text: OJ L 119, 4.5.2016, p. 1 (hereinafter “GDPR”). OJ L 295, 21.11.2018, p. 39. OJ L 119, 4.5.2016, p. 89 (hereinafter “Law Enforcement Directive”). Proposal for a Regulation of the European Parliament and of the Council on European Production and Preservation Orders for electronic evidence in criminal matters, COM(2018) 225 final. Proposal for a Directive of the European Parliament and of the Council laying down harmonised rules on the appointment of legal representatives for the purpose of gathering evidence in criminal proceedings, COM(2018) 226 final. The Council adopted its general approach on the proposed Regulation on 7 December 2018, available at https://www.consilium.europa.eu/en/press/press-releases/2018/12/07/regulation-on-cross-border-access-to-eevidence-council-agrees-its-position/#. The Council adopted its general approach on the proposed Directive on 8 March 2018, available at https://www.consilium.europa.eu/en/press/press-releases/2019/03/08/e-evidencepackage-council-agrees-its-position-on-rules-to-appoint-legal-representatives-for-the-gathering-of-evidence/ Recommendation for a Council Decision authorising the opening of negotiations in view of an agreement between the European Union and the United States of America on cross-border access to electronic evidence for judicial cooperation in criminal matters, COM(2019) 70 final. Recommendation for a Council Decision authorising the participation in negotiations on a second Additional Protocol to the Council of Europe Convention on Cybercrime (CETS No. 185), COM(2019) 71 final; Convention on enhanced international cooperation on cybercrime and electronic evidence, Budapest, 23 November 2001, CETS No. 185. EDPS Opinion 3/2019 regarding the participation in the negotiations in view of a Second Additional Protocol to the Budapest Cybercrime Convention. Agreement of 25 June 2003 on mutual legal assistance between the European Union and the United States of America, OJ L 181, 19.7.2003, p. 34. Recent rulings and court cases in the US sought to clarify whether US authorities could order the production of data stored abroad by service providers which fall under US jurisdiction. Among those cases, the famous Microsoft Ireland Case reached the US Supreme Court after Microsoft refused to execute a US warrant to disclose data stored on its servers in Ireland and challenged the application of the US Stored Communication Act. On 23 March 2018, the US passed the Clarifying Lawful Overseas Use of Data (CLOUD) Act. On the one hand, the CLOUD Act amends the Stored Communication Act and clarifies US law enforcement authorities’ powers to order the production of data apply “regardless of whether such communication, record, or other information is located within or outside of the United States”. Thus, it confirmed that the power of US law enforcement authorities to serve warrants ordering the disclosure of data has extraterritorial reach and rendered the Microsoft Ireland Case moot. It also enacts into US law a practice of US law enforcement authorities to bypass Mutual Legal Assistance Treaties in criminal matters (MLATs) currently in place between the US and foreign countries, including the MLAT in force between the EU and the US. On the other hand, the CLOUD Act provides the possibility for the US to conclude “executive agreements” with “qualifying foreign governments”, which would allow law enforcement authorities of those third countries to directly request access to data in the US, including content data, under certain conditions. See Title 18 USC, § 2702. Commission Staff Working Document: Impact Assessment, SWD(2018) 118 final, available at: https://eurlex.europa.eu/legal-content/EN/TXT/?uri=SWD%3A2018%3A118%3AFIN. Available at: https://www.congress.gov/bill/115th-congress/house-bill/1625/text. See Title 18 USC, §§2511, 2523 and 2702. Explanatory memorandum of the Recommendation, p. 4-5. Explanatory memorandum of the Recommendation, p. 4. Paragraph 2 of the negotiating directives. CJEU,

text: Case 181/73

text: , R. & V. Haegeman v. Belgian State, ECLI:EU:C:1974:41, par. 5. CJEU, Joined cases

text: P and

text: P, Kadi v. Council, ECLI:EU:C:2008:461, par. 285. [Emphasis added]. CJEU, Opinion 1/15, EU-Canada PNR Agreement, ECLI:EU:C:2017:592. CJEU, Opinion 1/15, EU-Canada PNR Agreement, ECLI:EU:C:2017:592, par. 214; see also par. 93 of Opinion 1/15.

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and

text: on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89. This is a specific derogation from

text: Article 35(1)

text: (b) LED that personal data are transferred by law enforcement authorities in the EU Member States to a controller in a third country or international organisation that is also a law enforcement authority. The additional conditions are : “1 (...) (a) the transfer is strictly necessary for the performance of a task of the transferring competent authority as provided for by Union or Member State law for the purposes set out in

text: Article 1(1)

text: ; (b) the transferring competent authority determines that no fundamental rights and freedoms of the data subject concerned override the public interest necessitating the transfer in the case at hand; (c) the transferring competent authority considers that the transfer to an authority that is competent for the purposes referred to in

text: Article 1(1)

text: in the third country is ineffective or inappropriate, in particular because the transfer cannot be achieved in good time; (d) the authority that is competent for the purposes referred to in

text: Article 1(1)

text: in the third country is informed without undue delay, unless this is ineffective or inappropriate; (e) the transferring competent authority informs the recipient of the specified purpose or purposes for which the personal data are only to be processed by the latter provided that such processing is necessary. (...) 3. The transferring competent authority shall inform the supervisory authority about transfers under this Article. 4. Where a transfer is based on paragraph 1, such a transfer shall be documented”. See also EDPB Opinion 23/2018 of 26 September 2018 on Commission proposals on European Production and Preservation Orders for electronic evidence in criminal matters (hereinafter “EDPB Opinion 23/2018”), p. 9, available at: https://edpb.europa.eu/sites/edpb/files/files/file1/eevidence_opinion_final_en.pdf. Explanatory memorandum of the Recommendation, p 7. CJEU,

text: Case C-687/15

text: , European Commission v Council of the EU, ECLI:EU:C:2017:803, par. 48 and following. CJEU, Opinion 1/15, EU-Canada PNR Agreement, ECLI:EU:C:2017:592, par. 232. Paragraph 14 of the negotiating directives. Agreement between the United States of America and the European Union on the protection of personal information relating to the prevention, investigation, detection, and prosecution of criminal offences, OJ L 336, 10.12.2016, p. 3 (hereinafter “the Umbrella Agreement”). It mainly applies to personal data transfers between EU and US law enforcement authorities. It may also apply to personal data “otherwise transferred in accordance with an agreement concluded between the United States and the [EU] or its Member States” for law enforcement purposes (

text: Article 3(1)

text: ). Thus, the Umbrella Agreement can also cover transfers of personal data from relevant private companies where they are based on international agreements between the EU and the US, such as transfers by service providers under the envisaged agreement on cross-border access to electronic evidence. EDPS Opinion 1/2016 of 12 February 2016 on the agreement between the United States of America and the European Union on the protection of personal information relating to the prevention, investigation, detection and prosecution of criminal offences (hereinafter “EDPS Opinion 1/2016”), available at: https://edps.europa.eu/sites/edp/files/publication/16-02-12_eu-us_umbrella_agreement_en.pdf. See sections 4.3., 4.4., 4.5. below. The EDPS is working on guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data. A draft version of those guidelines were recently submitted to stakeholders’ consultation before the publication of the final version. They are available at: https://edps.europa.eu/sites/edp/files/publication/19-02-25_proportionality_guidelines_en.pdf. Explanatory memorandum of the Recommendation, p 5. See sections 3.4., 4.2., 4.9., 4.11. below. CJEU, Opinion 1/15, EU-Canada PNR Agreement, ECLI:EU:C:2017:592, specifically par. 134, where the Court found that “[e]ven though the means intended to ensure such a level of protection may differ from those employed within the European Union [...], those means must nevertheless prove, in practice, effective in order to ensure protection essentially equivalent to that guaranteed within the European Union”. Paragraph 1 of the negotiating directives. See the list of grounds to object mentioned under Article 14 of the e-evidence Proposal and the case law developed by the CJEU in the context of the European Arrest Warrant (CJEU,

text: Case C-404/15

text: , Pál Aranyosi and Robert Căldăraru v Generalstaatsanwaltschaft Bremen, ECLI:EU:C:2016:198, par. 82 and following). See

text: Articles 6

text: TUE and 67(1) TFUE. See also Fundamental Rights Agency Opinion of 14 February 2011 on the draft Directive regarding the European Investigation Order, footnote 56: “[i]n this context, one should be reminded of the principle of extraterritorial responsibility under the ECHR. EU Member States are responsible under the ECHR for human rights violations committed in another territory where through their action they have placed someone in that situation; see ECtHR, Soering v. United Kingdom, No 14038/88, 7 July 1989. See also

text: ECtHR, Bosphorus v. Ireland, No. 45036/98, 30 June 2005, par. 156 ‛the presumption will be that a State has not departed from the requirements of the Convention when it does no more than implement legal obligations flowing from its membership of the [EU].’ This presumption was considered to be rebuttable”. See Fundamental Rights Agency Opinion of 14 February 2011 on the draft Directive regarding the European Investigation Order, 14 February 2011, footnote 61 referring to ECtHR Case, MSS v. Belgium and Greece, No. 30696/09, 21 January 2011. Available at: http://data.consilium.europa.eu/doc/document/ST-15020-2018-INIT/en/pdf. See footnote 34 of the Council general approach “Czech Republic, Finland, Germany, Greece, Hungary and Latvia have a reservation on the notification procedure advocating for a procedure with more effect that also includes transactional data and a fundamental rights clause, i.e. providing for grounds for refusal to the notified authority; furthermore also rule on what should be considered a “national case” should be reversed; finally Germany advocating for submission of the Order instead of the Certificate, whereas Czech Republic is of the view that both the Order and the Certificate should be submitted”. See EDPB Opinion 23/2018, p. 16. See EDPB Opinion 23/2018, p. 17. See explanatory memorandum of the Recommendation, p. 8. See Prel. Doc. No 10 of December 2008 - The mandatory / non-mandatory character of the Evidence Convention [in civil and commercial matters]: https://assets.hcch.net/upload/wop/2008pd10e.pdf; and judgment of United States Supreme Court in Société Nationale Industrielle Aérospatiale v. United States District Court for the Southern District of Iowa, 482 US 522, 535, 548 (1987).

text: Article 35(1)

text: (b) provides that the onward transfer occurs between authorities responsible for the prevention, investigation, detection and prosecution of criminal offences.

text: Article 35(1)

text: (e) provides the principle of prior authorisation of the sending Member State. CJEU, Opinion 1/15, EU-Canada PNR Agreement, ECLI:EU:C:2017:592, par. 214. EDPS Opinion 1/2016, § 39 and 41. CJEU,

text: Case C‑201/14

text: , Smaranda Bara and Others v Președintele Casei Naționale de Asigurări de Sănătate, Casa Naţională de Asigurări de Sănătate, Agenţia Naţională de Administrare Fiscală, ECLI:EU:C:2015:638, in particular par. 32 and 33 where the Court found that “the requirement to inform the data subjects about the processing of their personal data is all the more important since it affects the exercise by the data subjects of their right of access to, and right to rectify, the data being processed, and their right to object to the processing of those data” and that “That information concerns the identity of the data controller, the purposes of the processing and any further information necessary to guarantee fair processing of the data”. CJEU, Opinion 1/15, EU-Canada PNR Agreement, ECLI:EU:C:2017:592, par. 220. [Emphasis added]. See CJEU,

text: Case C-518/07

text: , Commission v Germany, ECLI:EU:C:2010:125, par. 25; CJEU,

text: Case C-614/10

text: , Commission v Austria, ECLI:EU:C:2012:631, par. 36-37; CJEU,

text: Case C-288/12

text: , Commission v Hungary, par. 48; CJEU,

text: Case C-362/14

text: , Maximillian Schrems v Data Protection Commissioner, ECLI:EU:C:2015:650, par. 41. CJEU, Opinion 1/15, EU-Canada PNR Agreement, ECLI:EU:C:2017:592, par. 230. See paragraph 9 of the negotiating directives. CJEU,

text: Case C-362/14

text: , Maximillian Schrems v Data Protection Commissioner, ECLI:EU:C:2015:650, par. 95. CJEU,

text: Case C-362/14

text: , Maximillian Schrems v Data Protection Commissioner, ECLI:EU:C:2015:650, par. 95. [Emphasis added]. CJEU,

text: Case C-362/14

text: , Maximillian Schrems v Data Protection Commissioner, ECLI:EU:C:2015:650, par. 56- 58. EDPS Opinion 1/2016, par. 46. Available at: https://www.congress.gov/114/plaws/publ126/PLAW-114publ126.pdf. Paragraph 13 of the negotiating directives. See Title 18 USC, § 2703. See paragraph 6 of the negotiating directives. CJEU, Joined Cases

text: and

text: , Digital Rights Ireland and Seitlinger, ECLI:EU:C:2014:238, par. 39. CJEU, Joined Cases

text: and

text: , Digital Rights Ireland and Seitlinger, ECLI:EU:C:2014:238, par. 27. CJEU, Joined Cases

text: and

text: , Tele2 Sverige and Watson, ECLI:EU:C:2016:970, par. 99. See EDPB Opinion 23/2018, p. 12: “Indeed, the four categories proposed do not appear to be clearly delineated, and the definition of “access data” still remains vague, compared to the other categories”. See paragraph 7 of the negotiating directives. See paragraph 17(b) of the negotiating directives. CJEU,

text: Case C‑207/16

text: , Ministerio fiscal, ECLI:EU:C:2018:788, par. 54, see also par. 56. CJEU,

text: Case C‑207/16

text: , Ministerio fiscal, ECLI:EU:C:2018:788, par. 62. [Emphasis added].

text: See paragraph 15 of the negotiating directives. Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (principle of ‘integrity and confidentiality’ under

text: Article 5(1)

text: (f) GDPR and

text: Article 4(1)

text: (f) of the Law Enforcement Directive). The security of the processing covers in particular the ability to ensure the ongoing confidentiality and integrity of processing systems. See Title 18 USC, § 2703. See EDPB Opinion 23/2018, p. 17, where the EDPB recommended that the e-evidence Proposal “should at least foresee the minimum classic derogation that if there are substantial grounds for believing that the enforcement of an Order would result in a breach of a fundamental right of the person concerned and that the executing State would disregard its obligations concerning the protection of fundamental rights recognised in the Charter, the enforcement of the order should be refused”.

identifier: EDPS yttrande 02/2019

amnesord:
International Agreements
Umbrella Agreement
Judicial Cooperation

title: EU-US Agreement on Electronic Evidence

text: Opinion 2/2019

text: EDPS Opinion on the negotiating mandate of an EU-US agreement on cross-border access to electronic evidence

text: 2 April 2019 1 | P a g e

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’ and under article 57(1)(g), the EDPS shall ‘advise on his or her own initiative or on request, all Union institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data’.

text: He was appointed in December 2014 together with the Assistant Supervisor with the specific remit of being constructive and proactive. The EDPS published in March 2015 a five-year strategy setting out how he intends to implement this remit, and to be accountable for doing so.

text: This Opinion relates to the EDPS' mission to advise the EU institutions on coherently and consistently applying the EU data protection principles when negotiating agreements in the law enforcement sector, in line with Action 5 of the EDPS Strategy: ‘Mainstreaming data protection into international agreements’. It builds on the general obligation that international agreements must comply with the provisions of TFEU and the respect for fundamental rights that stands at the core of EU law. In particular, compliance with Articles 8 of the Charter of

text: Fundamental Rights of the EU and 16 TFEU must be ensured.

text: 2 | P a g e

text: Executive Summary

text: On 5 February 2019, the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations to conclude an international agreement with the United States of America (US) on cross-border access to electronic evidence. The Annex to the Recommendation sets out the Council’s directives to negotiate the agreement. The objective of the proposed agreement would be to address, through common rules, the legal issue of access to content and non-content data held by service providers in the EU and the US.

text: The EDPS welcomes and supports the objective of the Commission to conclude an agreement on cross-border access to electronic evidence with the US, thus ensuring a high level of protection for personal data in transfers between the EU and the US for law enforcement purposes, and appreciates the commitment to introduce sufficient safeguards. As the EDPS has long argued, the EU needs sustainable arrangements for sharing personal data with third countries for law enforcement purposes, which are fully compatible with the Charter of Fundamental Rights. Even when investigating domestic cases, law enforcement authorities increasingly find themselves in “cross-border situations” simply because a foreign service provider was used and the information is stored electronically in a third country. In practice, this often concerns service providers headquartered in the US due to their dominance on global markets. The growing volume of requests for electronic evidence and the volatility of digital information put a strain on existing models of cooperation, such as MLATs. The EDPS understands that authorities face a race against time to obtain data for their investigations and supports efforts to devise new models of cooperation, including in the context of cooperation with third countries.

text: This Opinion aims to provide constructive and objective advice as the Council has to deliver its directives before the start of this delicate task. It builds on the case-law of the Court of Justice of the European Union in recent years, which has affirmed data protection principles including fairness, accuracy and relevance of information, independent oversight and individual rights of individuals. These principles are as relevant for public bodies as they are for private companies and become all the more important considering the sensitivity of the data required for criminal investigations.

text: Against this background, the EDPS wishes to make the following observations:

text: - he welcomes that the Recommendation already includes important data protection safeguards, including the need to make the Umbrella Agreement applicable by reference, and supports the need for certain additional safeguards as proposed by the Commission; - given specific risks that arise in the context of direct cooperation between service providers and judicial authorities, he proposes to involve a judicial authority in the other party to the agreement; - he recommends adding Article 16 TFEU as a substantive legal basis.

text: Additionally, the Opinion offers further recommendations for possible improvements and clarifications of the negotiating directives. The EDPS remains at the disposal of the institutions for further advice during the negotiations and before the finalisation of the future EU-US agreement.

text: 3 | P a g e

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof, Having regard to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) , Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: , in particular Articles

text: (g) and 58(3)(c) thereof, Having regard to

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA ,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION AND BACKGROUND

text: 1. On 17 April 2018, the Commission issued a package of two legislative proposals: a Proposal for a Regulation on European Production and Preservation Orders for electronic evidence in criminal matters (hereinafter “the e-evidence Proposal”), and a Proposal for a Directive laying down harmonised rules on the appointment of legal representatives for the purpose of gathering evidence in criminal proceedings . While work is ongoing at the European Parliament, the Council of the European Union (the Council) has reached a general approach on those two proposals .

text: 2. On 5 February 2019, the Commission adopted two recommendations for Council Decisions: a Recommendation to authorise the opening of negotiations in view of an international agreement between the European Union (EU) and the United States of America (US) on cross-border access to electronic evidence for judicial cooperation in criminal matters (hereinafter “the Recommendation”), and a Recommendation to authorise the participation of the Commission on behalf of the EU in negotiations on a second Additional Protocol to the Council of Europe Convention on Cybercrime (CETS No. 185) . The Annex to the Recommendation (hereinafter “the Annex”) is of utmost importance since it lays down the recommended Council’s directives to the Commission to negotiate the agreement on behalf of the EU. The latter recommendation is the subject of a separate EDPS Opinion . However, the EDPS considers that both negotiations with the US and at the Council of Europe are closely linked. 5 | P a g e

text: 3. The Recommendation was adopted on the basis of the procedure laid down in Article 218 of the Treaty on the Functioning of the European Union (TFEU) for agreements concluded between the EU and third countries. With this Recommendation, the Commission seeks to obtain authorisation from the Council to be appointed as the negotiator on behalf of the EU and to start the negotiations with the US, along the negotiating directives annexed to the Recommendation. Once the negotiations are completed, in order for the agreement to be concluded, the European Parliament will have to give its consent to the text of the agreement negotiated, after which, the Council will have to adopt a decision concluding the agreement. The EDPS expects to be consulted on the text of the draft agreement in due course in accordance with

text: Article 42(1) of Regulation (EU) No 2018/1725

text: 4. The EDPS welcomes that he has been consulted following the adoption of the Recommendation by the European Commission, as well as by the Committee on Civil Liberties, Justice and Home Affairs of the European Parliament. The EDPS also welcomes the reference to his Opinion in Recital 4 of the Recommendation. He wishes to underline that the present Opinion is without prejudice to any additional comments that the EDPS could make on the basis of further available information at a later stage.

text: 2. OBJECTIVES OF THE AGREEMENT

text: 5. The objective of the Commission initiative is to address the specific legal issue of access to content and non-content data held by service providers in the EU and in the US, by establishing common rules in an international agreement. In doing so, it would complement the e-evidence Proposal by addressing conflict of laws between the EU and the US and, as the largest service providers are headquartered in the US, increase the Proposal’s effectiveness.

text: 6. The US has concluded bilateral Mutual Legal Assistance Treaties (MLAT) for the exchange of evidence in criminal matters with the majority of EU Member States. The EU-US MLAT , which was signed in 2003 and entered into force in 2010, complements those bilateral agreements. The Commission considers that there is a need to develop alternative channels of cooperation between the EU and the US and to allow direct cooperation between judicial authorities and service providers in transatlantic relations.

text: 7. Direct cooperation with US service providers already exists in practice to a certain extent. US law allows US based service providers to cooperate directly with public authorities of foreign countries . This cooperation only concerns non-content data and is voluntary from the perspective of US law . US companies have adopted their own policies to answer requests from foreign authorities or decide on a case-by-case basis; as a result, requests to US service providers are often not fulfilled and this practice lacks legal certainty. The US Stored Communications Act prohibits the disclosure of content data to foreign authorities. Under the US Clarifying Lawful Overseas Use of Data (CLOUD) Act , US service providers could potentially answer positively to requests for content data from authorities of qualifying foreign governments which concluded an executive agreement with the US .

text: 8. According to the Commission, an EU-US agreement on cross-border access to electronic evidence would complement the e-evidence Proposal, which may give rise to conflicting obligations for service providers deriving for third countries’ laws, and address the legal issues faced by law enforcement authorities when seeking access to both content and noncontent data held by service providers in the EU or the US . The envisaged agreement 6 | P a g e would pursue the three main objectives laid down in paragraphs 1, 2 and 3 of the negotiating directives in the Annex: 1) set common rules and address conflict of laws for orders for obtaining electronic evidence in the form of content and non-content data from judicial authorities to service providers in a cross-border context, which would enhance legal certainty; 2) allow for transfers of electronic evidence between those actors when they directly cooperate; 3) ensure respect of fundamental rights, freedoms and general principles of EU law, including the rights to privacy and data protection.

text: 3. MAIN RECOMMENDATIONS

text: 9. The EDPS supports the efforts to identify innovative approaches to obtain cross-border access to electronic evidence. He supports the Commission’s assessment that the EU “has an interest in a comprehensive agreement with the US, both from the perspective of protecting European rights and values such as privacy and personal data protection, and from the perspective of our own security interests” . An international agreement between the EU and the US would better preserve the level of protection guaranteed by the EU data protection framework and ensure a consistent level of protection throughout the EU, rather than distinct agreements concluded by Member States bilaterally. 3.1. Standards regarding international data transfers and the respect of fundamental rights

text: 10. The negotiating directives set out as second objective of the envisaged international agreement that it would “allow for a transfer of electronic evidence directly on a reciprocal basis by a service provider to a requesting authority” .

text: 11. Pursuant to

text: Article 216(2)

text: TFEU, international agreements to which EU is a party, such as the envisaged agreement, “are binding upon the institutions of the Union and on the Member States”. Moreover, according to the settled case law of the Court of Justice of the EU (CJEU), international agreements become from their entry into force “an integral part of [the European legal order]” .

text: 12. The CJEU found, with respect to international agreements concluded by the EU, that “the obligations imposed by an international agreement cannot have the effect of prejudicing the constitutional principles of the EC Treaty, which include the principle that all Community acts must respect fundamental rights, that respect constituting a condition of their lawfulness which it is for the Court to review in the framework of the complete system of legal remedies established by the Treaty” . The subsequent analysis takes as starting point the requirement for international agreements to be compliant with the EU system for the protection of fundamental rights. The Charter of Fundamental Rights of the EU (the Charter) not only guarantees the respect for private and family life (

text: Article 7

text: ), but it has also raised data protection to the level of a fundamental right under EU law (

text: Article 8

text: 13. The applicable standards of EU law with regard to international agreement providing for transfers of personal data have been considered by the CJEU. In July 2017, the CJEU delivered Opinion 1/15 on the international agreement regarding the transfer of Passenger Name Records (PNR) data to Canada, in which it sets out the conditions under which an 7 | P a g e international agreement can provide a legal basis for transfers of personal data. The CJEU found that “a transfer of personal data from the European Union to a non-member country may take place only if that country ensures a level of protection of fundamental rights and freedoms that is essentially equivalent to that guaranteed within the European Union” . It follows from Opinion 1/15 that the level of protection resulting from the envisaged agreement with the US for the exchange of personal data between national competent authorities and service providers for law enforcement purposes should similarly (to the agreement between the EU and Canada on the transfer of PNR data) be essentially equivalent to the level of protection provided for in EU law.

text: 14. In this context, attention is drawn to Article 35(1) of the Law Enforcement Directive (LED) that lists specific conditions for a Member State law enforcement authority to lawfully transfer data to addressees established in third countries, including the principle that, as a rule, the addressee of such transfers shall be a competent authority of a third country for the purposes of “prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security”. Transfers from Member States law enforcement authorities to other addressees, including private parties established in third countries, are 24 25 allowed only as a derogation under

text: Article 39

text: LED and only if further specific conditions are met. Such specific conditions include notably information to be provided to the competent data protection authority in their Member State and an obligation to document the transfer . The EDPS considers that the future EU-US agreement should at least include those additional conditions inspired by

text: Article 39

text: LED so as not to lower the level of data protection required by the LED. 3.2. Legal basis of the Council Decision

text: 15. The explanatory memorandum of the Recommendation states that “The Council shall authorise the opening of negotiations, adopt negotiating directives and authorise the signing and conclusion of the agreement as set out in

text: Article 218 (3)

text: and (4) of the Treaty on the Functioning of the European Union” .

text: Article 218 (3)

text: and (4) TFEU is also referred to in the preamble to the draft Council Decision. However, the preamble does not refer to any substantive legal basis for this legal act.

text: 16. In accordance with

text: Article 296 (2)

text: TFEU and the settled case law of the CJEU , the EDPS questions the fact that the citations in the preamble to the Council Decision only refer to the appropriate procedural legal basis and do not equally refer to the relevant substantive legal basis.

text: 17. The EDPS recommends that the citations in the preamble of the Council Decision not only refer to the appropriate procedural legal basis but also to the relevant substantive legal basis, among which

text: Article 16

text: TFEU. It already follows from section 1 of the Annex on the negotiating directives that the Commission should simultaneously pursue several objectives during the negotiations of the envisaged agreement, among which allowing the transfer of personal data and ensure respect for the fundamental rights enshrined in the Charter, including the rights to privacy and the protection of personal data. The envisaged agreement would thus relate directly to the objective pursued by

text: Article 16

text: TFEU. The EDPS recalls that, in a similar law enforcement context, the CJEU found that “the Council Decision on the conclusion of the envisaged Agreement [between Canada and the European 8 | P a g e 3.3. Safeguards of the Umbrella Agreement and additional safeguards

text: 18. The negotiating directives in the Annex provide that “The agreement should make applicable by reference the EU-U.S. Data Protection and Privacy Agreement, otherwise 30 31 known as the "Umbrella Agreement"” . The Umbrella Agreement entered into force on 1 February 2017 and establishes a framework for the protection of personal data exchanged between the EU and the US for law enforcement purposes . The Umbrella Agreement does not constitute a legal basis for transfers of personal data, and a proper legal basis for transfers to the US is always required. A legal basis for the transfer of personal data produced in answer to orders for electronic evidence is still required under EU law.

text: 19. The EDPS welcomes that the Umbrella Agreement, which he actively supported, should apply by reference and that this is included in the mandate. At the same time, the EDPS recalls that, in his Opinion 1/2016 on the Umbrella Agreement , he recommended essential improvements and insisted on the need to reinforce several safeguards. Since those issues have not been resolved in the final text of the Umbrella Agreement, the EDPS considers that the necessary improvements (addressed in sections below ) should be included in the negotiating directives themselves.

text: 20. As a rule, the Umbrella Agreement provides a minimum level of safeguards for transfers of personal data to the US for law enforcement purposes. While the envisaged agreement should not weaken those safeguards, it should increase the level of data protection, taking into account the specificities of the envisaged agreement and the risks involved for the rights and freedoms of data subjects. Therefore, the EDPS welcomes that paragraph 15 of the mandate envisages such additional safeguards and provides that “The agreement should complement the Umbrella Agreement with additional safeguards that take into account the level of sensitivity of the categories of data concerned and the unique requirements of the transfer of electronic evidence directly by service providers rather than between authorities”.

text: 21. In this respect, the EDPS recalls that, to meet the proportionality condition of Article 52(1) of the Charter, the advantages resulting from the measures should not be outweighed by the disadvantages those measure causes with respect to the exercise of fundamental rights . They would have to strike a fair balance between the need to speed up the process to secure and obtain electronic evidence for the purposes of investigating, detecting or prosecuting criminal offences and the sound protection of personal data and other fundamental rights of the persons concerned. The EDPS welcomes the attention already paid to privacy and data protection throughout the negotiating directives included in the Annex, and supports the statement that the envisaged agreement “should be conditional on strong protection mechanisms for fundamental rights” . He notes that paragraphs 16 and 17 of the negotiating directives provide a non-exhaustive list of additional safeguards to include in the agreement. He recommends replacing the words “inter alia” in both paragraphs 16 and 17 by “at the very least” to better convey that these safeguards are indispensable.

text: 22. Moreover, given the impact of the envisaged agreement on fundamental rights, the EDPS considers that certain further safeguards than those envisaged in the negotiating 9 | P a g e directives (that he will address individually in sections below ) should be included to ensure that the final agreement meets the proportionality requirement.

text: 23. Finally, the EDPS recalls that all safeguards provided in the envisaged agreement should not only be clear but also effective in order to fully comply with EU primary law and be in line with Opinion 1/15 of the CJEU . 3.4. Involvement of judicial authorities of the other Party to the agreement

text: 24. The negotiating directives clearly give instructions to establish a model of direct cooperation between judicial authorities and service providers, which is similar to the model proposed by the e-evidence Proposal, with the important difference that it envisages such direct cooperation between authorities of a third country - the US - and service providers in the EU (and vice versa). The EDPS notes that those directives do not refer to any systematic involvement of competent judicial authorities of the other party when orders would be issued. Paragraph 16(c) provides “that use by and disclosure to other U.S. authorities not bound by the Umbrella Agreement is subject to notification to, and prior authorisation by the competent judicial authority designated in the Member State in which the service provider is established or represented”. It is unclear whether this requirement of prior notification and authorisation relates to all orders issued by US competent authorities not bound by the Umbrella Agreement, or whether it relates to the communication of data by US authorities bound by the Umbrella Agreement to other US authorities not bound by it. The EDPS recommends clarifying paragraph 16(c).

text: 25. In the traditional approach to cross-border access to electronic evidence, it is primarily the responsibility of the enforcing State to ensure the review of limited grounds of refusal. While, as stated above, the EDPS recognises the need to identify alternative approaches to gathering evidence in a cross-border context, the need for effective guarantees for fundamental rights of data subjects remains of paramount importance. It is important to consider that relevant laws in the EU Member States and in the US - inter alia on the admissibility of evidence gathered in another country and what constitutes a criminal offence - may diverge.

text: 26. Furthermore, private entities may not be equipped to effectively deliver the required assessment. It is critical to keep in mind that despite being the addressees of orders, service providers are not the ones whose rights to privacy and to personal data protection are limited by the order. Yet, conditions for issuing an order are not harmonised on substance at international level and important objections against the recognition and enforcement of such order may exist . EU Member States have the legal obligation to respect fundamental rights when implementing EU law . In this regard, in the context of the EIO Directive negotiations, the Fundamental Rights Agency recalled that “a failure to ensure proper respect for fundamental rights in the execution of an EIO will engage the responsibility of the executing state under instruments such as the ECHR” .

text: 27. The EDPS points out that the Council adopted a general approach on the e-evidence Proposal in December 2018, which introduces a notification to the competent authorities of the executing Member States for orders to produce content data. This notification must take place at the same time as orders are sent to service providers and gives the possibility to the notified authorities to raise certain issues. Several Member States requested further involvement of the Member State where the service provider is located, beyond the 10 | P a g e notification introduced in the general approach and covering also non-content data . In addition, the European Data Protection Board (EDPB), which issued an Opinion on the eevidence Proposal, found no justification for addressing orders to service providers to produce content data “without any involvement at least of the competent authorities of the Member State where the data subject is” .

text: 28. Also, even in the EU context, the EDPB expressed in its Opinion on the e-evidence Proposal “its concerns as regards the removal of any double check by the receiving competent authority of the order transmitted, compared to the other instruments” . The EDPS considers that effective protection of fundamental rights in this context requires a degree of involvement of public authorities of the requested party to the envisaged agreement. He therefore recommends including as specific safeguard in the negotiating directives the obligation for EU and US competent authorities to systematically involve judicial authorities designated by the other Party as early as possible in the process of gathering electronic evidence, in order to give these authorities the possibility to effectively review compliance of the orders with fundamental rights and possibly to raise grounds for refusal, on the basis of sufficient information and within realistic deadlines. From an EU perspective, such involvement of EU judicial authorities would also be more in line with

text: Article 82(1)

text: TFEU (if this legal basis is included as one of the substantial legal basis of the Council Decision).

text: 4. ADDITIONAL RECOMMENDATIONS

text: 29. The EDPS would like to insist on the importance of providing concrete, specific and effective safeguards. Given the law enforcement context and the potential risks that such transfers of data could pose to data subjects, the safeguards included in the envisaged agreement with the US should satisfactorily address and mitigate these risks. 4.1. Mandatory nature of the agreement

text: 30. The negotiating directives specify that the envisaged agreement should “take precedence over the Council of Europe Convention on Cybercrime and any agreement or arrangement reached in the negotiations of the Second Additional Protocol”. However, they do not specify whether the CLOUD Act - which has a clear extraterritorial reach - could still be used by US law enforcement authorities to serve warrants ordering the disclosure of data on EU companies, if an EU-US agreement on cross-border access to e-evidence is concluded.

text: 31. The explanatory memorandum states that “it is in the interest of both the European Union and United States of America to conclude a comprehensive agreement as this would provide legal clarity for judicial and law enforcement authorities from both sides and avoid conflicting legal obligations for service providers” . To effectively achieve these objectives, the EDPS recommends clarifying in the negotiating directives the mandatory nature of the envisaged agreement in bilateral relations between the EU and the US.

text: 32. In addition, treaties and executive agreements concluded by the US might not be selfexecuting as implementing legislation is required to make their provisions enforceable in the US. Therefore, the EDPS recommends clarifying that the envisaged agreement should be self-executing from the perspective of US law. 11 | P a g e 4.2. Onward transfers

text: 33. Paragraph 16(d) of the negotiating directives provides that “onward transfers to other third countries may only be made to law enforcement authorities (...) and should be subject to notification to, and prior authorisation by the competent judicial authority designated by the Member State in which the service provider is established or represented”. The EDPS welcomes these requirements for onward transfers that are similar to those of Article 35 of the LED . However, the EDPS considers that as an additional requirement for onward transfers the second receiving competent authority in the other third country should provide an adequate level of protection.

text: 34. The EDPS points out that the CJEU held in Opinion 1/15 of July 2017 in relation to such onward transfers that the same requirement of ensuring a level of protection essentially equivalent to that guaranteed in the EU “applies in the case of the disclosure of PNR data by Canada to third countries (...) in order to prevent the level of protection provided for in that agreement from being circumvented by transfers of personal data to third countries and to ensure the continuity of the level of protection afforded by EU law” . The Court added that “such disclosure requires the existence of either an agreement between the European Union and the non-member country concerned equivalent to that agreement, or [an adequacy] decision of the Commission (...) covering the authorities to which it is intended PNR data be transferred”. Therefore, the EDPS recommends including this additional requirement in paragraph 16(d) of the negotiating directives. 4.3. Rights of data subjects

text: 35. The EDPS takes note of the fact that the Annex does not include any specific directive regarding data subject rights. The EDPS first recalls that the right of access and the right to rectification are essential elements of the right to data protection under Article 8(2) of the Charter. If the exercise of data subjects’ rights are usually limited in the law enforcement context in order to avoid jeopardising ongoing investigations, the possibility for data subjects to exercise their rights should exist in practice and not remain purely theoretical, even if limited or performed by a trusted third party in situations where the exercise of these rights is denied to protect sensitive law enforcement information.

text: 36. The Umbrella Agreement includes provisions on the right to be informed (

text: Article 20

text: ), the right of access (

text: Article 16

text: ), the right to rectification - which also refers to erasure and blocking (

text: Article 17

text: ) and the right not to be subject to automated decisions (

text: Article 15

text: ). As raised in his Opinion on the Umbrella Agreement , the EDPS considers that exemptions provided in the Umbrella Agreement regarding the exercise of the right to information and the right of access are so considerable that they might not allow the exercise of those rights.

text: 37. As regard the right of access, the EDPS considers that the envisaged agreement should make sure that the possibility for data subjects to have access to their own data de facto exist, even if limited or performed by a trusted third party.

text: 38. As regard the right to information, the EDPS notes that paragraph 17(e) of the negotiating directives provides that “The confidentiality safeguards for authorities and service providers, including non-disclosure requirements”. The right to information is of utmost importance as it allows the exercise of other data protection rights, including the right to 12 | P a g e remedies, and ensures fair processing of the data . Data subjects usually have no knowledge of the fact that their data are processed (or transferred) for law enforcement purposes. The EDPS recalls that the CJEU found in Opinion 1/15 that “air passengers must be notified of the transfer of their PNR data to Canada and of its use as soon as that information is no longer liable to jeopardise the investigations being carried out by the government authorities” considering that “[t]hat information is, in fact, necessary to enable the air passengers to exercise their rights to request access to PNR data concerning them and, if appropriate, rectification of that data, and, in accordance with the first paragraph of Article 47 of the Charter, to an effective remedy before a tribunal” .

text: 39. Therefore, the EDPS recommends including the right to information and the right of access in the negotiating directives so that the parties to the envisaged agreement increase their efforts to ensure that restrictions to the exercise of the right of access are selectively limited to what is indispensable to preserve the public interests pursued and to strengthen the obligation for transparency upon competent authorities. 4.4. Control by an independent authority

text: Article 16

text: TFEU and Article 8(3) of the Charter include as essential guarantee of the right to data protection: the control by an independent authority. While each Member State has appointed an independent authority in charge of supervising the data processing activities, including the transfer of data to third countries, there is also a need for an effective independent oversight once the data have been transferred in the receiving third countries.

text: 41. Article 21 of the Umbrella Agreement obliges the US to have in place one or more public oversight authorities which must “exercise independent oversight functions and powers”. The US must provide for oversight through more than one authority, which may notably include “inspectors general, chief privacy officers, government accountability offices, privacy and civil liberties oversight boards, and other applicable executive and legislative privacy or civil liberties review bodies”. The EDPS recalls that, pursuant to the CJEU case law , an independent supervisory authority within the meaning of Article 8(3) of the Charter is an authority able to make decisions independently from any direct or indirect external influence. Such a supervisory authority must not only be independent from the parties it supervises, but it should also not be “subordinate to a further supervisory authority, from which it may receive instructions” as this would imply that it is “not free from any external influence liable to have an effect on its decisions” .

text: 42. The EDPS recommends clearly identifying the specific authority or authorities entrusted by the US with the independent oversight of compliance with the rules of the envisaged agreement in the agreement. The effective powers that this specific authority or authorities may exercise over authorities to which personal data would be transferred on the basis of the agreement should also be specified. 4.5. Judicial redress and administrative remedies

text: 43. The EDPS welcomes that the mandate provides that “The agreement should include a clause enabling effective judicial remedies for data subjects during criminal proceedings” . 13 | P a g e

text: 44. The EDPS recalls that the CJEU found that the lack of effective judicial redress when personal data are transferred to a third country goes to the essence of Article 47 of the Charter, which provides for the right to effective judicial protection. In that context, the CJEU found that "legislation not providing for any possibility for an individual to pursue legal remedies in order to have access to personal data relating to him, or to obtain the rectification or erasure of such data, does not respect the essence of the fundamental right to effective judicial protection, as enshrined in Article 47 of the Charter" and that "the first paragraph of Article 47 of the Charter requires everyone whose rights and freedoms guaranteed by the law of the European Union are violated to have the right to an effective remedy before a tribunal in compliance with the conditions laid down in that article" .

text: 45. Also, the CJEU has stressed that it is essential for individuals to be able to file complaints with independent supervisory authorities and seek, therefore, administrative redress.

text: 46. The Umbrella Agreement includes two provisions - Articles

text: and

text: - on administrative and judicial redress. As raised in his Opinion on the Umbrella Agreement , the EDPS still has serious concerns about the compliance of

text: Article 19

text: with the Charter. He is aware that the US passed the Judicial Redress Act in February 2016, which extends certain rights of judicial redress established under the US Privacy Act to citizens of designated countries. However, he needs further information regarding the effective nature of those legal remedies, which is also a requirement of Article 47 of the Charter, based on a review of the way this Agreement is implemented in the US law and complied with in practice.

text: 47. Therefore, the EDPS recommends including in the mandate that the envisaged agreement should ensure that both redresses are available to all data subjects. 4.6. Categories of data subjects concerned

text: 48. The negotiating directives provide that “The agreement should be reciprocal in terms of the categories of persons whose data must not be requested pursuant to this agreement” .

text: 49. The EDPS notes that the CLOUD Act refers to so-called “US persons” and makes distinctions on this basis. For instance, it does not allow foreign service providers to object to orders from US law enforcement authorities on the basis of a conflict of law when the person whose data are sought is a “US person” .

text: 50. The EDPS recalls that the protection afforded by Articles 7 and 8 of the Charter, according to which the fundamental rights to privacy and personal data protection applies to "everyone" in the EU, irrespective of the nationality or status. Similarly the GDPR does not distinguish based on nationality or status and ensures the same level of protection to personal data of both EU citizens or residents and non-EU citizens or residents. Therefore, the EDPS considers that any distinction in the envisaged agreement regarding the level of data protection and safeguards ensured for the processing of personal data falling within the scope of the GDPR due to the US nationality or the residence in the US of the data subject would be unacceptable. The EDPS recommends making clear in the negotiating directives that the same level of data protection and similar safeguards should be ensured for all data subjects whose data will be processed based on the agreement. 14 | P a g e 4.7. Definition and types of data

text: 51. The negotiating directives provide that “The agreement should set out the definitions and types of data that are to be covered, including both content and non-content data” . The EDPS welcomes that the envisaged agreement should provide definitions of data categories which would be covered. He considers that the sole distinction between content data and non-content data may not be sufficient as both types of data could be as sensitive.

text: 52. In this respect, the EDPS first recalls that the CJEU found that access to content data may adversely affect the essence of the right to privacy .

text: 53. In relation to non-content data, the CJEU found as regards metadata, such as traffic data and location data, stored by providers of publicly available electronic communications that “taken as a whole, [they] may allow very precise conclusions to be drawn concerning the private lives of the persons whose data has been retained, such as the habits of everyday life, permanent or temporary places of residence, daily or other movements, the activities carried out, the social relationships of those persons and the social environments frequented by them” and “[provide] the means [...] of establishing a profile of the individuals concerned, information that is no less sensitive, having regard to the right to privacy, than the actual content of communications” .

text: 54. The EDPS stresses the importance of laying down clear and straightforward definitions of data categories in the envisaged agreement in order to ensure legal certainty for all stakeholders involved in the EU and the US - which is part of the first objective set out in paragraph 1 of the mandate. The effectiveness of orders to obtain electronic evidence could easily be undermined by the lack of precision and clarity of the core definitions of the envisaged agreement. To the extent the definitions of data categories in the e-evidence Proposal will be used as reference, as previously raised by the EDPB , the EDPS recommends ensuring a clear delineation between data categories and avoiding any overlap, which would also highly contribute to ensuring legal certainty regarding the substantive provisions of the agreement. 4.8. Criminal offences covered by the agreement

text: 55. The EDPS welcomes that the negotiating directives provide that “The agreement should define its exact scope of application in terms of the criminal offences covered and the thresholds” . Paragraph 17(b) further specify that the agreement should provide “adequate conditions to ensure necessity and proportionality of orders for access to electronic evidence, distinguishing in particular between the data categories as appropriate” .

text: 56. To comply with the proportionality condition of Article 52(1) of the Charter, the EDPS considers that a balance between the types of offences for which the production and transfer of personal data could be ordered and the categories of data concerned should be reached. Thus, distinctions should also be based on the seriousness of the offences investigated or prosecuted and the level of intrusiveness and sensitivity of the data categories sought. Thus, the EDPS recommends specifying in paragraph 17(b) of the negotiating directives that distinctions should also be made based on the seriousness of the offences concerned.

text: 57. The EDPS recalls that, according to the CJEU case law, only the objective of fighting serious crime is capable of justifying the access by public authorities to personal data retained by service providers “which, taken as a whole, allow precise conclusions to be drawn 15 | P a g e concerning the private lives of the persons whose data is concerned” . Where such conclusions cannot be drawn and therefore the interference is not deemed serious, the Court further held that “access to such data (...) is therefore capable of being justified by the objective (…) of preventing, investigating, detecting and prosecuting ‘criminal offences’ generally, without it being necessary that those offences be defined as ‘serious’” . Thus, under the envisaged agreement, the possibility to order the production and transfer of content data or non-content data which taken as a whole may allow very precise conclusions to be drawn concerning the private lives of the persons concerned should be limited to serious crimes only. 4.9. Information security

text: 58. Article 9 of the Umbrella Agreement obliges the EU and the US to “have in place appropriate technical, security and organisational arrangements for the protection of personal information”. The negotiating directives envisages “safeguards that take into account [...] the unique requirements of the transfer of electronic evidence directly by service providers rather than between authorities” . Among those specific safeguards, paragraph 16(f) provides that “The notification of an information security incident to the competent authority designated by the Member State in which the service provider is established or represented shall be made under the conditions of Article 10(2) of the Umbrella Agreement”.

text: 59. Given the model of direct cooperation between service providers and judicial authorities on different sides of the Atlantic, the EPDS considers that the envisaged agreement raises important questions regarding the security of cross-border incoming and outgoing transmission of personal data related to the execution of orders for electronic evidence. The EDPS wishes to stress that ensuring the security of personal data is not only a clear requirement under EU law , but it is also considered by the CJEU in relation to the essence of the fundamental right to data protection. Data security is also essential to ensuring the secrecy of investigations and the confidentiality of criminal proceedings.

text: 60. Therefore, the EDPS recommends including further safeguards in the mandate in order to ensure an appropriate level of security for the personal data produced and transferred. In addition to paragraph 16(f), the mandate should notably address the questions of the authenticity of orders and the security of the transmission of personal data to the requesting authorities which should be ensured. 4.10. Authorities competent to issue orders

text: 61. The EDPS considers that the envisaged agreement should clearly identify the authorities of both parties which would be competent to issue orders addressed directly to service providers. The EDPS notes that this is not specifically addressed in the negotiating directives. Therefore, he recommends including in the mandate that the agreement should identify which authorities may issue orders for electronic evidence.

text: 62. The EDPS stresses that compliance with the purpose limitation principle is closely linked to the scope of competence of recipients in the receiving third country. To ensure respect of the purpose limitation principle, the scope of competence of the specific authorities in the US to which data would be transferred and which would process these data should be clearly defined in order to ensure that they are also competent for the purposes of the transfer. In that sense, therefore, the EDPS recommends that the envisaged agreement be 16 | P a g e accompanied by an exhaustive list of the competent authorities in the US to which data could be transferred as well as a short description of their competences. This should also be reflected in one of the directives of the Annex. 4.11. Possibility for service providers to object

text: 63. Service providers receiving an order for electronic evidence addressed by US judicial authorities may find themselves caught between conflicting legal obligations under EU law and US law. The EDPS welcomes paragraph 9 of the negotiating directives which provides that “The agreement should also define in which circumstances a service provider has the right to object to an order”.

text: 64. In this regard, the EDPS notes that the US CLOUD Act allows foreign service providers to object to orders from US law enforcement authorities on the basis of a conflict of law only in limited cases. It allows them to file a so-called “motion to quash” in front of US courts on the cumulative conditions that the subscriber or customer whose data are sought is not a US person and does not reside in the US, and that the order raises a conflict of laws with a qualifying foreign government .

text: 65. The EDPS considers that service providers served with an order for electronic evidence should be able to object to an order on specific grounds defined in the envisaged agreement, such as missing or incorrect information or fundamental rights considerations . Those grounds should be clearly defined so as not to allow providers to decide on a case-by-case basis on whether and how to cooperate. Therefore, instead of defining “in which circumstances”, the EDPS recommends specifying in the negotiating directives that the agreement should also define “the specific grounds that a service provider may raise to object to an order”.

text: 5. CONCLUSIONS

text: 66. The EDPS understands the need for law enforcement authorities to secure and obtain electronic evidence quickly and effectively. He supports the efforts to identify innovative approaches to obtain cross-border access to electronic evidence. Therefore, this Opinion aims to provide constructive and objective advice to the EU institutions as the Commission seeks to obtain authorisation from the Council to negotiate with the US.

text: 67. The EDPS agrees with the Commission’s statement that the envisaged agreement should be conditional on strong protection mechanisms for fundamental rights. Several data protection principles and safeguards are already envisaged in the negotiating directives. He first recommends to include

text: Article 16

text: TFEU as one of the substantive legal basis in the preamble of the Council Decision. He welcomes that the Umbrella Agreement, which he actively supported, should apply by reference to the future agreement. In his Opinion 1/2016 on the Umbrella Agreement, the EDPS recommended essential improvements and the reinforcement of several safeguards; he recommends to include those safeguards in the negotiating directives.

text: 68. Given the impact of the envisaged agreement on fundamental rights, the EDPS also considers that further safeguards than those already envisaged should be included to ensure that the final agreement meets the proportionality condition. He notably recommends the involvement of judicial authorities designated by the other Party to the agreement as early 17 | P a g e as possible in the process of gathering electronic evidence so that these authorities would have the possibility to review compliance of the orders with fundamental rights and raise grounds for refusal.

text: 69. In addition to these general recommendations, the recommendations and comments of the EDPS in the present Opinion relate to the following specific aspects of the envisaged agreements to be negotiated with the US in the negotiating directives: - the mandatory nature of the agreement; - the onward transfers by US competent authorities; - the rights of data subjects in the US, in particular the right to information and the right of access; - the control by and independent authority in the US; - the judicial redress and administrative redress in the US; - the categories of data subjects concerned; - the definition and types of data covered by the envisaged agreement; - the criminal offences covered by the envisaged agreement; - the specific safeguards to ensure an appropriate level of security of the data transferred; - the type of authorities that can issue orders for electronic evidence; - the possibility for service providers served with an order for electronic evidence to object based on specific grounds.

text: 70. Finally, the EDPS remains at the disposal of the Commission, the Council and the European Parliament to provide advice at further stages of this process. The comments in this Opinion are without prejudice to any additional comments that the EDPS could make as further issues may arise and would then be addressed once further information is available. He expects to be consulted on the text of the draft agreement before its finalisation. Brussels, 2 April 2019 Giovanni Buttarelli European Data Protection Supervisor 18 | P a g e

text: NOTES

text: 19 | P a g e

text: 20 | P a g e

text: 21 | P a g e

text: 22 | P a g e


text: OJ L 119, 4.5.2016, p. 1. 2 OJ L 295, 21.11.2018, p. 39. 3 OJ L 119, 4.5.2016, p. 89. 4 OJ L 29, 31.1.2020, p. 7. 5 Article 184 of the Withdrawal Agreement provides: ‘The Union and the United Kingdom shall use their best endeavours, in good faith and in full respect of their respective legal orders, to take the necessary steps to negotiate expeditiously the agreements governing their future relationship referred to in the Political Declaration of 17 October 2019 and to conduct the relevant procedures for the ratification or conclusion of those agreements, with a view to ensuring that those agreements apply, to the extent possible, as from the end of the transition period.’

text: OJ C 34, 31.1.2020, p. 1. COM(2020) 35 final. 8 Page 2 of the Recommendation. 9 2020/2557(RSP) European Parliament Resolution of 12 February 2020 on the proposed mandate for negotiations for a new partnership with the United Kingdom of Great Britain and Northern Ireland (P9_TA(2020)0033).

text: Paragraph 11 of the Annex. According to

text: Article 3

text: TEU, ‘[i]n its relations with the wider world, the Union shall uphold and promote its values and interests and contribute to the protection of its citizens. It shall contribute to [...] the protection of human rights [...], as well as to the strict observance and the development of international law, including respect for the principles of the United Nations Charter’. 11 Paragraph 17 of the Annex. 12 Paragraph 44 of the Annex. 13 Contribution of the EDPB to the evaluation of the GDPR under

text: Article 97

text: adopted on 18 February 2020. 14 Paragraphs 112-120 of the Annex. 15 Paragraph 113 of the Annex.

text: Paragraph 12 of the Annex. 17 Paragraph 9 of the Political Declaration. 18

text: Article 47 of Regulation (EU) 2018/1725

text: . 19

text: Article 70(1)

text: (s) of the GDPR and

text: Article 51(1)

text: (g) of the Law Enforcement Directive. In this regard, the EDPS underlines that as far as GDPR adequacy decisions are concerned, the EDPB endorsed the WP29 Working document on Adequacy Referential (wp254rev.01). 20 See the Political Declaration, paragraph 9:‘The future relationship will not affect the Parties’ autonomy over their respective personal data protection rules’. See also UK Government’s written statement on the UK / EU relations: - HCWS86 of 3 February 2020:

text: ‘Future cooperation in other areas does not need to be managed through an international Treaty, still less through

text: shared institutions. The UK will in future develop separate and independent policies in areas such as (but not

text: limited to) the points-based immigration system, competition and subsidy policy, the environment, social policy,

text: procurement, and data protection, maintaining high standards as we do so. Cooperation on foreign affairs and

text: related issues is of course likely to be substantial, but does not in itself require a joint institutional framework’.

text: ‘Similarly, the UK would see the EU’s assessment processes on financial services equivalence and data adequacy as technical and confirmatory of the reality that the UK will be operating exactly the same regulatory frameworks as the EU at the point of exit. The UK intends to approach its own technical assessment processes

text: in this spirit’. 21 See in particular paragraphs 32, 33 and 92 of the Resolution. 22 Paragraph 10 thereof. 23 See Internal EU27 preparatory discussions on the future relationship: "Personal data protection (adequacy decisions); Cooperation and equivalence in financial services" published on the UKTF website on 10 January 2020, pages 8 and 16.

text: In its Opinion 1/15, EU-Canada PNR Agreement, ECLI:EU:C:2017:592, paragraph 214, the CJEU held, in relation to onward transfers by a third State of PNR data that the same requirement of ensuring a level of protection essentially equivalent to that guaranteed in the EU ‘applies in the case of the disclosure of PNR data by Canada to third countries [...] in order to prevent the level of protection provided for in that agreement from being circumvented by transfers of personal data to third countries and to ensure the continuity of the level of protection afforded by EU law’. The Court added that ‘such disclosure requires the existence of either an agreement between the European Union and the non-member country concerned equivalent to that agreement, or [an adequacy] decision of the Commission [...] finding that the third country ensures an adequate level of protection within the meaning of EU law and covering the authorities to which it is intended PNR data be transferred’. 25 See the Political Declaration, paragraph 9 : ‘Noting that the United Kingdom will be establishing its own international transfer regime, the United Kingdom will in the same timeframe take steps to ensure the comparable facilitation of transfers of personal data to the Union, if the applicable conditions are met. The future relationship will not affect the Parties’ autonomy over their respective personal data protection rules’.

identifier: EDPS yttrande 02/2020

amnesord:
International Agreements
International Cooperation

publisher: Europeiska datatillsynsmannen

sprak: en

title: Opening of negotiations for a new partnership with the UK

serie: yttranden

text: Opinion 2/2020

type: rubrik

text: EDPS Opinion on the opening of negotiations for a new partnership with the UK

text: 24 February 2020 1 | P a g e

type: stycke

text: 24The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’ and under article 57(1)(g), the EDPS shall ‘advise on his or her own initiative or on request, all Union institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the EDPS' mission to advise the EU institutions on coherently and consistently applying the EU data protection principles, including when negotiating agreements with third countries. It builds on the general obligation that international agreements must comply with the provisions of TFEU and the respect for fundamental rights that stands at the core of EU law. In particular, compliance with Articles 7 and 8 of the Charter of Fundamental Rights of the EU and Article 16 TFEU must be ensured.

text: 2 | P a g e

text: Executive Summary

text: On 3 February 2020, the European Commission adopted a Recommendation for a Council Decision authorising the opening of negotiations for a new partnership with the United Kingdom of Great Britain and Northern Ireland.

text: The objective of the negotiations is to establish a partnership between the Union, and Euratom where relevant, and the United Kingdom, that is comprehensive and covers areas of interest outlined in the Political Declaration. Such partnership would be composed of three main parts: general provisions, containing inter alia the underlying principles and basis for cooperation as well as the governance provisions, an economic partnership and a security partnership.

text: This Opinion aims at providing constructive and objective advice in relation to the envisaged partnership and the adequacy assessment.

text: The EDPS makes the following three main recommendations in relation to the envisaged partnership:

text: - ensuring that the security and the economic partnerships are underpinned by similar commitments to respect fundamental rights including adequate protection of personal data;

text: - defining priorities where arrangements for international cooperation should be concluded in matters other than law enforcement, in particular for the cooperation between public authorities, including Union institutions, bodies, offices and agencies;

text: - assessing the issue of onward transfers of personal data, in the light of the Opinion 1/15 of the CJEU both for the economic and the security partnerships.

text: With regard to the assessment of adequacy, the EDPS draws the attention on the following points:

text: - the importance of such assessment under the Law Enforcement Directive and under the GDPR for cooperation between public authorities and its impact on transfers by Union institutions, bodies, offices and agencies to the UK;

text: - the importance of defining the scope of the envisaged adequacy decisions, in particular under the Law Enforcement Directive;

text: 3 | P a g e

text: - the adoption of an adequacy decision is subject to specific conditions and requirements and, should the Commission present a draft adequacy decision, the EDPB should be appropriately and timely involved;

text: - given the specific situation of the UK, any substantial deviation from the EU data protection acquis that would result in lowering the level of protection would constitute an important obstacle to the adequacy findings.

text: The EDPS finally recommends that the Union take steps to prepare for all eventualities, including where the adequacy decision(s) could not be adopted within the transition period, where no adequacy decision would be adopted at all, or where it would be adopted only in relation to some areas.

text: The EDPS remains at the disposal of the Commission, the European Parliament and the Council for further advice during the negotiations and before the finalisation of the envisaged partnership.

text: 4 | P a g e

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof, Having regard to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) , Having regard to

text: Regulation (EC) No 2018/1725

text: of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular Articles

text: (g) and 58(3)(c) thereof, Having regard to

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA ,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION

text: 1. On 1 February 2020, the United Kingdom of Great Britain and Northern Ireland (hereinafter the ‘UK’) withdrew from the European Union and European Atomic Energy Community. The arrangements for the withdrawal are set out in the Agreement on the withdrawal of the UK from the European Union and the European Atomic Energy Community .

text: 2. The Withdrawal Agreement entered into force on 1 February 2020 and provides for a transition period during which Union law applies to and in the United Kingdom in accordance with that Agreement. This period will end on 31 December 2020, unless the Joint Committee established under the Withdrawal Agreement adopts, before 1 July 2020, a single decision extending the transition period for up to 1 or 2 years. The Withdrawal Agreement was accompanied by a Political Declaration setting out the 6 | P a g e framework for the future relationship between the European Union and the United Kingdom 2020/C 34/01 (hereinafter ‘Political Declaration’) .

text: 3. On 3 February 2020, the European Commission adopted its recommendation for a Council Decision authorising the opening of negotiations for a new partnership with the United Kingdom of Great Britain and Northern Ireland (hereinafter ‘the Recommendation’). The Annex to the Recommendation (hereinafter ‘the Annex’) lays down the Council’s negotiating directives to the Commission, i.e. the objectives the latter should aim to achieve on behalf of the EU in the course of the negotiations.

text: 4. The Recommendation was adopted on the basis of the procedure laid down in Article 218 of the Treaty on the Functioning of the European Union (TFEU) for agreements concluded between the EU and third countries. As for the substantive legal basis, the Commission recommends the Decision to be based at this stage on

text: Article 217

text: TFEU (association agreement) while recognising that ‘the substantive legal basis for the signature and conclusion of the new partnership can only be determined at the end of the negotiations’.

text: 5. ‘The envisaged partnership is a single package that comprises three main components: – general arrangements (including provisions on basic values and principles and on governance); – economic arrangements (including provisions on trade and level playing field guarantees); and – security arrangements (including provisions on law enforcement and judicial cooperation in criminal matters, as well as on foreign policy, security and defence)’ .

text: 6. On 12 February 2020, the European Parliament adopted a Resolution on the proposed mandate for negotiations for a new partnership with the UK.

text: 7. The EDPS welcomes that he was consulted on the Recommendation by the European Commission on 12 February 2020. This Opinion is without prejudice to any additional comments that the EDPS could make on the basis of further available information at a later stage. The EDPS expects to be consulted on the text of the draft partnership in due course, in accordance with

text: Article 42(1) of Regulation (EU) No 2018/1725

text: 2. THE IMPORTANCE OF SAFEGUARDING FUNDAMENTAL RIGHTS AND FREEDOMS IN ALL AREAS

text: 8. The EDPS supports the Commission in its endeavours to aim at a comprehensive partnership and to achieve as much as possible during the transition period. Indeed being close neighbours, the EU and UK will continue to have many interests in common so that an extensive exchange of information, including personal data, between the EU and the UK can be expected. It is therefore of utmost importance to 7 | P a g e ensure that the envisaged comprehensive partnership fully respects for fundamental rights and the Union’s personal data protection rules.

text: 9. The EDPS welcomes therefore the recommended negotiating directives (Part I of the Annex) according to which ‘respect for and safeguarding human rights and fundamental freedoms, democratic principles, the rule of law [...] should constitute essential elements for the cooperation envisaged in the partnership’ .

text: 10. In relation to the economic partnership (Part II of the Annex), the EDPS supports the recommendations according to which the economic partnership should ensure that Parties retain the ability ‘to regulate economic activity according to the levels of protection each deems appropriate in order to achieve legitimate public policy objectives such as [...] privacy and data protection, [...]’ and ‘that while facilitating digital trade, it should not affect the Union’s personal data protection rules ’. However, as mentioned by the EDPB Contribution to the evaluation of the GDPR under

text: Article 97

text: ‘[i]n the field of international negotiations, the Commission should continue its current practice to exclude data protection from the discussions on trade agreements’.

text: 11. In relation to the security partnership (Part III of the Annex), concerning section 2, law enforcement and judicial cooperation in criminal matters , the Commission recommends linking the level of ambition of the law enforcement and judicial cooperation envisaged in the security partnership with the level of protection of personal data ensured in the UK. It recommends under paragraph 113 of the Annex, ‘automatic termination of the law enforcement cooperation and judicial cooperation in criminal matters if the [UK] were to denounce the [ECHR]’, ‘automatic suspension if the [UK] were to abrogate domestic law giving effect to the ECHR’ and the ‘suspension of the law enforcement cooperation and judicial cooperation set out in the security partnership, if the adequacy decision is repealed or suspended by the Commission or declared invalid by the [CJEU]’. Given that the UK is a former EU Member State, the EDPS strongly supports this recommendation which aims at ensuring that the UK will maintain its commitments towards the protection of fundamental rights, including privacy and personal data protection in this area.

text: 12. The EDPS welcomes that in relation to the law enforcement and judicial cooperation in criminal matters part of the envisaged security partnership, the Recommendation aims at underpinning the partnership ‘by commitments to respect fundamental rights including adequate protection of personal data’ . Nevertheless, we note that this recommendation appears to be related only to these matters. The EDPS considers that these commitments can prove to be just as important in the context of transfers of personal data in areas other than law enforcement and judicial cooperation in criminal 8 | P a g e matters. He therefore recommends ensuring that the economic partnership is also underpinned by similar commitments.

text: 3. ADEQUACY DECISIONS AS THE APPROPRIATE FRAMEWORK FOR TRANSFERS OF PERSONAL DATA

text: 13. The EDPS particularly welcomes the recommended negotiating directives reiterating the Political Declaration by including data protection among the initial provisions, as a basis for cooperation and mentioning ‘the adoption by the Union of adequacy decisions, if the applicable conditions are met’. The EDPS supports the Commission’s objectives and wishes to underline the importance of such assessment for the future cooperation between the EU and the UK, be it under the

text: Regulation (EU) No 2016/679

text: (hereinafter ‘GDPR’) or the

text: Directive (EU) No 2016/680

text: (hereinafter ‘Law Enforcement Directive’). Indeed the future relationship with the UK will entail the transfer of personal data in law enforcement area and in other areas in particular for the cooperation between public authorities. It is all the more important since the adoption of adequacy decisions under Articles 45 of the GDPR and 36 of the Law Enforcement Directive is also relevant for the transfers of personal data from Union Institutions, bodies, offices and agencies to third countries, ‘where the personal data are transferred solely to allow tasks within the competence of the controller to be carried out’ .

text: 14. Given the level of ambition of the envisaged partnership, it will be of paramount importance to clearly define the scope of the envisaged adequacy decisions, in particular the one pursuant to Article 36 of the Law Enforcement Directive. The definition of the scope should provide clarity about the applicable legal framework for the various forms of data exchange envisaged in the partnership, such as PNR data under the security partnership.

text: 15. The EDPS recalls that the adoption of an adequacy decision is subject to specific conditions and procedural requirements under the GDPR and the Law Enforcement Directive to be assessed by the Commission. Under the EU legal framework, the EDPB shall provide the Commission with an opinion for the assessment of the adequacy of the level of protection in a third country . Consequently, should the Commission proceed to a draft adequacy decision, all necessary documentation should be provided to the EDPB in a timely manner as required under

text: Article 70(1)

text: (s) GDPR, so as to allow an informed Opinion to be issued.

text: 16. Given the unique status of UK as a former Member State of the EU having, in principle, integrated all the EU acquis into its national law, the EDPS would like to emphasise that any substantial deviation that would result in lowering the level of protection would constitute an important obstacle to a finding of adequacy . Also, were the 9 | P a g e Commission to adopt an adequacy decision, it must subsequently monitor developments in the UK and, if it considers that the UK no longer provides an adequate level of protection, it can repeal, amend or suspend its decision in accordance with

text: Article 45(4)

text: and (5) of the GDPR and

text: Article 36(4)

text: and (5) of the Law Enforcement Directive.

text: 17. Finally, the EDPS recommends that the Union take steps to prepare for all eventualities, including cases where the adequacy decision(s) could not be adopted within the transition period, where no adequacy decision would be adopted at all, or where it would be adopted only in relation to some areas. In this respect, the EDPS draws attention to the European Parliament’s Resolution adopted on 12 February 2020, which identifies a number of concerns as to the level of protection of personal data in the UK .

text: 4. ARRANGEMENTS ON INTERNATIONAL COOPERATION IN SPECIFIC AREAS

text: 4.1. Scope

text: 18. The Political Declaration states that, ‘[i]n this context, the Parties should also make arrangements for appropriate cooperation between regulators’ . The Commission Task Force for Relations with the UK mentioned that this paragraph builds on Article 50 of the GDPR in order to facilitate the enforcement of data protection legislation (exchange of information in the context of investigations, joint investigations, exchange of best practices, personnel, etc.) . The EDPS would like to emphasise in this regard that arrangements for data sharing are necessary in law enforcement matters as well as in matters covered by the GDPR. For example, the envisaged relationship with the UK is expected to entail close cooperation between the UK and the EU across many areas, necessitating transfers of personal data, and notably sensitive data, between public authorities, including the Union institutions, bodies, offices and agencies or judicial cooperation in civil or commercial matters, where arrangements on cooperation would be needed. 4.2. Conditions

text: 19. The EDPS also supports the recommendation to include in the mandate for the negotiations that the possible future arrangements in relation to PNR data should 10 | P a g e ‘comply with the relevant requirements, including those set out in the Opinion 1/15 of the CJEU’ . In this context, he recommends carefully assessing the issue of onward transfers of personal data for both the economic and the security partnerships, including in the context of the processing of DNA, fingerprints and vehicle registration data (Prüm), and not only in the framework of the processing of PNR data. This is all the more important that to date, there is little information as to whether and under which conditions the UK will provide for transfers of personal data to third countries .

text: 5. CONCLUSION

text: 20. The EDPS welcomes and supports the objective of the Commission to conclude a comprehensive partnership with the UK, establishing a cooperation the essential elements of which should be in particular the respect for and safeguarding of human rights as well as the rule of law, affirming the Parties’ commitment to ensuring a high level of personal data protection and fully respecting the Union’s personal data protection rules.

text: 21. Given the close cooperation that is expected to continue between the EU and the UK at the end of the transition period, the EDPS also welcomes and supports the Commission’s commitment in its Recommendation to work towards the adoption of adequacy decisions, provided that the relevant conditions are met.

text: 22. Therefore, this Opinion aims at providing constructive and objective advice to the EU institutions as the Commission seeks to obtain authorisation from the Council to negotiate a new partnership with the UK and intends to work towards adequacy decisions if the conditions are met.

text: 23. To this end, in relation to the envisaged partnership, the EDPS recommends:  ensuring that the security and the economic partnerships are underpinned by similar commitments to respect fundamental rights including adequate protection of personal data;  defining priorities where arrangements for international cooperation should be concluded in matters other than law enforcement, in particular for the cooperation between public authorities, including Union institutions, bodies, offices and agencies; 11 | P a g e  assessing the issue of onward transfers of personal data, in the light of the Opinion 1/15 of the CJEU, not only in the framework of the processing of PNR data but both for the economic and the security partnerships.

text: 24. With regard to the assessment of adequacy, the EDPS highlights the importance of:  such assessment under the Law Enforcement Directive and under the GDPR for cooperation between public authorities and its impact on transfers by Union institutions, bodies, offices and agencies to the UK;  defining the scope of the envisaged adequacy decisions, in particular under the Law Enforcement Directive.

text: 25. He recalls that the adoption of an adequacy decision is subject to specific conditions and requirements and, should the Commission present a draft adequacy decision, the EDPB should be appropriately and timely involved. He emphasises that given the specific situation of the UK, any substantial deviation from the EU data protection acquis that would result in lowering the level of protection would constitute an important obstacle to the adequacy findings. The EDPS also recommends that the Union take steps to prepare for all eventualities, including where the adequacy decision(s) could not be adopted within the transition period, where no adequacy decision would be adopted at all, or where it would be adopted only in relation to some areas.

text: 26. Finally, the EDPS remains at the disposal of the Commission, the Council and the European Parliament to provide advice at further stages of this process. The comments in this Opinion are without prejudice to any additional comments that the EDPS could make as further issues may arise and would then be addressed once further information is available. He expects to be consulted on the text of the draft partnership before its finalisation. Brussels, 24 February 2020 Wojciech Rafał WIEWIÓROWSKI 12 | P a g e

type: vagledning

utgivare: edps