text: OJ L 295, 21.11.2018, p. 39. 2 COM(2023) 773 final. 3 COM(2023) 774 final. 4 Article 1 of the Signing Proposal. Article 1 of the Conclusion Proposal. 4

text: Agreement between the European Union and Japan for an Economic Partnership, OJ L 330, 27.12.2018, p. 3. 7 Recommendation for a Council Decision authorising the opening of negotiations for the inclusion of provisions on cross-border data flows in the Agreement between the European Union and Japan for an Economic Partnership, COM(2022) 336 final, Recital 2. 8 EDPS Opinion 17/2022 on the Recommendation for a Council Decision authorising the opening of negotiations for the inclusion of provisions on cross-border data flows in the Agreement between the European Union and Japan for an Economic Partnership, 9 August 2022. 9 OJ L 330/3, 27.12.2018, p. 3. 10 Recital 2 of the Signing Proposal. 11 Signing Proposal, Explanatory Memorandum, Section 1, p.1. 5

text: EDPS Opinion 03/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, issued on 22 February 2021, paragraph 14. 13 Commission Implementing Decision

text: (EU) 2019/419

text: of 23 January 2019 pursuant to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information (Text with EEA relevance), OJ L 76, 19.3.2019, p. 1. 14

text: Article 45(1)

text: GDPR and Recital 5 of the Adequacy Decision. 15 https://trade.ec.europa.eu/doclib/docs/2018/july/tradoc_157130.pdf. 16 EDPS Opinion 03/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, issued on 22 February 2021, paragraph 15. 6

text: EDPS Opinion 17/2022 on the Recommendation for a Council Decision authorising the opening of negotiations for the inclusion of provisions on cross-border data flows in the Agreement between the European Union and Japan for an Economic Partnership, 9 August 2022, paragraph 12. 18 EDPS Opinion 03/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, issued on 22 February 2021, paragraphs 16- 22 and 38. 19 https://ec.europa.eu/commission/presscorner/detail/en/MEX_18_546. 20 As an example, the EDPS and the European Data Protection Board (EDPB) have recently recommended the co-legislators to require that controllers and processors, established in the EU/EEA and processing personal electronic health data within the scope of the Commission’s Proposal for a Regulation on the European Health Data Space, should be required to store this data in the EU/EEA, without prejudice to the possibility to transfer personal electronic health data in compliance with Chapter V GDPR. See EDPB-EDPS Joint Opinion 03/2022 on the Recommendation for a Regulation on the European Health Data Space, issued on 12 July 2022, paragraph 111. 7

text: According to footnote 2 of the Protocol, ‘“legitimate public policy objective" shall be interpreted in an objective manner and shall enable the pursuit of objectives such as the protection of public security, public morals, or human, animal or plant life or health, or the maintenance of public order or other similar objectives of public interest, taking into account the evolving nature of digital technologies’. 9

identifier: EDPS yttrande 03/2024

title: EDPS Opinion 3/2024 on the signing and conclusion on behalf of the European Union, of the Protocol amending the Agreement between the European Union and Japan for an Economic Partnership regarding free flow of data

text: 10 January 2024 Opinion 3/2024

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to (i) the Proposal for a Council Decision on the signing, on behalf of the European Union, of the Protocol amending the Agreement between the European Union and Japan for an Economic Partnership regarding free flow of data and (ii) the Proposal for a Council Decision on the conclusion, on behalf of the European Union, of the Protocol amending the Agreement between the European Union and Japan for an Economic Partnership regarding free flow of data. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 1 December 2023, the European Commission issued two proposals for a Council Decision on the signing and on the conclusion, on behalf of the European Union, of the Protocol amending the Agreement between the EU and Japan for an Economic Partnership regarding free flow of data.

text: On 23 January 2019, Japan was granted an adequacy finding by the Commission. Consequently, transfers of personal data from a controller or a processor in the European Economic Area (EEA) to organisations in Japan covered by the adequacy decision may take place without the need to obtain any further authorisation.

text: The Agreement for an Economic Partnership between the EU and Japan was signed on 17 July 2018. The objective of this Agreement is, in particular, to remove the vast majority of duties paid by EU and Japanese companies and other technical and regulatory trade barriers. On 12 July 2023, the Council authorised the Commission to negotiate the inclusion of provisions on cross-border data flows in the Agreement between the EU and Japan for an Economic Partnership.

text: The EDPS notes that the protocol amending the Agreement exclusively concerns cross-border data flows between the EU and Japan. Considering that Japan has already been granted an adequacy finding by the Commission, the EDPS recommends to further explain why, despite this adequacy decision, further negotiations on cross-border data flows were considered to be necessary.

text: The EDPS welcomes that the negotiated protocol provides that each party shall adopt or maintain a legal framework that provides for the protection of personal data related to electronic commerce.

text: The EDPS recalls that he supports the legal wording of the horizontal provisions for cross-border data flows and personal data protection in trade negotiations, published by the Commission in July 2018. These horizontal provisions reach a balanced compromise between public and private interests as they allow the EU to tackle protectionist practices in third countries in relation to digital trade, while ensuring that trade agreements cannot be used to challenge the high level of protection guaranteed by EU law.

text: The EDPS notes that the amending protocol does not integrally take over the horizontal provisions. In amending the legal wording of the horizontal provisions, the EDPS considers that the protocol creates legal uncertainty as to the Union’s position on the protection of personal data in connection with EU trade agreements and risks creating friction with EU data protection law. In particular, the EDPS is concerned that the protocol, in its current wording, could affect the EU’s personal data protection rules and the possibility for the EU to, in duly justified cases, enact measures that would require controllers or processors to store personal data in the EU/EEA.

text: To better reflect the legal wording of the horizontal provisions, the EDPS recommends amending the protocol in order to clarify that each party may adopt and maintain the safeguards it deems appropriate to ensure the protection of personal data and privacy, including through rules for the cross-border transfer of personal data. The EDPS also recommends clarifying that nothing in the Agreement shall affect the protection of personal data and privacy afforded by the parties’ respective safeguards.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 1 December 2023, the European Commission issued:  a proposal for a Council Decision on the signing, on behalf of the European Union, of the Protocol amending the Agreement between the European Union and Japan for an Economic Partnership regarding free flow of data (‘the Signing Proposal’) ; and  a proposal for a Council Decision on the conclusion, on behalf of the European Union, of the Protocol amending the Agreement between the European Union and Japan for an Economic Partnership regarding free flow of data (‘the Conclusion Proposal’) .

text: 2. The objective of the Signing Proposal is to approve the signing of the protocol amending the agreement between the European Union and Japan for an Economic Partnership regarding free flow of data ('the Protocol') .

text: 3. The objective of the Conclusion Proposal is to approve the Protocol .

text: 4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 1 December 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in the third citation of the Signing Proposal and Conclusion Proposal.

text: 2. General remarks

text: 5. By decision of 29 November 2012, the Council approved negotiating directives for the Commission to negotiate a free trade agreement with Japan, on the basis of which the Commission negotiated the Agreement between the European Union and Japan for an Economic Partnership, signed on 17 July 2018 (‘the Agreement’). The Agreement entered into force on 1 February 2019. The objective of the Agreement is, in particular, to remove the vast majority of duties paid by EU and Japanese companies and other technical and regulatory trade barriers.

text: 6. Chapter 8 of the Agreement contains provisions on trade in services, investment liberalisation and electronic commerce. Article 8.81 of the Agreement, which relates to the free flow of data, provides that '[t]he Parties shall reassess within three years of the date of entry into force of this Agreement the need for inclusion of provisions on the free flow of data into this Agreement’. In its meeting of 25 March 2022, the Joint Committee established by Article 22.1 of the Agreement examined whether the economic partnership between the European Union and Japan would benefit from the inclusion of provisions on cross-border data flows in the Agreement. Building on that examination, the representatives of the European Union and Japan, at the 28th EU-Japan summit (in May 2022), committed to consider the launch of the negotiations needed for such inclusion, as underlined in the Recommendation for a Council Decision authorising the opening of negotiations for the inclusion of provisions on cross-border data flows in the Agreement between the European Union and Japan for an Economic Partnership (the ‘Recommendation’) .

text: 7. The EDPS was consulted on this matter and issued on 9 August 2022 his Opinion 17/2022 on the Recommendation . On 12 July 2023, the Council authorised the Commission to negotiate the inclusion of provisions on cross-border data flows in the Agreement between the European Union and Japan for an Economic Partnership ('the Agreement') .

text: 8. On 28 October 2023, the negotiations of the provisions on cross-border data flows to be included in the Agreement were concluded .

text: 9. According to the Commission, the outcome of the negotiations confirms the EU and Japan’s continued commitment to the rules-based international trading system and joint determination to shape global data flow rules that respect shared values and respective regulatory approaches. As mentioned in the Signing Proposal, the EU and Japan agreed on rules addressing unjustified obstacles to data flows while preserving regulatory autonomy in the area of data protection and privacy .

text: 10. The Protocol should now be signed and approved on behalf of the EU.

text: 11. The EDPS has long taken the view that, as the protection of personal data is a fundamental right in the Union, it cannot be subject to negotiations in the context of EU trade agreements. It is for the EU alone to decide how to implement fundamental rights protections in Union law. The Union cannot and should not embark on any international trade commitments that are incompatible with its domestic data protection legislation. Dialogues on data protection and trade negotiations with third countries can complement each other but must follow separate tracks. Personal data flows between the EU and third countries should be enabled by using the mechanisms provided under the EU data protection legislation .

text: 12. In this regard, the EDPS positively notes that Japan has already been granted an adequacy finding by the Commission on 23 January 2019 (‘the Adequacy Decision) . Consequently, transfers of personal data from a controller or a processor in the European Economic Area (EEA) to organisations in Japan covered by the Adequacy Decision may take place without the need to obtain any further authorisation .

text: 13. In this context, the EDPS notes that the Protocol exclusively concerns cross-border data flows between the European Union and Japan. In view of the Adequacy Decision, the need for having additional rules covering cross-border data flows should be expressed in more detail so that the justification for an amendment of the Agreement is made clearer . In other words, the EDPS recommends to further explain why, despite the Adequacy Decision, further negotiations on cross-border data flows were considered to be necessary.

text: 3. Horizontal provisions on cross-border data flows

text: 14. On 31 January 2018, the European Commission endorsed horizontal provisions for crossborder data flows and personal data protection in trade negotiations (‘the Horizontal Provisions’), which were published in July 2018 .

text: 15. The EDPS recalls that he supports the legal wording of the Horizontal Provisions as the best outcome achievable to preserve individual’s fundamental rights to data protection and privacy. The Horizontal Provisions reach a balanced compromise between public and private interests as they allow the EU to tackle protectionist practices in third countries in relation to digital trade, while ensuring that trade agreements cannot be used to challenge the high level of protection guaranteed by the Charter of fundamental rights of the EU and the EU legislation on the protection of personal data .

text: 16. In his Opinion 17/2022, the EDPS welcomed that Recital 4 to the Recommendation confirmed that the negotiations would be opened ‘with a view to include the provisions on

text: data flows into the Agreement, coherent with the horizontal provisions for cross-border data flows and personal data protection in trade negotiations’ (emphasis

text: added) .

text: 17. In his Opinion 3/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, the EDPS recommended that the wording agreed with the UK on data protection and privacy (which modified the Horizontal Provisions) remained an exception and would not be the basis for future trade agreements with other third countries . On this note, the EDPS recalls that the Commission has repeatedly stated that as ‘the protection of personal data is a fundamental right in the EU, it cannot be subject to negotiations in the context of EU trade agreements’. Consequently, the Horizontal Provisions should not be up for negotiation .

text: 18. Nonetheless, the EDPS notes that the Protocol does not integrally take over the Horizontal Provisions. In amending the legal wording of the Horizontal Provisions, the EDPS considers that the Protocol creates legal uncertainty as to the Union’s position on the protection of personal data in connection with EU trade agreements and risks creating friction with the EU data protection legal framework. The EDPS reinstates that, as a matter of principle, the wording of the Horizontal Provisions should be kept in EU trade agreements containing provisions for cross-border data flows and personal data protection. He also stresses that any different wording resulting from negotiations in a specific case should not serve as a precedent for negotiations of EU trade agreements with other third countries on matters of cross-border data flows and personal data protection.

text: 4. Differences between the Horizontal Provisions and the Protocol

text: 19. The EDPS regrets that the legal wording of the Horizontal provisions was modified in the Protocol. In particular, the EDPS is concerned that the Protocol, in its current wording, could - contrary to the negotiating directives contained in the Recommendation - affect the EU’s personal data protection rules and the possibility for the EU to, in duly justified cases, enact measures that would require controllers or processors to store personal data in the EU/EEA .

text: 20. In this regard, Article 3 of the Protocol, which would replace Article 8.81 of the Agreement, states that ‘Nothing in this Article shall prevent a Party from adopting or maintaining measures on the protection of personal data and privacy, including with respect to cross-border transfers of information, provided that the law of the Party provides for instruments enabling transfers under conditions of general application for the protection of the information transferred’ (emphasis added). According to footnote 4 of the Protocol, ‘“conditions of general application” refer to conditions formulated in objective terms that apply horizontally to an unidentified number of economic operators and thus cover a range of situations and cases’. It is not clear whether all duly justified cases in which the EU would decide to require specific controllers or processors to store specific personal data in the EU/EEA based on grounds related to the fundamental rights to data protection and privacy would qualify as conditions of general application under the Protocol. In practice,

text: Article 8.81

text: (4) of the Agreement as formulated under Article 3 of the Protocol would not fully safeguard how the EU regulates the protection of personal data and privacy and would mean the Protocol regulates what a law applying to data transfers should look like in the EU.

text: 21. Furthermore, unlike Article B(2) of the Horizontal Provisions,

text: Article 8.81

text: (4) of the Agreement as formulated under Article 3 of the Protocol does not state that ‘[n]othing in this agreement shall affect the protection of personal data and privacy afforded by the Parties’ respective safeguards’. Article B(2) of the Horizontal Provisions was meant to ensure that if EU laws protecting privacy and related to data protection were challenged in a trade dispute, the EU would not need to justify its data protection and privacy laws under strict tests based on Article XIV of the General Agreement on Trade in Services. The absence of such wording in the Protocol would apparently not prevent the EU from having to pass strict trade tests to justify its measures safeguarding the fundamental rights to privacy and personal data protection.

text: 22. Therefore, the EDPS recommends replacing the new

text: Article 8.81

text: 23. In any event, even if

text: Article 8.81

text: (4) of the Agreement as formulated under Article 3 of the Protocol is not amended as suggested, the EDPS interprets the current wording as still allowing the EU to require, in duly justified cases, specific controllers or processors to store specific personal data in the EU/EEA based on grounds related to the fundamental rights to data protection and privacy, as long as there is a general framework (such as Chapter V of the GDPR) enabling transfers under conditions of general application.

text: 24. The EDPS notes that new

text: Article 8.81

text: (2)(f) of the Agreement as formulated under Article 3 of the Protocol would establish that a Party shall not adopt or maintain measures which prohibit or restrict the cross-border transfer of information by electronic means where this activity is for the conduct of the business of a covered person where such measures entail “requiring the approval of the Party prior to the transfer of information to the territory of the other Party”. The EDPS welcomes that footnote 1 of the Protocol clarifies that this provision would not prevent the EU from subjecting the use of a specific transfer instrument or a particular cross-border transfer of information to approval on grounds relating to the protection of personal data and privacy, in compliance with

text: Article 8.81

text: (4) of the Agreement under Article 3 of the Protocol. However, also for this reason, the EDPS stresses the need to alter the text of

text: Article 8.81

text: (4) of the Agreement as formulated under Article 3 of the Protocol, in line with the recommendation set out in paragraph 22 of this Opinion. 8

text: 25. The EDPS welcomes that

text: Article 8.81

text: (3) of the Agreement as formulated under Article 3 of the Protocol would allow the EU to adopt or maintain measures that would require (inter alia) the localisation of information (including personal data) in the territory of the EU for storage or processing or require the approval of the EU prior to the transfer of information to the territory of Japan to achieve a “legitimate public policy objective ” (other than the protection of personal data and privacy), under certain conditions.

text: 26. The EDPS regrets that, unlike Article B(1) of the Horizontal Provisions,

text: Article 8.82

text: (1) of the Agreement under Article 4 of the Protocol does not refer to the right to data protection as a fundamental right, but merely that “individuals have a right to the protection of their personal data and privacy as provided for by the laws and regulations of each Party and that high standards in this regard contribute to trust in the digital economy and to the development of trade.” On the other hand, he welcomes that

text: Article 8.82

text: (2) and (3) of the Agreement under Article 4 of the Protocol establish that “Each Party shall endeavour to adopt measures that protect individuals, without discrimination based on grounds such as nationality or residence, from personal data protection violations occurring within its jurisdiction”, and that “Each Party shall adopt or maintain a legal framework that provides for the protection of personal data related to electronic commerce.”

text: 27. The EDPS also notes that, contrary to Article X of the Horizontal Provisions, Article 8.82 of the Agreement under Article 4 of the Protocol does not contain provisions on regulatory dialogue and cooperation on regulatory issues with regard to digital trade.

text: 5. Conclusions

text: 28. In light of the above, the EDPS makes the following recommendations: (1) to detail in a recital the reasons why, despite the Adequacy Decision, further negotiations on cross-border data flows are considered to be necessary. (2) to replace the new

text: Article 8.81

text: (4) of the Agreement as formulated under Article 3 of the Protocol with the wording in Article B(2) of the Horizontal Provisions, which states that “Each Party may adopt and maintain the safeguards it deems appropriate to ensure the protection of personal data and privacy, including through the adoption and application of rules for the cross-border transfer of personal data. Nothing in this agreement shall affect the protection of personal data and privacy afforded by the Parties’ respective safeguards”. Brussels, 10 January 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 10


text: OJ L 295, 21.11.2018, p. 39. 2

text: Regulation (EU) 2017/2226

text: of the European Parliament and of the Council of 30 November 2017 establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third-country nationals crossing the external borders of the Member States and determining the conditions for access to the EES for law enforcement purposes, and amending the Convention implementing the Schengen Agreement and Regulations

text: (EC) No 767/2008

text: and

text: (EU) No 1077/2011

text: (EES Regulation) (OJ L 327 9.12.2017, p. 20). 3

text: Regulation (EU) 2016/399

text: of the European Parliament and of the Council of 9 March 2016 on a Union Code on the rules governing the movement of persons across borders (Schengen Borders Code) (OJ L 77, 23.3.2016, p. 1–52). 4 COM(2024) 567 final. COM(2024) 567 final, Explanatory memorandum, p. 3. 6 COM(2024) 567 final, Explanatory memorandum, p. 1. 4

text: COM(2024) 567 final, Explanatory memorandum, p. 3-4. 8

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1). 9 COM(2024) 567 final, Explanatory memorandum, p. 6. 5

identifier: EDPS yttrande 03/2025

amnesord:
EES
Borders, Asylum, Migration

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion 03/2025 on the Proposal for a Regulation on a progressive start of operations of the Entry/Exit system

serie: yttranden

text: 10 March 2025

type: rubrik

text: Opinion 03/2025

text: on the Proposal for a Regulation on a progressive start of operations of the Entry/Exit System

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on a temporary derogation from certain provisions of

text: Regulation (EU) 2017/2226

text: and

text: Regulation (EU) 2016/399

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 4 December 2024, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on a temporary derogation from certain provisions of

text: Regulation (EU) 2017/2226

text: (EES Regulation) and

text: Regulation (EU) 2016/399

text: (Schengen Borders Code) as regards a progressive start of operations of the Entry/Exit System.

text: The objective of the Proposal is to facilitate the operationalisation of the EES Regulation, thereby enabling Member States to achieve the system’s objectives in a timely and efficient manner. The specific objectives of the Proposal are to provide flexibility to Member States to start using the EES according to their level of readiness; to facilitate technical and operational adjustments during the first period of the EES operations by allowing the system to be gradually deployed; to better manage and avoid potential long waiting times at the external borders; to enable national authorities, travellers and carriers to adjust to the new border management processes and technologies; and others.

text: The EDPS considers that the Proposal raises concerns from the data protection perspective in relation to the accuracy of personal data processed. In particular, the personal data of the third country nationals crossing the external borders, registered in the EES during the period of the progressive start may be incomplete, and that fact may lead to potential negative consequences for them. Therefore, the EDPS underlines the need for the Proposal to lay down appropriate safeguards and that the Proposal should particularly clarify in its

text: Article 6

text: that decisions that could adversely affect individuals may not be taken solely on the basis that a registration of an alleged entry or exit is absent in the EES. The EDPS also recommends to extend the suspension of certain provisions of the EES Regulation provided for under Article 5(12) of the Proposal to Article 11 of the EES Regulation as regards the automated calculator providing information on the maximum duration of the authorised stay and to

text: Article 12(3)

text: EES Regulation as regards the automatically generated list of overstayers. Moreover, for legal certainty, this suspension should apply until the end of the progressive start of operations.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 4 December 2024, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on a temporary derogation from certain 2 3 provisions of

text: Regulation (EU) 2017/2226

text: and

text: Regulation (EU) 2016/399

text: as regards a progressive start of operations of the Entry/Exit System (‘the Proposal’).

text: 2. The general objective of the Proposal is to facilitate the operationalisation of the EES Regulation, thereby enabling Member States to achieve the system’s objectives in a timely and efficient manner. The specific objectives of the Proposal are, among others, to provide flexibility to Member States to start using the EES according to their level of readiness; to facilitate technical and operational adjustments during the first period of the EES operations by allowing the system to be gradually deployed; to better manage and avoid potential long waiting times at the external borders; to enable national authorities, travellers and carriers to adjust to the new border management processes and technologies; and others .

text: 3. One of the main reasons for the envisaged derogations from EES Regulation and Schengen Borders Code is the fact it is not possible to launch the EES in Q4 2024 as initially planned due to delays in the preparations of certain Member States. Moreover, the proposed progressive start of operations of the EES is considered preferrable compared to a full start of operations overnight as the latter constitutes a risk factor for the resilience of a complex IT system, such as the EES Central System .

text: 4. In addition, it should be noted that the progressive start of the EES operations will have an impact on the application of the Visa Information System (VIS) and the future European Travel Information and Authorisation System (ETIAS), as well as with the future interoperability components being developed by eu-LISA, namely the European Search Portal, the shared Biometric Matching Service, the Common Identity Repository and the Multiple-Identity Detector .

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 13 January 2025, pursuant to Article 42(1) of EUDPR, which is specifically referred in Recital 34 of the Proposal.

text: 2. General remarks

text: 6. The EDPS positively notes that the Proposal does not envisage or entail any derogations from the applicable data protection framework, namely

text: Regulation (EU) 2016/679

text: (GDPR) . He also welcomes that it does not change the current access rules to the EES, and the necessary safeguards set out in the EES Regulation, including the right to information .

text: 7. At the same time, the EDPS recalls the principle of accuracy under

text: Article 5(1)

text: (d) GDPR, more specifically in the context of the expected incompleteness of the data of the third country nationals crossing the external borders, being registered and further processed in the EES during progressive start of operations of the system. For the reasons explained in the following section of this Opinion, the potential processing of incomplete data would not seem consistent with the principle of accuracy.

text: 8. The EDPS notes with regret that the Proposal is not accompanied by a proper Impact Assessment. Even if the Explanatory Memorandum to the Proposal provides a generally clear and convincing arguments is support of the proposed change in the approach as regards the EES start of operations, the potential impact on the third country nationals crossing the external borders, on the one hand, and on a number of other IT systems linked to the EES through the interoperabilty framework deserve a more detailed assessment.

text: 9. This being said, the EDPS considers that the Proposal raise concerns from data protection perspective in relation to the accuracy of the personal data processed in the EES. In this regard, the EDPS recommends specific safeguards to protect individuals from potential adverse consequences of the processing of incomplete personal data. He also highlights certain aspects of the Proposal that require further clarification, as well as particular attention during the implementation phase.

text: 3. Incompleteness of the data recorded in the EES

text: 10. The EDPS notes that one of the practical consequences of the progressive start of operations of the EES is that the personal data of the third country nationals crossing the external borders registered in the EES during this period may be incomplete and that may lead to potential negative consequences for them. To prevent such consequences, the legislator has provided for the data protection principle of accuracy in

text: Article 5(1)

text: (d) GDPR, whereby the notion of adequacy includes both factual correctness and the need for data to be comprehensive enough for the intended purpose.

text: 11. The EDPS positively notes that the Proposal explictly acknowledges and addresses the possibility of such situations in Recitals 20-22 and in

text: Article 6

text: . He also recalls that one of the specific objectives of the Proposal is to “improve the current situation by ensuring that end users, such as border guards, immigration officials, visa authorities and law enforcement officers, have access to the most up-to-date information on travellers’ identities even if the data recorded in the system is incomplete due to the progressive deployment of the EES” .

text: 12. At the same time, the envisaged measures to mitigate the potential negative impacts of the possible incompleteness of the data recorded in the EES appear to be very general, namely a call to the concerned national authorities and the relevant Union agencies to “take into account” that fact. The only exception is the provision of Article 6(5) of the Proposal, which explicitly restricts during the progressive start of the EES operations the access of the authorised staff of the European Border and Coast Guard Agency to the data registered in the EES for the purpose of carrying out risk analyses and vulnerability assessments.

text: 13. The EDPS notes that the Proposal does not provide any justification why access to EES data during the progressive start of operations for operational purposes by authorities listed under

text: Article 6(1)

text: should be allowed, whereas access to EES data for strategic analysis by Frontex is not allowed. Given the negative impact that the use of incomplete EES data for operational purposes could have on the rights of data subjects, if access by the authorities listed under

text: Article 6(1)

text: is nevertheless granted, the Proposal should lay down specific guarantees for the data subjects that their rights will not be adversely affected by the processing of incomplete data.

text: 14. The EDPS therefore considers that the enacting terms of the Proposal should be more precise as to the actual meaning of the requirement in

text: Article 6

text: , imposed upon relevant authorities granted access to EES data, during the progressive start of operations – “to take into account” that such data could be incomplete – and provide for specific safeguards to protect individuals from potential adverse consequences of the processing of incomplete personal data. In particular, the Proposal should clarify that decisions that could adversely affect individuals may not be taken solely on the basis that a registration of an alleged entry or exit is absent in the EES. The EDPS stresses that it is a consequence of the fairness principle of the GDPR that the systemic, potentially incomplete filling of the EES must not be to the detriment of the data subject.

text: 15. In addition to the legal safeguards, the EDPS encourages the Commission to provide further practical guidance to the relevant national authority and Union agencies as regards the use of the data registered in the EES during the progressive start of operations of the EES. If feasible, such guidance could also be included in the Practical handbook for the implementation and management of the EES, which the Commission is obliged to prepare pursuant to Article 71 of EES Regulation.

text: 4. Automatic calculator and automatically generated list of overstayers

text: 16. The EDPS notes that according to Article 5(6) of the Proposal, the national authorities and Europol must “disregard” the results of (a) the automated calculator that provides information on the maximum duration of the authorised stay referred to in Article 11 of the EES Regulation and (b) the automatically generated list of overstayers and its consequences referred to in

text: Article 12(3)

text: and other provisions of the EES Regulation. Recital 10 of the Proposal clarifies the rationale for this provision by recalling that "data registered in the EES during the progressive start of operations might be incomplete". Consequently, the results of the automated calculator and the automatically generated list cannot be considered accurate and reliable.

text: 17. As the national authorities and Europol would be obliged to disregard the results of the automated calculator and the automatically generated list, processing of personal data through these tools during the progressive start of the operations does not seem necessary and proportionate. Also, it is not clear how compliance with the obligation to disregard the results of data processing through these tools would be effectively monitored in practice.

text: 18. At the same time, the EDPS notes Article 5(12) of the Proposal provides for the suspension of

text: Article 12(1)

text: and (2) EES Regulation, which refers to a mechanism automatically detecting potential overstaying by identifying which entry/exit records do not have exit data immediately following the time of expiry of authorised stay and for which the maximum duration of authorised stay has been exceeded. However, Article 5(12) of the Proposal does not provide for a suspension of Article 12(3) of the EES Regulation, which refers specifically to the automatically generated list of overstayers.

text: 19. The EDPS notes that it is not clear from the explanatory memorandum and the recitals whether the mechanism automatically detecting potential overstaying by identifying which entry/exit records do not have exit data is a prerequisite for creating the list of overstayers and whether the suspension of

text: Article 12(1)

text: and (2) of the EES Regulation would therefore automatically render the application of paragraph 3 of the same article practically impossible. Article 5(6) of the Proposal, according to which the national authorities and Europol must “disregard” the results of the automated calculator and the automatically generated list of overstayers, seems to suggest that Article 12(3) of the EES Regulation is meant to remain executable. The EDPS sees no justification for not suspending Article 12(3) of the EES Regulation. If the results of the processing may not be used due to the incompleteness of the data, then the preferred solution should be not to carry out (suspend) the processing in the first place, or at least to suppress displaying the results. In this specific context, the technical safeguards seem to be more effective in comparison with organisational measures, such as instructions to “disregard” the results. Moreover, the latter would more difficult to monitor than the former.

text: 20. Therefore, for the reason explained above, the EDPS considers that the suspension provided for under Article 5(12) of the Proposal should be extended and apply also to 7 Article 11 of the EES Regulation as regards the automated calculator providing information on the maximum duration of the authorised stay and to

text: Article 12(3)

text: EES Regulation as regards the automatically generated list of overstayers and its consequences. Furthermore, for legal clarity, the Proposal should specify that the suspension shall apply until the end of the progressive start of operations.

text: 5. Information campaign

text: 21. The EDPS recalls that pursuant to Article 51 of the EES Regulation, the Commission, in cooperation with the national supervisory authorities and the EDPS, should accompany the start of operations of the EES with an information campaign informing the public and, in particular, third-country nationals.

text: 22. The EDPS positively notes that pursuant to Article 5(11) of the Proposal, the information campaign will be updated to reflect the specific conditions stemming from the envisaged progressive start of the EES operations. In this context, the EDPS considers that the requirement for cooperation with the supervisory authorities referred in Article 51 of the EES Regulation applies to the additional information activities, too.

text: 6. Conclusions

text: 23. In light of the above, the EDPS makes the following recommendations: (1) to provide for specific safeguards to protect individuals from potential adverse consequences of the processing of incomplete personal data, in particular by clarifying in Article 6 of the Proposal that decisions that could adversely affect individuals may not be taken solely on the basis that a registration of an alleged entry or exit is absent in the EES during the progressive start of operations. (2) to extend the suspension provided for under Article 5(12) of the Proposal also to Article 11 of EES Regulation as regards the automated calculator providing information on the maximum duration of the authorised stay and to

text: Article 12(3)

text: EES Regulation as regards the automatically generated list of overstayers and its consequences. (4) to carry out the update of the information campaign as regards the specific conditions stemming from the progressive start of the EES operations in cooperation with the national supervisory authorities and EDPS, in line with Article 51 of EES Regulation. Brussels, 10 March 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8

type: vagledning

utgivare: edps


text: COM(2025) 840 final.

text: OJ L 295, 21.11.2018, p. 39. 3 COM(2025) 840 final. 4 Recital 6 of the Proposal notes that the PEPP Regulation has had very limited uptake, with only two providers active across the Union at the end of 2025. COM(2025) 840 final, pages 2 and 3. 6

text: Regulation (EU) 2019/1238

text: of the European Parliament and of the Council of 20 June 2019 on a pan-European Personal Pension Product (PEPP), OJ L 198, 25.7.2019, p. 1–63. 7 Idem.

text: Directive (EU) 2016/2341

text: of the European Parliament and of the Council of 14 December 2016 on the activities and supervision of institutions for occupational retirement provision (IORPs) (recast), OJ L 354, 23.12.2016, pp. 37–85. 9 Recital 5 of the Proposal. 10

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1). 11 Articles

text: and

text: of Regulation (EU) 2019/1238.

text: COM(2025) 842 final.

identifier: EDPS yttrande 03/2026

title: Opinion 3/2026 on the Proposal for a Regulation amending Regulation (EU) 2019/1238 on a pan-European Personal Pension Product (PEPP)

text: Regulation (EU) 2019/1238

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: ‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council amending

text: Regulation (EU) 2019/1238

text: on a pan-European Personal Pension Product (PEPP).

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: Regulation (EU) 2019/1238

text: The objective of the Proposal is to enhance the functionality and practical effectiveness of the PEPP Regulation by establishing a solid and efficient basis for a personal pension scheme that complements the statutory and occupational pension systems of the Member States. The Proposal also aims to facilitate the development of a more sophisticated PEPP with additional investment and/or risk management options, enabling providers to offer more tailor-made solutions that reflect different risk preferences, market conditions, and national contexts.

text: The EDPS welcomes the objectives of the Proposal, particularly the goal of giving Union citizens access to a simple, transparent, and portable pension product that they can trust, helping them to save with confidence and to plan for their retirement wherever they live or work in the Union.

text: Data about PEPP savers and beneficiaries qualifies as personal data within the meaning of EU data protection law and may contain special categories of personal data, in particular data concerning health. Therefore, it is important to clearly indicate which categories of personal data will be collected and shared and to ensure that appropriate safeguards are in place.

text: The Proposal establishes that, where pension tracking systems exist at the national level, PEPP providers and distributors would be required to share information with such pension tracking systems. The EDPS recommends defining clear rules for the functioning of pension tracking systems, including in what concerns the processing of personal data. The EDPS recommends empowering the Commission to define, by delegated or implementing act, the categories of personal data that should be shared by PEPP providers and distributors with the entities managing pension tracking systems.

text: Lastly, the EDPS recommends clarifying whether the offering of tailored (personalised) PEPPs according to the preferences, circumstances and risk profiles of savers would entail any form of profiling of individual PEPP savers.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 20 November 2025, the European Commission adopted the Proposal for a Regulation of the European Parliament and of the Council amending

text: Regulation (EU) 2019/1238

text: on a pan- European Personal Pension Product (PEPP) (‘the Proposal’).

text: 2. The Proposal aims to make the PEPP a more attractive and accessible option for savers across the Union considering the different retirement saving preferences and ensuring that there is a clear offer of a simple scheme designed to be transparent, and cost-effective, thereby keeping production and distribution costs low . The Commission considers that the Proposal would empower citizens to save and invest for their future through transparent, competitive, accessible and diverse products that better match their preferences regarding retirement savings, investment risk, and insurance coverage .

text: 3. The objective of the Proposal is to enhance the functionality and practical effectiveness of the PEPP Regulation , by establishing a solid and efficient basis for a personal pension scheme that complements the statutory and occupational pension systems of the Member States. The Proposal also aims to facilitate the development of a more sophisticated PEPP with additional investment and/or risk management options, enabling providers to offer more tailor-made solutions that reflect different risk preferences, market conditions, and national contexts . 4

text: 4. The Proposal is part of a broader pension package that includes the review of

text: Directive (EU) 2016/2341

text: , on which the EDPS is delivering a separate Opinion.

text: 5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 20 November 2025, pursuant to Article 42(1) of EUDPR. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR. The EDPS notes the reference to the present consultation in the Preamble of the Proposal. In line with standard practice, the EDPS recommends referring to the present consultation in a recital of the Proposal.

text: 2. General remarks

text: 6. The EDPS welcomes the objectives of the Proposal, particularly the objective of providing Union citizens access to a simple, transparent, and portable pension product that they can trust, helping them to save with confidence and to plan for their retirement wherever they live or work in the Union .

text: 7. Data about PEPP savers and beneficiaries relates to natural persons and, therefore, qualifies as personal data within the meaning of

text: Article 4(4) of Regulation (EU) 2016/679

text: (‘GDPR’) and

text: Article 3(1)

text: EUDPR.

text: 8. The EDPS notes that contracts concerning PEPPs can cover ‘biometric risks’, i.e., risks linked to death, disability and/or longevity . Therefore, records on PEPPs may contain special categories of personal data within the meaning of Article 9(1) of the GDPR, in particular data concerning health. Therefore, it is important to clearly indicate which categories of personal data will be collected and shared and to ensure that appropriate safeguards are in place.

text: 9. The EDPS notes that the GDPR would apply when personal data are processed in the context of the Proposal. He therefore welcomes the reference to the application of the GDPR in Recital 29 of the Proposal. Likewise, there would be situations where EU bodies covered by the Proposal such as the European Insurance and Occupational Pensions Authority (‘EIOPA’) would be subject to the EUDPR. The EDPS therefore recommends including a reference to the EUDPR in Recital 29 of the Proposal. 5

text: 3. Tailored PEPPs

text: 10. Article 1(17) of the Proposal aims to enable PEPP providers to offer more tailored solutions for savers, providing greater flexibility in the design of ‘tailored’ PEPP options. Recital 18 of the Proposal mentions that such PEPPs would be ‘personalised’ according to the preferences, circumstances and risk profiles of savers.

text: 11. The EDPS recommends clarifying further what is meant by ‘personalising’ PEPPs. In particular, the EDPS, recommends clarifying whether the design of tailored PEPP options would entail any form of profiling, as defined under

text: Article 4(4)

text: GDPR, of individual PEPP savers.

text: 4. Pension tracking systems

text: 12. Article 1(22) of the Proposal provides that “PEPP providers and PEPP distributors shall transmit to pension tracking systems, where pension tracking systems are in place in the Member State where the PEPP is distributed, all information necessary to provide customers with a comprehensive, reliable and up-to-date overview of their entitlements.” Such information (which qualifies as personal data of PEPP savers and beneficiaries) would be transmitted in “standardised and interoperable format enabling pension tracking systems to aggregate data on accumulated value, accrued rights and projected benefits in a coherent and comparable manner.”

text: 13. The EDPS invites the Commission to define “pension tracking systems” in the Proposal, notably by relying on the definition proposed for

text: Article 2(20) of Directive (EU) 2016/97

text: in Article 2(1) of the Proposal for a Directive of the European Parliament and of the Council amending Directives

text: (EU) 2016/2341

text: and 2016/97 as regards the strengthening of the framework for occupational retirement provision . He also recommends proposing clear rules for the functioning of pension tracking systems, including in what concerns the processing of personal data.

text: 14. In particular, the EDPS recommends empowering the Commission to define via a delegated or implementing regulation the format and structure of the information to be transmitted to pension tracking systems, including the categories of personal data to be shared by PEPP providers and distributors. 6

text: 5. Conclusions

text: 15. In light of the above, the EDPS makes the following recommendations: (1) to include a reference to the EUDPR in Recital 29 of the Proposal; (2) to clarify whether the design of tailored PEPP options would entail any form of profiling within the meaning of

text: Article 4(4)

text: GDPR of individual PEPP savers; (3) to define “pension tracking systems” in the Proposal; and (4) to define rules for the functioning of pension tracking systems, including in what concerns the sharing of personal data by PEPP providers and distributors with the entities managing pension tracking systems, and the subsequent processing of the personal data by such entities. Brussels, 9 January 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7