3–40. 8 European Data Protection Board (EDPB) Guidelines 2/2020 on

text: articles 46 (2)

text: (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, issued on 15 December 2020. The same guidance also clarifies the safeguards required to be put in place by provisions to be inserted into administrative arrangements between public bodies, subject to authorisation from the competent supervisory authority. 6

identifier: EDPS yttrande 25/2024

title: EDPS Opinion 25/2024 on the signing and provisional application of the Implementing Protocol (2025-2030)

text: Opinion 25/2024

text: on the signing and provisional application of the Implementing Protocol (2025-2030) to the Sustainable Fisheries Partnership Agreement between the European Union on the one hand, and the Government of Greenland and the Government of Denmark on the other hand

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of Proposals for a legislative act, of recommendations or of Proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Council Decision on the signing, on behalf of the European Union, and provisional application of the Protocol (2025-2030) implementing the Sustainable Fisheries Partnership Agreement between the European Union on the one hand, and the Government of Greenland and the Government of Denmark on the other. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposals that are relevant from a data protection perspective.

text: Executive Summary

text: The EDPS is consulted on the Commission Proposals to sign and provisionally apply a Protocol on the implementation of the Sustainable Fisheries Partnership Agreement between the EU on the one hand, and the Government of Greenland and the Government of Denmark on the other hand.

text: The EDPS welcomes the inclusion of an Article dedicated to data protection, which is supplemented by an appendix to the Annex to the Protocol, expanding the data protection provisions and detailing the conditions and safeguards relating to the processing of personal data.

text: While the EDPS understands that it might be necessary for the Government of Greenland to make publicly available certain categories of personal data related to Union vessels in order to achieve specific and clearly defined objectives of public interest, he underlines that the specific reasons that would justify such publication as necessary and proportionate should be clearly spelled out in the Annex to the Protocol.

text: For the purpose of transferring data, the EDPS invites the Commission to specify the safeguards that should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies.

text: The EDPS also recommends adding a provision that would refer to the specific safeguards to be provided in case of processing of personal data relating to criminal convictions and offences.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 17 October 2024, the European Commission issued a Proposal for a Council Decision on the signing, on behalf of the European Union, and provisional application of the Implementing Protocol (2025-2030) to the Sustainable Fisheries Partnership Agreement between the European Union on the one hand, and the Government of Greenland and the Government of Denmark, on the other hand (‘the Signing Proposal’) .

text: 2. The objectives of the Protocol are to enable Union vessels to fish in Greenland’s fishing zone and to enable the Union and Greenland to work closely together to further promote the development of a sustainable fisheries policy and the responsible exploitation of fishery resources in Greenland’s fishing zone. This cooperation should also contribute to decent working conditions in the fisheries sector .

text: 3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 17 October 2024, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 8 of the Signing Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 4. The EDPS welcomes the inclusion in the Protocol of a specific article on data protection:

text: Article 11

text: provides that the data shall be processed by the competent authorities solely for the purposes of implementing the Agreement, and in particular for the purposes of fisheries management, monitoring, control and surveillance. Moreover, it specifies that personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject.

text: Article 11

text: is supplemented by an appendix to the Annex to the Protocol, which develops the provisions on the processing of personal data. The EDPS notes with satisfaction that these provisions include the definitions of ‘personal data’ and ‘processing’, the categories of personal data to be processed, the designation of authorities responsible for the processing of data, the principles relating to processing of personal data including the retention periods, the modalities of onward transfers, the rights of the persons concerned, the right to redress and the designation of independent supervisory authorities.

text: 3. Publication of personal data

text: 6. The principle of confidentiality is included in paragraph 2 of Article 11 of the Protocol. However, the same paragraph also provides an exception to this principle, by stating that ‘data relating to Union vessels and their fishing activities under this Agreement, including personal data, may be published as required by law, especially § 52 in Act no 29 of 23 May 2024 on Fisheries, to ensure transparency with regard to fishing operations’.

text: 7. The EDPS regrets that the Commission has not provided an official translation in English of this Greenlandic law in question. According to a non-official translation provided by the Commission, it seems that the first alinea of § 52 of Act no 29 of 23 May 2024 on Fisheries foresees the obligation for the Government of Greenland to make available data collected for management, control, analysis and research purposes. The second alinea of § 52 specifies that some information should be made available to the public, inter alia through the publication of an overview including, among other elements, information on licence holders. The EDPS considers this latter information as potentially including personal data.

text: 8. The EDPS recalls that, according to Chapter V of Regulation 2016/679 (GDPR) , the level of protection of natural persons guaranteed by this Regulation should not be undermined when their personal data which are undergoing processing or are intended for processing are transferred to a third country.

text: 9. The EDPS also recalls that, according to settled case-law of the European Court of Justice, the need for safeguards when a legislation entails the interference with the rights guaranteed in Articles 7 and 8 of the Charter ‘is all the greater where personal data are made accessible to the general public, and thus to a potentially unlimited number of persons (...)’ .

text: 10. While the EDPS understands that it might be necessary for the Government of Greenland to make certain categories of personal data related to Union vessels publicly available in order to achieve specific and clearly defined objectives of public interest, he underlines that the specific reasons of public interest that would justify such publication as necessary and proportionate should be clearly spelled out in

text: Article 11

text: or in appendix 6 to the Annex to the Protocol, which expands the data protection provisions of the Protocol.

text: 4. International transfers of personal data

text: 11. The EDPS notes that appendix 6 to the Annex to the Protocol is similar to those accompanying other Protocols implementing Fisheries Partnership Agreements between the European Union and third countries, on which he has been previously consulted . Consequently, he reiterates his previous comments, particularly regarding onward transfers, recalling that in absence of an adequacy decision, transfers of personal data to a third country may be based on a legally binding and enforceable instrument between public authorities or bodies. In such a case, such instrument should provide appropriate safeguards and ensure that enforceable data subject rights and effective legal remedies for data subjects are available.

text: 12. Article 11(4) of the Protocol foresees that further safeguards and legal remedies in relation to personal data and data subjects’ rights may be established by the Joint Committee provided for in Article 12 of the Agreement between the European Community and the Republic of Cape Verde. In this respect, the EDPS recommends the Joint Committee to specify in par. 2.7 of Appendix 6 what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 46(3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies .

text: 5. Personal data relating to criminal convictions and offences

text: 13. The EDPS notes that Section 5 of Chapter IV of the Annex entitled ‘Conditions governing fishing activities by Union Vessels under the Protocol implementing the sustainable fisheries partnership agreement between the European Union, on the one hand, and the Government of Greenland and the Government of Denmark, on the other’ foresees cases of infringements committed by a Union vessel holding a fishing authorization. The EDPS recalls that data processed to prevent and fight against illegal fishing may constitute personal data relating to criminal convictions and offences, in which case appropriate safeguards for the rights and freedoms of data subjects should be provided, in accordance with

text: Article 10

text: GDPR and/or

text: Article 11

text: EUDPR. The EDPS recommends adding in appendix 6 to the Annex to the Protocol a provision that would specify these specific safeguards.

text: 6. Conclusions

text: 14. In light of the above, the EDPS makes the following recommendations: (1) to make use of the Joint Committee to clearly spell out in Article 11 of the Protocol or in appendix 6 to the Annex to the Protocol the specific reasons of public interest that would justify, as necessary and proportionate, the publication of certain categories of personal data related to Union vessels, (2) to make use of the Joint Committee to specify in par. 2.7 of appendix 6 what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on

text: Articles 46(2)

text: (a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, (3) to make also use of the Joint Committee to add in appendix 6 a provision that would specify the safeguards to be provided in the context of the processing of data relating to criminal convictions and offences. Brussels, 11 December 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7


text: COM(2025) 433 final and COM(2025) 434 final. 1

text: OJ L 295, 21.11.2018, p. 39. 3 Recommendation for a COUNCIL DECISION authorising the European Commission to participate, on behalf of the European Union, in negotiations on a Council of Europe Convention superseding and replacing the 1998 Convention on the Protection of the Environment through Criminal Law (ETS No. 172), as well as a draft Explanatory Report thereto.COM/2023/419 final 4

text: Council Decision (EU) 2023/2170 of 28 September 2023

text: authorising the European Commission to participate, on behalf of the European Union, in negotiations on a Council of Europe Convention superseding and replacing the 1998 Convention on the Protection of the Environment through Criminal Law (ETS No. 172), OJ L, 2023/2170, 16.10.2023. Article 1 of the Council of Europe Convention on the protection of the environment through criminal law. 4

text: COM(2025) 433 final and COM(2025) 434 final. 7 Articles 1 of the Proposals. 8

text: Article 42

text: -Data protection. 9 R. & V. Haegeman v Belgian State Judgment of the Court of Justice of 30 April 1974, , ECLI:EU:C:1974:41, para. 5. 10 Judgment of the Court (Grand Chamber) of 3 June 2008, Intertanko and Others, ECLI:EU:C:2008:312, para. 42. 11 Judgment of the Court (Grand Chamber) of 3 September 2008, Yassin Abdullah Kadi, Al Barakaat International Foundation v. Council and Commission, ECLI:C:2008:461, para. 285. 5

text: Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108). 13 Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS n°223). 14 See Chapter V of

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1-88 and Chapter V

text: Article 36 of Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, pp. 89. 6

identifier: EDPS yttrande 25/2025

amnesord:
Convention 108
Council of Europe

title: EDPS Opinion 25/2025 on the Proposals for Council Decisions on the signing and conclusion, on behalf of the European Union, of the Council of Europe Convention on the protection of the environment through criminal law

text: Opinion 25/2025

text: on the two Proposals for Council Decisions on the signing and conclusion, on behalf of the European Union, of the Council of Europe Convention on the protection of the environment through criminal law

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to two Proposals for Council Decisions on the signing and conclusion, on behalf of the European Union, of the Council of Europe Convention on the protection of the environment through criminal law . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 29 July 2025, the European Commission adopted two Proposals for Council Decisions on the signing and conclusion, on behalf of the European Union, of the new Council of Europe Convention on the protection of the environment through criminal law.

text: The EDPS recognises the legitimacy and the importance of the aim pursued by this Convention, whose objective is to prevent and combat environmental crime, as well as promoting and enhancing national and international cooperation and establishing minimum rules to guide States in their national legislation.

text: Against this background, the EDPS welcomes the introduction of a specific article dedicated to the protection of personal data in the new Convention, and the reference in the Preamble to the Council of Europe Convention No. 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data and its amending Protocols.

text: The EDPS recommends ensuring that appropriate safeguards are in place for the transfers of personal data between EU Member States and third countries including, if appropriate, by the conclusion of bilateral or multilateral agreements.

text: Contents

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 23 November 2022, the Committee of Ministers of the Council of Europe set up and mandated the Committee of Experts on the protection of the environment through criminal law to draft a new Convention superseding and replacing the 1998 Convention on the Protection of the Environment through Criminal Law (ETS No. 172) (‘the new Convention’) by 30 June 2024.

text: 2. On 7 July 2023, the Commission adopted a Recommendation for a Council Decision authorising the European Commission to participate, on behalf of the European Union, in negotiations on the new Convention . The EDPS was not consulted on this recommendation.

text: 3. By Decision of 28 September 2023, the Council of the European Union authorised the Commission to participate, on behalf of the European Union, in the negotiations on the new Convention .

text: 4. On 14 May 2025, the Council of Europe’s Committee of Ministers adopted the new Convention on the Protection of the Environment through Criminal Law. The purposes of this Convention are to prevent and combat environmental crime, promote and enhance national and international co-operation against environmental crime, establish minimum rules to guide States in their national legislation and thereby promote and enhance the protection of the environment .

text: 5. Article 53 of the new Convention provides that the Convention shall be open for signature by the Member States of the Council of Europe, the non-member States which have participated in its elaboration and the European Union. Moreover, any non-member State of the Council of Europe which has not participated in the elaboration on the new Convention may be invited by the Committee of Ministers of the Council of Europe to accede to this Convention, under conditions specified in Article 54 of the new Convention.

text: 6. On 29 July 2025, the European Commission adopted two Proposals for a Council Decision on the signing and conclusion, on behalf of the European Union, of the Council of Europe Convention on the protection of the environment through criminal law (‘the Proposals’). The legal bases of the Proposals are

text: Article 83(2)

text: and

text: Article 218(5)

text: and (6) subparagraph 2(a) of the Treaty on the Functioning of the European Union (TFEU).

text: 7. The objectives of the Proposals are (1) to authorise the signing on behalf of the Union, of the Council of Europe Convention on the protection of the environment through criminal law, and (2) to approve this Convention .

text: 8. The present Opinion of the EDPS is issued in response to consultations by the European Commission of 29 July 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to these consultations, respectively in Recital 11 of the Proposal on the signing of the new Convention, and Recital 9 of the Proposal on the conclusion of this Convention. In this regard, the EDPS also notes that he was already previously informally consulted on one article of the new Convention, pursuant to recital 60 of EUDPR.

text: 2. General remarks

text: 9. The EDPS acknowledges the legitimacy and the importance of the global objective pursued by the new Convention, which aims at improving the protection of the environment by preventing and combating environmental crimes. The need for a high level of environmental protection is enshrined in Article 37 of the Charter of Fundamental Rights of the European Union.

text: 10. The EDPS recalls that, pursuant to

text: Article 216(1)

text: TFEU, international agreements concluded by the European Union ‘are binding upon the institutions of the Union and on the Member States’. Moreover, according to the settled case law of the Court of Justice of the European Union (‘CJEU’), international agreements become from their coming into force ‘an integral 9 10 part of Community law’ and they have primacy over acts of secondary Union legislation .

text: 11. Furthermore, the ‘obligations imposed by an international agreement cannot have the effect of prejudicing the constitutional principles of the EC Treaty, which include the principle that all Community acts must respect fundamental rights, that respect constituting a condition of their lawfulness’’ . It is therefore essential to ensure that the obligations stemming from the new Convention would not prejudice these principles as far as data protection is concerned.

text: 12. Against this background, the EDPS notes that Chapter VI of the new Convention is dedicated to “international cooperation” among the Parties to the Convention, which implies exchanges of information, including personal data. In particular,

text: Article 40(2)

text: provides that this Convention might be considered as the legal basis for mutual assistance in criminal matters among competent authorities, in respect of the offences established in accordance with this Convention.

text: 13. The EDPS welcomes the introduction of a specific article on data protection in Chapter VI -

text: Article 42

text: - which recalls the need to respect applicable legislation and international agreements governing the protection of personal data, for any transfer of personal data by a Party. In this regard, the EPDS recalls that all Member States of the Council of Europe are parties to the Convention 108 of the Council of Europe , which is also applicable in the law enforcement area. Therefore, the EDPS welcomes the reference to this Convention, as well as the Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data , in the Preamble of the new Convention. The EDPS supports efforts towards a prompt ratification by third countries of this Protocol as a meaningful step towards aligning with internationally recognised data protection principles, and as a signal of their engagement with broader standards and fundamental rights.

text: 14. Furthermore, the EDPS positively notes the reference to data protection rules in

text: Article 5(2)

text: (b) of the new Convention, in the context of exchange of information for strategic and operational purposes at the national level.

text: 3. Transfers of personal data from EU Member States to third countries

text: 15. The EDPS recalls that in the absence of an adequacy decision, transfers of personal data from EU Member States to a third country may be based on another legal ground, including a legally binding and enforceable instrument between public authorities or bodies .

text: 16. The EDPS notes that, pursuant to Article 49(2) of the new Convention, ‘the Parties to this Convention may conclude bilateral or multilateral agreements with one another on the matters dealt with in this Convention, for purposes of supplementing or strengthening its provisions or facilitating the application of the principles embodied in it’. In this respect, the EDPS considers that specific safeguards for the protection of personal data could be provided in such agreements, whenever an EU Member State transfers personal data on the basis of the new Convention to a third country, if there is not already a binding agreement governing the protection of personal data between these two States or an international agreement regulating the transfer of personal data, to which both are parties.

text: 4. Conclusions

text: In light of the above, the EDPS recommends to clarify in the explanatory report that Article 49(2) of the new Convention also encompasses the possibility to refer to bilateral or multilateral agreements for purposes of supplementing the data protection provisions of the new Convention in relation to the transfers of personal data from EU Member States to third countries. Brussels, 22 September 2025

text: (e-signed) Wojciech Rafał WIEWIÓROWSKI


text: OJ L 295, 21.11.2018, p. 39. 2 COM(2022) 571 final. 3 See Explanatory Report, p 1. 4 It also has to be noted that the Proposal, under

text: Article 17

text: , amends

text: Regulation (EU) 2018/1724

text: . As specified under recital 32, the Proposal includes the procedures concerning the registration by hosts in Annex II of

text: Regulation (EU) 2018/1724

text: , which established the single digital gateway, providing for general rules for the online provision of information, procedures and assistance services relevant for the functioning of the internal market. See Explanatory Report, p 1. 4

text: See EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data, issued on 19 December 2019. 7

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (Text with EEA relevance) (OJ L 119, 4.5.2016, p. 1). 8 A more complete wording would be [emphasis added to the missing words]: “[..] the data protection supervisory authorities are responsible for the supervision of compliance with

text: Regulation (EU) 2016/679

text: of the processing of personal data carried out in the context of this Regulation.” 9 See

text: Article 3(2)

text: . 10 See recital (9) of the Proposal, “the registration number, which is a unique identifier of the unit rented, should ensure that the data collected and shared by platforms can be properly attributed to hosts and units”. 5

text: See Judgment of the European Court of Justice of 9 November 2010 in Joint Cases

text: and

text: , Volker und Markus Schecke GbR (

text: ) and Hartmut Eifert (

text: ) v Land Hessen, ECLI:EU:C:2010:662, paragraph 53. 12 Having regard to small or micro online short-term rental platforms that did not, in the previous quarter, reach a monthly average of 2500 or more active hosts, the reporting of data must occur every three months (see

text: Article 9(2)

text: ). 6

text: See also recital 22: “[..] a national Single Digital Entry Point should be established as a gateway for the electronic transmission of data between online short-term rental platforms and competent authorities, ensuring timely, reliable and efficient data sharing processes.” 14 See also recital 27. This recital refers, in the last sentence, to activity data to “be made available via sectorial data spaces, when established”. The EDPS notes that at the moment it is not possible to assess in particular the necessity of proportionality of this possible data sharing. 15 See also recital 24. 7

identifier: EDPS yttrande 26/2022

title: Opinion on proposal for a regulation on data collection and sharing relating to short-term accommodation rental services and amending Regulation (EU) 2018/1724

text: 16 December 2022

text: Opinion 26/2022

text: on the Proposal for a Regulation on data collection and sharing relating to short-term accommodation rental services and amending

text: Regulation (EU) 2018/1724

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under

text: Article 52(2) of Regulation (EU) 2018/1725

text: ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under

text: Article 42(1) of Regulation (EU) 2018/1725

text: , the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on data collection and sharing relating to short-term accommodation rental services and amending

text: Regulation (EU) 2018/1724

text: . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the draft Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: Regulation (EU) 2018/1724

text: The Proposal aims to harmonise registration schemes and other transparency requirements for short-term rental (STR) services, as well as to enable, via the processing of data relating to STRs, the definition of appropriate policy responses when addressing issues such as affordable housing or the protection of the urban environment. The EDPS recalls in this regard, insofar as the processing concerns personal data, the need to comply with the principles of necessity and proportionality.

text: The Proposal establishes rules on registration of providers of STRs (hosts); lists the information that hosts must provide in order to receive a registration number; lays down the obligation for competent authorities to verify the information submitted by hosts, request additional information and suspend the validity of the registration number. It also provides rules on the obligation by online short-term rental platforms to ensure the validity of registrations by hosts.

text: Furthermore, the Proposal sets out the condition according to which competent authorities will

text: receive from online short-term rental platforms specific information about hosts’ activities

text: through the Single Digital Entry Point (SDEP). The Proposal also specifies which authorities can access the data collected and shared by online short-term rental platforms.

text: By this Opinion, the EDPS recommends amending

text: Article 2

text: to make clear in the enacting terms of the Proposal that the latter excludes the use of personal data processed pursuant to the Proposal for law enforcement or for taxation and customs purposes.

text: According to the Proposal online short-term rental platforms should not be required to report personal data related to guests. Indeed, ‘Activity data’, as defined under

text: Article 3(11)

text: , to be transmitted by short-term rental platform to competent authorities, only refer to “the number of nights for which a unit is rented and the number of guests that stayed in the unit per night”. The EDPS considers that this is a key element of the Proposal having regard to the need to ensure that the processing of personal data is limited to what is necessary and proportionate.

text: The EDPS also recommends specifying the categories of personal data to be submitted by hosts to the competent authorities of the Member States according to

text: Article 5(3)

text: , and to clarify the wording referring to the maximum period during which personal data will be stored.

text: Concerning the verification by competent authorities and by online short-term rental platforms of the information submitted by hosts, the EDPS welcomes the information to be provided to hosts on the outcome of this verification, enabling the host to challenge or correct such information.

text: The EDPS also recommends specifying whether the SDEP would store personal data.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 7 November 2022, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on data collection and sharing relating to short-term accommodation rental services and amending

text: Regulation (EU) 2018/1724

text: (‘the Proposal’) .

text: 2. The objective of the Proposal is to harmonise and improve the framework for data collection and data sharing on short-term accommodation rentals (‘STRs’) across the European Union, and enhance transparency in the STR sector .

text: 3. More specifically, the Proposal aims at establishing: (i) a harmonised approach to registration schemes for hosts, with an obligation on public authorities to maintain such schemes to obtain data for policy making and enforcement purposes ; (ii) an obligation on online platforms to enable the hosts to display registration numbers (which will ensure compliance with registration requirements by hosts) and to share specific activity data about hosts and their listings with public authorities; (iii) specific tools and procedures to ensure that data sharing is safe, GDPR-compliant and cost-effective, for all players involved .

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 7 November 2022, pursuant to Article 42(1) of the EUDPR. The EDPS welcomes the reference to this consultation in recital 38 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of the EUDPR.

text: 2. General remarks

text: 5. The EDPS takes note of the objectives of the Proposal, namely to harmonise registration schemes and other transparency requirements for STR services, as well as to enable, via the processing of data relating to STRs, the definition of appropriate policy responses when addressing issues such as affordable housing or the protection of the urban environment. At the same time, the EDPS recalls, insofar as the processing concerns personal data, the need to comply with the principles of necessity and proportionality . possible further use of personal data processed pursuant to the Proposal for law enforcement or for taxation and customs purposes. The EDPS supports such an exclusion, specified under recital 5, but recommends to reformulate

text: Article 2

text: to make this clearer in the enacting terms of the Proposal.

text: 7. The EDPS also welcomes recitals 26 and 37 of the Proposal, referring to the applicability of

text: Regulation (EU) 2016/679

text: (‘the GDPR’) having regard to the processing of personal data in the context of the Proposal. However, the EDPS considers that the last sentence of recital 37, specifying that “[T]herefore the data protection supervisory authorities are responsible for the supervision of the processing of personal data carried out in the context of this Regulation” is superfluous and incomplete . The EDPS hence recommends deleting this last sentence.

text: 3. Specific remarks

text: 3.1. Registration of hosts (Chapter II)

text: 8. The EDPS notes that Article 4 of the Proposal lays down the registration procedure for ‘hosts’, defined as “a natural or legal person that provides, or intends to provide, on a professional or non-professional basis, a short-term accommodation rental service against remuneration through an online short-term rental platform” .

text: 9. The EDPS also notes that the registration procedure allows for the release of a registration number by the competent authority upon the submission by the host of the information pursuant to Article 5 of the Proposal. In this regard, the EDPS observes that the registration number, as a unique identifier related, though indirectly as identifier of the unit rented, to a natural person or to a legal person identifying a natural person renting the unit (the host), may constitute personal data pursuant to Article 4(1) of the GDPR .

text: 10. Having regard to Article 5 of the Proposal, on the information to be provided by hosts for the registration procedure, the EDPS considers that Article 5(3) of the Proposal must specify the categories of personal data, if any, that may be further required by the competent authorities of the Member States, especially if these could also include special categories of personal data.

text: 11. The EDPS notices and welcomes the inclusion of the storage limitation principle in Article 5(5) of the Proposal. However, the EDPS suggests clarifying the wording referring to the storage limitation period in Article 5(5) of the Proposal. This could be more clearly formulated as [emphasis added to the words to be included] “only for a period which is necessary for the identification of the unit and, in any case, for a maximum of 1 year after the host has indicated via the functionality referred to in

text: Article 4(2)

text: , point (f) that the unit should be removed from the registry”.

text: 12. The EDPS also notes that the Proposal provides for the verification of the declaration for registration submitted by hosts. The verification is to be done by competent authorities (

text: Article 6

text: ), as well as by short-term rental platforms (

text: Article 7

text: ). order by competent authorities to remove or disable access to non-compliant listing notified to the host in writing stating the reasons for the intention to remove or disable access. At the same time, the EDPS welcomes that

text: Article 7(2)

text: requires that shortterm platform services inform (not only the competent authorities, but also) the hosts of the results of the random checks. This contributes to a ‘due process’ approach, enhancing data quality via verification by the hosts concerned.

text: 3.2. Reporting of data by online short-term rental platforms to competent authorities (Chapter III)

text: platforms to collect and transmit to competent authorities via a Single Digital Entry Point (‘SDEP’) the activity data per unit together with the corresponding registration

text: number as provided by the host and the URL of the listing, on a monthly basis .

text: 15. In this regard, the EDPS notes and welcomes that ‘activity data’, as defined under

text: Article 3(11)

text: , only refer to “the number of nights for which a unit is rented and the number of guests that stayed in the unit per night”. The EDPS welcomes in particular that personal data related to guests would not be processed pursuant to the Proposal. The EDPS considers that this is a key element of the Proposal having regard to the need to ensure that the processing of personal data is limited to what is necessary and proportionate in the relation to the purpose for which they are processed as specified in the Proposal.

text: 16. The EDPS points out in this regard that ‘activity data’, to be collected and transmitted pursuant to Article 9 of the Proposal as such, do not seem to constitute personal data. However, together with the registration number, they may constitute data relating to an identified natural person, and, therefore, be considered as personal data.

text: 17. The EDPS also notes that the transmission of activity data identified by the relevant registration number will occur via the SDEP, to be established by each Member State, pursuant to Article 10 of the Proposal .

text: 18. Having regard to Article 10(4) of the Proposal, the EDPS notes that, for instance when storing the registration number together with other data, the SDEP might indeed be storing personal data. Moreover, the EDPS notes that the “transient processing” might also entail storage (of personal data). Therefore, the EDPS, while welcoming the second sentence of

text: Article 10(4)

text: , according to which the SDEP “[...] shall ensure the automatic, intermediate and transient processing of personal data that is strictly necessary [...]”, recommends redrafting the first sentence of the same paragraph, according to which the SDEP “shall not store information containing personal data”.

text: 19. The EDPS welcomes the specification of the data retention period applicable to activity data processed by competent authorities under Article 12(3) of the Proposal, namely “no longer than 1 year after the receipt”.

text: 20. The EDPS notes that the last sentence of Article 12(3) of the Proposal refers to the possibility for competent authorities to share activity data without any data that can identify individual units or hosts, including registration number or URL, with, among others, “(a) authorities tasked with developing laws, regulations or administrative provisions concerning access to and provision of short-term accommodation rental services; (b) entities or persons carrying out scientific research, analytical activities or developing new business models, where this is necessary for the purpose of those activities.” In this regard, the EDPS considers that such data sharing only concerns non-personal data.

text: 21. Having regard to Article 12(4) of the Proposal, stating that activity data must be aggregated to be used for statistics by national statistical offices and Eurostat, the EDPS also recommends specifying that this provision refers to aggregation of non-personal data (notably, of activity data not ‘accompanied’ by registration number or any other reference that leads to identification or identifiability of hosts). Recital 27 of the Proposal indeed refers to the sharing of activity data, without any data that could enable the identification of individual units or hosts, such as registration numbers and URLs.

text: 22. Finally, the EDPS notes that, according to

text: Article 10(5)

text: , the Commission must adopt implementing acts laying down common technical specifications and procedures to ensure interoperability of solutions for the functioning of the Single Digital Entry Points and the seamless exchange of data, including the structure of the registration numbers . In this regard, and to the extent personal data would be processed, the EDPS recalls that the Commission is obliged to consult the EDPS pursuant to

text: Article 42(1)

text: EUDPR on these implementing acts.

text: 4. Conclusions

text: 23. In light of the above, the EDPS makes the following recommendations: (1) to amend

text: Article 2

text: to make clear in the enacting terms of the Proposal that the latter excludes the use of personal data processed pursuant to the Proposal for law enforcement or for taxation and customs purposes; (2) to delete the last sentence of recital 37; (3) to specify the categories of personal data that may be further required by the competent authorities of the Member States according to

text: Article 5(3)

text: ; (4) to clarify the wording referring to the storage limitation period in

text: Article 5(5)

text: ; (5) to consider the possible amendment of the first sentence of

text: Article 10(4)

text: in the light of the fact that SDEP might indeed store personal data; (6) to specify in

text: Article 12(4)

text: that this provisions refers to the aggregation of non-personal data. Brussels, 16 December 2022 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8


text: OJ L 295, 21.11.2018, p. 39. 2 COM(2023) 232 final. 3 COM(2023) 232 final, p. 1. 4 COM(2023) 232 final, p. 1.

text: Article 3(2)

text: (b) of the Proposal. 6 Article 4 of the Proposal. 7 Article 5 of the Proposal. 4

text: See COM(2023) 232 final, p. 11. 9

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (Text with EEA relevance), OJ L 119, 4.5.2016, p. 1. 5

text: A general statement declaring the information to be ‘of public interest’ without further qualification or explanation does not constitute a clearly defined objective of public interest justifying public accessibility. 11 See

text: Article 2

text: , definition 18, of the Proposal. 6

text: p.o. Leonardo CRVERA NAVAS Acting Head of EDPS Secretariat

identifier: EDPS yttrande 26/2023

title: EDPS Opinion 26/2023 on the Proposal for a Regulation on standard essential patents

text: 19 June 2023

text: Opinion 26/2023 on the Proposal for a Regulation on standard essential patents and amending

text: Regulation (EU) 2017/1001

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Directive of the European Parliament and of the Council amending Directive

text: as regards the scope of deposit protection, use of deposit guarantee schemes funds, cross-border cooperation, and transparency (COM(2023) 228 final). This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 27 April 2023 the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on standard essential patents and amending

text: Regulation (EU) 2017/1001

text: The Proposal aims at (i) making available detailed information on standard essential patents (SEPs) and existing fair, reasonable and non-discriminatory (‘FRAND’) terms and conditions to facilitate licensing negotiations; (ii) raise awareness of SEP licensing in the value chain and (iii) provide for an alternative dispute resolution mechanism for setting FRAND terms and conditions. The Proposal would create a competence centre within European Union Intellectual Property Office (EUIPO), which would be tasked to administer databases, a register and the procedures for essentiality checks of SEPs and the FRAND determination.

text: The EDPS notes that the Proposal would entail processing of personal data, notably personal data relating SEP holders and/or their legal representive, as well as personal data relating to evaluators and conciliators. For this reason, the EDPS recommends specifying in a recital that the processing of personal data in accordance with this Regulation shall be subject to the EUDPR and to

text: Regulation (EU) 2016/679

text: (‘the GDPR’).

text: Regarding the register and databases managed by EUIPO, the Proposal should clearly set out the specific purpose(s) for which personal data may be made available and provide for a procedure ensuring that only third parties who demonstrate a legitimate interest have access to such data. The Proposal should also specify in the enacting terms the role of EUIPO as controller under the EUDPR.

text: Finally, the EDPS invites the EU legislator to consider whether the 18-month retention period could be prescribed as a rule for personal data (regardless of the submission of a request), and, in any case, to specify who would be entitled to lodge such a request for removal of personal data to EUIPO.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 27 April 2023, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on standard essential patents and amending

text: Regulation (EU) 2017/1001

text: (‘the Proposal’).

text: 2. The overall objectives of the Proposal are to: (i) ensure that end users, including small businesses and EU consumers benefit from products based on the latest standardised technologies; (ii) make the EU attractive for standards innovation; and (iii) encourage both standard essential patents (‘SEP’) holders and implementers to innovate in the EU, make and sell products in the EU and be competitive in non-EU markets. The initiative aims to incentivise participation by European firms in the standard development process and the broad implementation of such standardised technologies, particularly in IoT industries .

text: 3. In this context, the initiative seeks to: (i) make available detailed information on SEPs and existing fair, reasonable and non-discriminatory (‘FRAND’) terms and conditions to facilitate licensing negotiations; (ii) raise awareness of SEP licensing in the value chain and (iii) provide for an alternative dispute resolution mechanism for setting FRAND terms and conditions .

text: 4. To achieve these objectives, the Proposal includes provisions that establish a competence center within the European Union Intellectual Property Office (‘the EUIPO competence center’), which would be tasked setting up and managing, inter alia, a roster of evaluators 5 6 and conciliators , establishing and maintaining a register of SEPs (‘the register’) and establishing and maintaining an electronic database for SEPs (‘the database’) .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 19 April 2023 pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in recital 50 of the Proposal.

text: 2. General remarks

text: 6. The EDPS welcomes the Commission’s Proposal, providing for enhanced transparency with regard to information necessary for SEP licensing; registration of SEPs; procedures for evaluating the essentiality of registered SEPs and procedures for determination FRAND terms and conditions for a SEP licence.

text: 7. The EDPS notes that the Proposal would entail processing of personal data, notably personal data relating to SEP holders and/or their legal representive, as well as personal data relating to evaluators and conciliators.

text: 8. Recital 14 of the Proposal specifies that the EUIPO competence centre should be the subject of Union rules on access to documents and data protection. As the Proposal would also entail processing of personal data by other entities, the EDPS recommends specifying in the recital that any processing of personal data in accordance with the Regulation shall be subject to the EUDPR and to

text: Regulation (EU) 2016/679

text: (‘the GDPR’) . The applicability of the EUDPR is triggered by the role of EUIPO as controller for the processing of personal data relating to the register and to the database. The applicability of the GDPR is triggered by the processing of personal data by entities which are not Union institutions, offices, bodies or agencies (e.g., SEP holders, patent pools).

text: 3. The register and the database

text: 9. According to Article 4(3) of the Proposal, the register of standard essential patents will contain the name, address and contact details of the SEP holder as well as the name, address and contact details of the SEP holder’s legal representatives in the Union, where relevant.

text: Article 4(6)

text: provides that the EUIPO competence centre must collect, organise, make public and store the items referred to in paragraphs (3) and (4), including any personal data for the purposes of this Regulation. Moreover, Article 4(7) of the Proposal states that the EUIPO competence centre must keep the register easily accessible for public inspection. It adds that the data must be considered to be of public interest and may be accessed by any third party free of charge.

text: 11. The EDPS understands that making available contact details of SEP holders and/or their legal representatives may be necessary to achieve the objectives of the Proposal, including the objective of facilitating licensing. As the publication of personal data constitutes an interference with the right to data protection, however, the Proposal should clearly specify the specific purposes for which personal data may be made available . Moreover, the EDPS considers that a procedure should be put in place to ensure that only third parties who demonstrate a legitimate interest have access to personal data.

text: 12. Having regard to the database, to be established under Article 5 of the Proposal, the EDPS notes that this may also contain personal data, notably of conciliators, as specified under

text: Article 5(2)

text: (i).

text: Article 5(2)

text: specifies that the information listed in this paragraph must be accessible to any third party subject to the registration with the EUIPO competence centre, whereas

text: Article 5(4)

text: specifies that public authorities, including courts, shall have full access to the information in the database free of charge, subject to registration with the competence centre. Also in this case, the EDPS recommends specifying the purpose of the data access, as well as that only registered third parties who demonstrate a legitimate interest will be provided with access to personal data.

text: 14. Finally, since the EUIPO competence centre, establishing and maintaining the register (and the database) will be established within EIUPO, as EUIPO administrative Unit , the Proposal should specify in the enacting terms of the Proposal the role of EUIPO as controller within the meaning of Article 3(8) of the EUDPR.

text: 4. Common provisions on the register and the database

text: 15. The EDPS notes that Article 6(2) of the Proposal states that the EUIPO competence centre must keep the files for 10 years after the removal of the registration of the SEP. The same paragraph specifies that, upon request, personal data may be removed from the register or the database after 18 months from the expiry of the SEP or removal of the SEP from the register.

text: 16. The Proposal does not elaborate why personal data should be kept in the register for a period of 10 years. The EDPS therefore invites the legislature to consider whether an 18month retention period could be prescribed as a rule for personal data regardless of the submission of a request, with the possibility to extend the retention period, where necessary, to safeguard the rights of individuals (e.g., in the context of possible exercise of legal claims). If the current provision were to be maintained, the Proposal should: (a) clearly set out the rationale for establishing a 10-year retention period; and (b) specify who would be entitled to lodge the request for removal of personal data to the EUIPO competence centre. In any event, the EDPS considers that the request for removal in accordance with Article 6(2) of the Proposal should be without prejudice to the data subject’s right to erasure in accordance with

text: Article 19

text: EUDPR.

text: 5. Exercise of delegation of powers by the Commission

text: 17. Finally the EDPS notices that, under Article 67 of the Proposal, the Commission would be empowered to adopt a delegated act referred to in Articles 1(4), 4(5) and 66(4) of the Proposal. Having regard to

text: Article 4(5)

text: , related to items to be entered in the register, the EDPS recalls that, when a proposal for legislation has a possible impact on the protection of personal data, the European Commission has to submit it to the EDPS for consultation in accordance with

text: Article 42(1)

text: EUDPR.

text: 6. Conclusions

text: 18. In light of the above, the EDPS makes the following recommendations: (1) to specify in Recital 14 that the processing of personal data in accordance with this Regulation shall be subject to the EUDPR and to

text: Regulation (EU) 2016/679

text: (‘the GDPR’); (2) to specify in

text: Article 4

text: the specific purposes for which personal data may be made available and to provide for a procedure ensuring that only third parties who demonstrate a legitimate interest have access to personal data; (3) to specify in

text: Article 5

text: the specific purpose for which personal data may be made available and to specify that only registered third parties who demonstrate a legitimate interest will be provided with access to personal data; (4) to specify in the enacting terms of the Proposal the role as controller of EUIPO under the EUDPR; (5) to consider whether an 18-month retention period could be prescribed as a rule for personal data regardless of the submission of a request, and, in any case, to specify who would be entitled to lodge such a request for removal of personal data to EUIPO. Brussels, 19 June 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7